mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
global:
|
|
enabled: true
|
|
tlsDisable: true
|
|
injector:
|
|
enabled: true
|
|
# The chart's default anti-affinity forbids two injector pods on one
|
|
# node, so on this single node a rolling update can never start the new
|
|
# pod while the old one runs. Recreate removes the old pod first, which
|
|
# also gets past pods that still carry the old anti-affinity.
|
|
affinity: ""
|
|
strategy:
|
|
type: Recreate
|
|
rollingUpdate: null
|
|
server:
|
|
# Pinned to the running version: the chart would otherwise pull its own
|
|
# default on the next pod restart, and with Shamir unsealing a Vault
|
|
# upgrade needs someone with the unseal keys at hand. The StatefulSet
|
|
# uses OnDelete, so after a sync tools/vault-roll.sh <tag> restarts and
|
|
# unseals the pods one at a time.
|
|
image:
|
|
tag: "2.2.1"
|
|
dataStorage:
|
|
storageClass: longhorn
|
|
standalone:
|
|
enabled: false
|
|
affinity: ""
|
|
ha:
|
|
enabled: true
|
|
replicas: 3
|
|
raft:
|
|
enabled: true
|
|
setNodeId: true
|
|
config: |
|
|
cluster_name = "vault-integrated-storage"
|
|
ui = true
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
}
|
|
disable_mlock = true
|
|
service_registration "kubernetes" {}
|