mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
e518e1368f
Chart 0.28.1 is only tested up to Kubernetes 1.30. 0.34.1 brings the injector to vault-k8s 1.7.6. The server image is pinned to the running 1.17.2: the StatefulSet uses OnDelete, so nothing restarts now, but a later pod restart would otherwise pull the chart's default and Shamir unsealing needs the keys at hand for a Vault upgrade. Rendered with the pin, the StatefulSet only changes in formatting and an extra check in the config script that doesn't apply here.
47 lines
1.2 KiB
YAML
47 lines
1.2 KiB
YAML
global:
|
|
enabled: true
|
|
tlsDisable: true
|
|
injector:
|
|
enabled: true
|
|
server:
|
|
# Pinned to the running version: the chart would otherwise pull its own
|
|
# default on the next pod restart, and with Shamir unsealing a Vault
|
|
# upgrade needs someone with the unseal keys at hand.
|
|
image:
|
|
tag: "1.17.2"
|
|
dataStorage:
|
|
storageClass: longhorn
|
|
standalone:
|
|
enabled: false
|
|
affinity: ""
|
|
ha:
|
|
enabled: true
|
|
replicas: 3
|
|
raft:
|
|
enabled: true
|
|
setNodeId: true
|
|
config: |
|
|
cluster_name = "vault-integrated-storage"
|
|
ui = true
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
}
|
|
disable_mlock = true
|
|
service_registration "kubernetes" {}
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: prod-cluster-issuer
|
|
ingressClassName: nginx
|
|
tls:
|
|
- secretName: letsencrypt-prod
|
|
hosts:
|
|
- vault.rubenhensen.nl
|
|
hosts:
|
|
- host: "vault.rubenhensen.nl"
|