k8scd/vault/overrides.yaml

global:
   enabled: true
   tlsDisable: true
injector:
   enabled: true
   resources:
      requests:
         cpu: 10m
         memory: 32Mi
   # The chart's default anti-affinity forbids two injector pods on one
   # node, so on this single node a rolling update can never start the new
   # pod while the old one runs. Recreate removes the old pod first, which
   # also gets past pods that still carry the old anti-affinity.
   affinity: ""
   strategy:
      type: Recreate
      rollingUpdate: null
server:
   # Pinned to the running version: the chart would otherwise pull its own
   # default on the next pod restart, and with Shamir unsealing a Vault
   # upgrade needs someone with the unseal keys at hand. The StatefulSet
   # uses OnDelete, so after a sync tools/vault-roll.sh <tag> restarts and
   # unseals the pods one at a time.
   image:
      tag: "2.2.1"
   dataStorage:
      storageClass: longhorn
   standalone:
      enabled: false
   affinity: ""
   ha:
      enabled: true
      replicas: 3
      raft:
         enabled: true
         setNodeId: true
         config: |
            cluster_name = "vault-integrated-storage"
            ui = true
            listener "tcp" {
               tls_disable = 1
               address = "[::]:8200"
               cluster_address = "[::]:8201"
            }
            storage "raft" {
               path = "/vault/data"
            }
            disable_mlock = true
            service_registration "kubernetes" {}