---
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta2.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: vault
spec:
  interval: 30m
  chart:
    spec:
      chart: vault
      version: 0.28.1
      sourceRef:
        kind: HelmRepository
        name: hashicorp
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    cleanupOnFail: true
    remediation:
      retries: 3
      strategy: rollback
  values:
    server:
      image:
        repository: "hashicorp/vault"
        tag: "1.17.2"
      logLevel: "info"
      logFormat: "json"
      ingress:
        enabled: true
        ingressClassName: internal-nginx
        hosts:
          - host: &host "{{ .Release.Name }}.jahanson.tech"
            paths:
              - path: /
                service:
                  identifier: app
                  port: http
        tls:
          - hosts:
              - *host
      service:
        type: "ClusterIP"
        port: &internalPort 8200
        targetPort: &port 80
      # off until it's online for the first time
      readinessProbe:
        enabled: true
        # If you need to use a http path instead of the default exec
        # path: /v1/sys/health?standbyok=true
        # Port number on which readinessProbe will be checked.
        port: *port
      # These are defaults but explicitly set here for clarity.
      dataStorage:
        size: 10Gi
        mountPath: /vault/data
        storageClass: ceph-block
      auditStorage:
        enabled: true
        size: 10Gi
        mountPath: /vault/audit
        storageClass: ceph-block
      # We want high availability. If standalone is true it sets the storage backend to file
      # and the max replicas can only be 1.
      standalone:
        enabled: false
      ha:
        enabled: true
        # maxUnavailable will default to (n/2)-1 where n is the number of replicas
        # so if you have 6 replicas, maxUnavailable will be 2 unless you set it specifically.
        replicas: 6
        clusterAddr: "http://vault.security.svc.cluster.local:8201"
        config: ""
        raft:
          enabled: true
          config: |
            ui = true

            listener "tcp" {
              tls_disable = 1
              address = "[::]:8200"
              cluster_address = "[::]:8201"
              # For prometheus!
              telemetry {
                unauthenticated_metrics_access = "true"
              }
            }

            storage "raft" {
              path = "/vault/data"
            }

            service_registration "kubernetes" {}
      statefulSet:
        securityContext:
          pod:
            runAsUser: 568
            runAsGroup: 568
            runAsNonRoot: true
            fsGroup: 568
            fsGroupChangePolicy: OnRootMismatch
            supplementalGroups: [10000]
          container:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - "ALL"
    ui:
      enabled: true
      publishNotReadyAddresses: true
      # The service should only contain selectors for active Vault pod
      activeVaultPodOnly: true
      serviceType: "LoadBalancer"
      externalPort: *internalPort
      targetPort: *port