50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
vault:
|
|
# This is your live `helm get values vault -n vault` output, verbatim —
|
|
# not a rewrite. Production mode (file storage, not dev), standalone
|
|
# (no HA/raft). Init/unseal are still NEVER in Git or scripted: run by
|
|
# hand and keep the unseal keys / root token in a password manager, same
|
|
# as claude.md says. This adoption only manages Vault's own Deployment
|
|
# config, not its data or seal state.
|
|
#
|
|
# `ui = true` in the HCL block AND top-level ui.enabled: true are BOTH
|
|
# required — this is claude.md issue #10 (Vault UI 404'd until both were
|
|
# set; the chart has two separate toggles for the same thing).
|
|
injector:
|
|
enabled: true
|
|
resources:
|
|
limits:
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
|
|
server:
|
|
dataStorage:
|
|
enabled: true
|
|
# Must stay 5Gi to match the already-bound PVC — local-path-provisioner
|
|
# doesn't support volume expansion, same constraint as Gitea's PVC.
|
|
size: 5Gi
|
|
ha:
|
|
enabled: false
|
|
resources:
|
|
limits:
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
standalone:
|
|
enabled: true
|
|
config: |
|
|
ui = true
|
|
listener "tcp" {
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
tls_disable = "true" # lab only - enable TLS for anything beyond local testing
|
|
}
|
|
storage "file" {
|
|
path = "/vault/data"
|
|
}
|
|
|
|
ui:
|
|
enabled: true
|