68 lines
2.5 KiB
YAML
68 lines
2.5 KiB
YAML
vault:
|
|
# This started as your live `helm get values vault -n vault` output,
|
|
# verbatim. One deliberate deviation from that since: injector.enabled
|
|
# is now false, not true. Secret delivery into pods is going through
|
|
# External Secrets Operator instead of Vault Agent Injector sidecars —
|
|
# nothing currently depends on the injector (claude.md's "Pending / not
|
|
# yet built" list has "Vault Agent Injector annotations for pulling
|
|
# secrets at pod start" — never actually wired up to any workload), so
|
|
# this removes an unused webhook rather than breaking anything live.
|
|
#
|
|
# Production mode (file storage, not dev), standalone (no HA/raft).
|
|
# Init/unseal are still NEVER in Git or scripted: run by hand and keep
|
|
# the unseal keys / root token in a password manager, same as claude.md
|
|
# says. This adoption only manages Vault's own Deployment config, not
|
|
# its data or seal state.
|
|
#
|
|
# `ui = true` in the HCL block AND top-level ui.enabled: true are BOTH
|
|
# required — this is claude.md issue #10 (Vault UI 404'd until both were
|
|
# set; the chart has two separate toggles for the same thing).
|
|
injector:
|
|
enabled: false
|
|
|
|
server:
|
|
dataStorage:
|
|
enabled: true
|
|
# Must stay 5Gi to match the already-bound PVC — local-path-provisioner
|
|
# doesn't support volume expansion, same constraint as Gitea's PVC.
|
|
size: 5Gi
|
|
ha:
|
|
enabled: false
|
|
resources:
|
|
limits:
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
standalone:
|
|
enabled: true
|
|
config: |
|
|
ui = true
|
|
listener "tcp" {
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
tls_disable = "true" # lab only - enable TLS for anything beyond local testing
|
|
}
|
|
storage "file" {
|
|
path = "/vault/data"
|
|
}
|
|
|
|
# No ingress config existed here before — access was via two raw,
|
|
# unmanaged Ingress objects (vault-ingress, vault-ingress-tailscale)
|
|
# that don't match anything Helm would generate, so this creates new
|
|
# GitOps-managed ones alongside them rather than adopting. Once these
|
|
# are confirmed working, the two raw ones should be deleted by hand
|
|
# (kubectl -n vault delete ingress vault-ingress vault-ingress-tailscale)
|
|
# — do that only after confirming, not before, so there's no access gap.
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: contour
|
|
hosts:
|
|
- host: "vault.192.168.1.7.nip.io"
|
|
paths: []
|
|
- host: "vault.100.90.248.118.nip.io"
|
|
paths: []
|
|
|
|
ui:
|
|
enabled: true
|