154 lines
5.7 KiB
YAML
154 lines
5.7 KiB
YAML
vault:
|
|
injector:
|
|
enabled: false
|
|
|
|
server:
|
|
enabled: "-"
|
|
|
|
# Ingress allows ingress services to be created to allow external access
|
|
# from Kubernetes to access Vault pods.
|
|
# If deployment is on OpenShift, the following block is ignored.
|
|
# In order to expose the service, use the route section below
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: nginx-internal
|
|
hosts:
|
|
- host: vault-prd.meeshogcp.in
|
|
|
|
tolerations:
|
|
- effect: NoSchedule
|
|
key: dedicated
|
|
operator: Equal
|
|
value: devops
|
|
|
|
nodeSelector:
|
|
dedicated: devops
|
|
|
|
# OpenShift only - create a route to expose the service
|
|
# By default the created route will be of type passthrough
|
|
route:
|
|
enabled: false
|
|
|
|
# Priority class for server pods
|
|
priorityClassName: ""
|
|
|
|
# Extra labels to attach to the server pods
|
|
# This should be a YAML map of the labels to apply to the server pods
|
|
extraLabels: {}
|
|
|
|
# Extra annotations to attach to the server pods
|
|
# This can either be YAML or a YAML-formatted multi-line templated string map
|
|
# of the annotations to apply to the server pods
|
|
annotations: {}
|
|
|
|
# Enables a headless service to be used by the Vault Statefulset
|
|
service:
|
|
enabled: true
|
|
|
|
# This configures the Vault Statefulset to create a PVC for data
|
|
# storage when using the file or raft backend storage engines.
|
|
# See https://www.vaultproject.io/docs/configuration/storage/index.html to know more
|
|
|
|
# Run Vault in "dev" mode. This requires no further setup, no state management,
|
|
# and no initialization. This is useful for experimenting with Vault without
|
|
# needing to unseal, store keys, et. al. All data is lost on restart - do not
|
|
# use dev mode for anything other than experimenting.
|
|
# See https://www.vaultproject.io/docs/concepts/dev-server.html to know more
|
|
dev:
|
|
enabled: false
|
|
|
|
# Set VAULT_DEV_ROOT_TOKEN_ID value
|
|
devRootToken: "root"
|
|
|
|
# Run Vault in "HA" mode. There are no storage requirements unless audit log
|
|
# persistence is required. In HA mode Vault will configure itself to use Consul
|
|
# for its storage backend. The default configuration provided will work the Consul
|
|
# Helm project by default. It is possible to manually configure Vault to use a
|
|
# different HA backend.
|
|
standalone:
|
|
enabled: false
|
|
ha:
|
|
enabled: true
|
|
replicas: 3
|
|
|
|
# Set the api_addr configuration for Vault HA
|
|
# See https://www.vaultproject.io/docs/configuration#api_addr
|
|
# If set to null, this will be set to the Pod IP Address
|
|
apiAddr: null
|
|
|
|
# Set the cluster_addr confuguration for Vault HA
|
|
# See https://www.vaultproject.io/docs/configuration#cluster_addr
|
|
# If set to null, this will be set to https://$(HOSTNAME).{{ template "vault.fullname" . }}-internal:8201
|
|
clusterAddr: null
|
|
|
|
# Enables Vault's integrated Raft storage. Unlike the typical HA modes where
|
|
# Vault's persistence is external (such as Consul), enabling Raft mode will create
|
|
# persistent volumes for Vault to store data according to the configuration under server.dataStorage.
|
|
# The Vault cluster will coordinate leader elections and failovers internally.
|
|
|
|
# config is a raw string of default configuration when using a Stateful
|
|
# deployment. Default is to use a Consul for its HA storage backend.
|
|
# This should be HCL.
|
|
|
|
# Note: Configuration files are stored in ConfigMaps so sensitive data
|
|
# such as passwords should be either mounted through extraSecretEnvironmentVars
|
|
# or through a Kube secret. For more information see:
|
|
# https://www.vaultproject.io/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
storage "gcs" {
|
|
bucket = "gcs-meesho-prd-admin-vault-backend"
|
|
ha_enabled = "true"
|
|
}
|
|
|
|
service_registration "kubernetes" {}
|
|
|
|
seal "gcpckms" {
|
|
project = "meesho-admin-prd-0622"
|
|
region = "asia-southeast1"
|
|
key_ring = "keyring-meesho-prd-admin-vault"
|
|
crypto_key = "key-meesho-prd-admin-vault"
|
|
}
|
|
|
|
# A disruption budget limits the number of pods of a replicated application
|
|
# that are down simultaneously from voluntary disruptions
|
|
disruptionBudget:
|
|
enabled: true
|
|
|
|
# maxUnavailable will default to (n/2)-1 where n is the number of
|
|
# replicas. If you'd like a custom value, you can specify an override here.
|
|
maxUnavailable: null
|
|
|
|
# Definition of the serviceAccount used to run Vault.
|
|
# These options are also used when using an external Vault server to validate
|
|
# Kubernetes tokens.
|
|
serviceAccount:
|
|
# Specifies whether a service account should be created
|
|
create: true
|
|
# The name of the service account to use.
|
|
# If not set and create is true, a name is generated using the fullname template
|
|
name: ""
|
|
# Extra annotations for the serviceAccount definition. This can either be
|
|
# YAML or a YAML-formatted multi-line templated string map of the
|
|
# annotations to apply to the serviceAccount.
|
|
annotations:
|
|
"iam.gke.io/gcp-service-account": "sa-prd-admin-vault@meesho-admin-prd-0622.iam.gserviceaccount.com"
|
|
|
|
# Settings for the statefulSet used to run Vault.
|
|
statefulSet:
|
|
# Extra annotations for the statefulSet. This can either be YAML or a
|
|
# YAML-formatted multi-line templated string map of the annotations to apply
|
|
# to the statefulSet.
|
|
annotations: {}
|
|
|
|
# Vault UI
|
|
ui:
|
|
enabled: true
|
|
publishNotReadyAddresses: true
|
|
annotations: {} |