Initial code commit + initial automation stuff + etc...

templates/vault-statefulset.yaml

@@ -0,0 +1,78 @@
+{{- if and (.Values.vault.create.enabled) (eq .Values.vault.type "hashicorp") -}}
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ .Release.Name }}-vault
+  labels:
+    app: {{ .Release.Name }}-vault
+spec:
+  serviceName: {{ .Release.Name }}-vault
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-vault
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}-vault
+    spec:
+      # Because the Vault process runs with a non-root user inside the container,
+      # we need to set the fsGroup to ensure that the mounted volumes have the correct permissions
+      securityContext:
+        fsGroup: 1000
+      containers:
+      - name: {{ .Release.Name }}-vault
+        image: {{ .Values.vault.create.image.repository }}:{{ .Values.vault.create.image.tag }}
+        ports:
+        - containerPort: 8200
+        - containerPort: 8201
+        {{- if .Values.vault.create.snapshotServer.enabled }}
+        - containerPort: {{ .Values.vault.create.snapshotServer.internalPort }}
+        {{- end }}
+        env:
+        - name: VAULT_ADDR
+          value: http://0.0.0.0:8200
+        - name: ROLE_ID_SECRET_NAME
+          value: USER_PASSWORD_DEFAULT_VAULT_ROLE_ID
+        - name: SECRET_ID_SECRET_NAME
+          value: USER_PASSWORD_DEFAULT_VAULT_SECRET_ID
+        {{- if .Values.vault.create.snapshotServer.enabled }}
+        - name: SNAPSHOT_SERVER_PORT
+          value: {{ .Values.vault.create.snapshotServer.internalPort | quote }}
+        {{- end }}
+        volumeMounts:
+        - name: vault-data
+          mountPath: /vault/data
+        - name: vault-log
+          mountPath: /vault/logs
+        - name: vault-creds
+          mountPath: /vault/creds
+        - name: vault-role-vars
+          mountPath: /role_vars
+        capAdd:
+        - IPC_LOCK
+      volumes:
+      - name: vault-log
+        emptyDir: {}
+      - name: vault-creds
+        {{- if .Values.vault.create.snapshotServer.enabled }}
+        persistentVolumeClaim:
+          claimName: {{ .Release.Name }}-vault-creds
+        {{- else }}
+        emptyDir: {}
+        {{- end }}
+      - name: vault-role-vars
+        persistentVolumeClaim:
+          claimName: {{ .Release.Name }}-vault-role-vars
+  # To have data consistency across pod restarts, we use a volume claim template
+  # We do this instead of a static PVC because we require less control and it's easier to manage
+  volumeClaimTemplates:
+  - metadata:
+      name: vault-data
+    spec:
+      storageClassName: rook-ceph-block
+      accessModes: [ "ReadWriteOnce" ]
+      resources:
+        requests:
+          storage: 2Gi
+{{- end -}}