110 lines
No EOL
4.1 KiB
YAML
110 lines
No EOL
4.1 KiB
YAML
# ============================
|
|
# Configurations for the vault
|
|
# ============================
|
|
|
|
# The type of secrets "vault" to use.
|
|
#
|
|
# The only appropriate value here is `hashicorp` at present.
|
|
#
|
|
# This is left here so that if in the future there is distinction between different Hashicorp Vault types this can be extended.
|
|
# Also, downstream charts may use this to determine which type of vault (outside Hashicorp Vault) to connect to.
|
|
#
|
|
type: 'hashicorp'
|
|
|
|
# The name of the vault instance to connect to
|
|
#
|
|
# Note, if `create` is true this is ignored
|
|
#
|
|
# This is generally the hostname of the Hashicorp Vault instance to connect to
|
|
#vaultName: ''
|
|
|
|
# The port of the vault instance to connect to
|
|
#
|
|
# ONLY RELEVANT iF `create` IS NOT TRUE
|
|
#vaultPort: 8200
|
|
|
|
# Configurations to create a Hashicorp Vault instance as part of the Helm chart
|
|
#
|
|
# THIS IS ONLY RELEVANT IF `type` IS SET TO `hashicorp`
|
|
create:
|
|
# If a Hashicorp Vault instance should be created as part of the Helm chart
|
|
enabled: true
|
|
|
|
# Configurations for the image to use if creating the Hashicorp Vault instance
|
|
# as part of the Helm chart
|
|
image:
|
|
# The repository of the image to use
|
|
repository: <redacted-private-repo>/ba-custom-hashicorp-vault
|
|
|
|
# The tag of the image to use
|
|
tag: latest
|
|
|
|
# The number of replicas of the Hashicorp Vault instance to create
|
|
#replicaCount: 1
|
|
|
|
# Configurations for the ingress of the created Hashicorp Vault instance
|
|
ingress:
|
|
# If an ingress should be created for the created Hashicorp Vault instance
|
|
enabled: true
|
|
|
|
# The host of the ingress for the created Hashicorp Vault instance
|
|
host: vault.<redacted-private-hostname>
|
|
|
|
# As part of the custom Hashicorp Vault image it includes a "snapshot server"
|
|
# This allows for the triggering and receiving of manual backups ("snapshots") and restoration via HTTP
|
|
snapshotServer:
|
|
# If the snapshot server should be enabled/running
|
|
enabled: true
|
|
|
|
# The external port that is opened via the service resource
|
|
externalPort: 81
|
|
|
|
# The internal port that the snapshot server listens on
|
|
internalPort: 8300
|
|
|
|
# Configurations for the `vault-creds` Persistent Volume Claim (PVC).
|
|
# The `vault-creds` PVC is used for the credentials used by the snapshot server to authenticate with Vault
|
|
vaultCredsPVC:
|
|
storageClassName: vault-role-vars-rook-cephfs
|
|
size: 512Mi
|
|
|
|
# The capabilities of the policy to create for the app
|
|
policyCapabilities:
|
|
- read
|
|
- create
|
|
- update
|
|
|
|
# Configurations for the AppRole authentication method for the created Vault instance
|
|
appRole:
|
|
# The name of the environment variable/secret that contains the Role ID for the app
|
|
roleIDSecretName: VAULT_ROLE_ID
|
|
|
|
# The name of the environment variable/secret that contains the Secret ID for the app
|
|
secretIDSecretName: VAULT_SECRET_ID
|
|
|
|
# Configurations for the `role-vars` Persistent Volume Claim (PVC).
|
|
# The `role-vars` PVC is used for the app's AppRole auth access variables (role & secret IDs etc...)
|
|
roleVarsPVC:
|
|
# Because the PVC needs to be a RWX type volume (so that multiple pods can access it)
|
|
# Because the app and the vault are separate pods.
|
|
# We need to use a storage class that supports RWX (Custom create CephFS backed storage class)
|
|
storageClassName: vault-role-vars-rook-cephfs
|
|
|
|
# The size of the PVC (note because this is largely just credentials a small size is sufficient)
|
|
size: 512Mi
|
|
|
|
# Configurations for the `vault-data` Persistent Volume Claim (PVC).
|
|
# The `vault-data` PVC is used for the Vault's data storage.
|
|
# In particular, a PVC allows data persistence across pod restarts.
|
|
vaultData:
|
|
# The storage class to use for the PVC
|
|
# Note, because there are no special requirements here we can use a standard RWO type volume
|
|
# Which means the default storage class (Rook Ceph Block) is sufficient
|
|
storageClassName: rook-ceph-block
|
|
|
|
# The access modes for the PVC (shouldn't ever really need to be changed)
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
|
|
# The size of the PVC (Note, this should be sized according to expected usage)
|
|
size: 2Gi |