values.yaml

# Default values for vault.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
replicaCount: 3
## The name of the secret to use if pulling images from a private registry.
# imagePullSecret:
image:
  repository: vault
  tag:
  pullPolicy: IfNotPresent

vaultExporter:
  enabled: false
  repository: grapeshot/vault_exporter
  tag: v0.1.2
  pullPolicy: IfNotPresent
  vaultAddress: 127.0.0.1:8200
  # tlsCAFile: /vault/tls/ca.crt

# Prometheus operator Service Monitor:
serviceMonitor:
  enabled: false
  additionalLabels: {}
    # prometheus-scraper: "default"
  podPortName: "metrics"
  interval: 10s
  jobLabel: "vault-exporter"
# Prometheus operator Rules:
prometheusRules:
  enabled: false
  defaultRules:
    # Triggered when pod is not up
    vaultUp: true
    # Triggered when vault is not initialzed
    vaultUninitialized: true
    # Triggered when vault is sealed
    vaultSealed: true
    # Triggered when vault is in standby mode
    vaultStandby: false
  extraRules: []
  # - alert: VaultStandby
  #   expr: vault_standby{app="vault", release="vault"} == 1
  #   for: 1m
  #   labels:
  #     service: vault
  #     severity: critical
  #   annotations:
  #     summary: "Vault instance {{$labels.pod_name}} is in standby mode"

consulAgent:
  repository: consul
  tag: 1.4.0
  pullPolicy: IfNotPresent
  # If you set join to a consul server endpoint, a consul agent will
  # be started in the vault pod.  If unset, no agent container is
  # deployed.
  # join: consul.service.consul
  #
  # If your consul server uses encrypted gossip, specify the secret
  # name here.  Format should match the stable/consul chart.
  # gossipKeySecretName: gossip-key
  #
  # Optionally override the agent's http port
  HttpPort: 8500
  resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi
service:
  name: vault
  type: ClusterIP
  # type: LoadBalancer
  # Assign a static LB IP
  # loadBalancerIP: 203.0.113.32
  loadBalancerSourceRanges: []
  #  - 10.0.0.0/8
  #  - 130.211.204.2/32
  externalPort: 8200
  port: 8200
  # clusterExternalPort: 8201
  clusterPort: 8201
  # clusterIP: None
  annotations: {}
  additionalSelector: {}
  #   cloud.google.com/load-balancer-type: "Internal"
  #
  # An example using type:loadbalancer and AWS internal ELB on kops
  # type: LoadBalancer
  # annotations:
  #   dns.alpha.kubernetes.io/internal: vault.internal.domain.name
  #   service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0

ingress:
  enabled: false
  labels: {}
  # Used to create Ingress record (should used with service.type: ClusterIP).
  # hosts:
  #  - chart-example.local
  # annotations:
  #   kubernetes.io/ingress.class: nginx
  #   kubernetes.io/tls-acme: "true"
  # path: /
  # tls:
  #   Secrets must be manually created in the namespace.
  #   - secretName: chart-example-tls
  #     hosts:
  #       - chart-example.local
resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi

## Node selector
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
nodeSelector: {}

## Affinity
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
    - weight: 100
      podAffinityTerm:
        topologyKey: kubernetes.io/hostname
        labelSelector:
          matchLabels:
            app: '{{ template "vault.name" . }}'
            release: '{{ .Release.Name }}'

## Tolerations
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
tolerations: []

## Deployment annotations
annotations: {}

## Extra Deployment labels
labels: {}

## Pod annotations
podAnnotations: {}

## Pod labels
podLabels: {}

##    Read more about kube2iam to provide access to s3 https://github.com/jtblin/kube2iam
#     iam.amazonaws.com/role: role-arn

## Sample for unsealing vault on startup
## if automation saves your unseal keys to a k8s secret on deploy
## writing a script to do this would be trivial and solves the
## issues of scaling up if deployed in HA.
# lifecycle:
#   postStart:
#     exec:
#       command: ["./unseal -s my-unseal-keys"]

# Priority class name for pods
priorityClassName: ""

# Minimum number of seconds that newly created replicas must be ready without any containers
# crashing
minReadySeconds: 0
serviceAccount:
  ## Specifies whether a ServiceAccount should be created
  ##
  create: true
  ## Annotations to set for the ServiceAccount
  # annotations:
    # my-annotation: my-annotation-value
  annotations: {}
  ## The name of the ServiceAccount to use.
  ## If not set and create is true, a name is generated using the fullname template
  # name:

vault:
  # Only used to enable dev mode. When in dev mode, the rest of this config
  # section below is not used to configure Vault. See
  # https://www.vaultproject.io/intro/getting-started/dev-server.html for more
  # information.
  dev: true
  # Configure additional arguments to pass to vault server command
  extraArgs: []
  # Configure additional environment variables for the Vault containers
  extraEnv: []
  #   - name: VAULT_API_ADDR
  #     value: "https://vault.internal.domain.name:8200"
  extraContainers: []
  ## Additional containers to be added to the Vault pod
  # extraContainers:
  # - name: vault-sidecar
  #   image: vault-sidecar:latest
  #   volumeMounts:
  #   - name: some-mount
  #     mountPath: /some/path
  # Extra volumes to mount to the Vault pod. The comments show an example usage
  # for mounting a TLS secret. In this example, the volume name must match
  # the volumeMount name. The two other fields required are the name of the
  # Kubernetes secret (created outside of this chart), and the mountPath
  # at which it should be mounted in the Vault container.
  extraVolumes: []
  #   - name: vault-tls
  #     secret:
  #       secretName: vault-tls-secret
  extraVolumeMounts: []
  #   - name: vault-tls
  #     mountPath: /vault/tls
  #     readOnly: true
  extraInitContainers: []
  ## Init containers to be added
  # extraInitContainers:
  # - name: do-something
  #   image: busybox
  #   command: ['do', 'something']
  # Log level
  # https://www.vaultproject.io/docs/commands/server.html#log-level
  logLevel: "info"
  ## Additional volumes to the vault pod.
  # - name: extra-volume
  #   secret:
  #     secretName: some-secret
  liveness:
    aliveIfUninitialized: true
    aliveIfSealed: true
    initialDelaySeconds: 30
    periodSeconds: 10
    failureThreshold: 3
    successThreshold: 1
    timeoutSeconds: 1
  readiness:
    readyIfSealed: false
    readyIfStandby: true
    readyIfUninitialized: true
    initialDelaySeconds: 10
    periodSeconds: 10
    failureThreshold: 3
    successThreshold: 1
    timeoutSeconds: 1

  # Set the `VAULT_API_ADDR` environment variable to the Pod IP Address
  # This is the address (full URL) to advertise to other Vault servers in the cluster for client redirection.
  # See https://www.vaultproject.io/docs/configuration/#api_addr
  podApiAddress: true

  ## Use an existing config in a named ConfigMap
  # existingConfigName: vault-cm
  config:
    # A YAML representation of a final vault config.json file.
    # See https://www.vaultproject.io/docs/configuration/ for more information.
    listener:
      tcp:
        address: '[::]:8200'
        cluster_address: '[::]:8201'
        tls_disable: true
        # tls_cert_file: /vault/tls/server.crt
        # tls_key_file: /vault/tls/server.key
    # See https://www.vaultproject.io/docs/configuration/storage/ for storage backends
    storage: {}
      # consul:
      #   address: ""
      #   path: ""
      #
      # etcd:
      #   address: "http://vault-etcd:2379"
      #   path: "vault/"
      #   etcd_api: "v3"
      #   ha_enabled: "true"
      #
      # s3:
      #   bucket: ""
      #   region: ""
      #   access_key: ""
      #   secret_key: ""
      #   endpoint: "" # When not using AWS S3
      #
      # gcs:
      #   bucket: ""
      #   # Use a custom secret to mount this file.
      #   credentials_file: ""
  backendPolicy: []

rbac:
   ## Enable RBAC
  create: true