unkinben
d2be521878
## Summary - Deploys HashiCorp Vault 2.0.1 using Helm chart 0.32.0 in HA raft mode (5 replicas) - Configuration modelled on production vault: \`disable_mlock=true\`, headless-DNS retry_join for all 5 pods - IPC_LOCK capability added via \`server.statefulSet.securityContext.container\` - 10Gi cephrbd-fast-delete PVC per pod via \`dataStorage\` - Gateway API: HTTPS gateway + HTTPRoute (443→vault service port 8200) at \`vault.k8s.syd1.au.unkin.net\` - ArgoCD platform ApplicationSet updated to include vault overlay path - Injector disabled (no agent sidecar injection needed) ## Requires - PR #147 (artifactapi: add hashicorp/vault to docker immutable patterns) to be merged first ## Test plan - [ ] Sandbox tested in \`sandbox-vault\`: all 5 pods Running, raft cluster forming - [ ] After merge: ArgoCD syncs vault namespace - [ ] Operator runs \`vault operator init\` to initialize, then unseals all 5 nodes - [ ] Verify \`vault.k8s.syd1.au.unkin.net\` is accessible via Gateway Reviewed-on: #148
73 lines
1.4 KiB
YAML
73 lines
1.4 KiB
YAML
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: vault-http-redirect
|
|
namespace: vault
|
|
labels:
|
|
app.kubernetes.io/name: vault
|
|
app.kubernetes.io/instance: vault
|
|
spec:
|
|
hostnames:
|
|
- vault.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- name: vault
|
|
sectionName: http
|
|
rules:
|
|
- filters:
|
|
- type: RequestRedirect
|
|
requestRedirect:
|
|
scheme: https
|
|
statusCode: 301
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: vault
|
|
namespace: vault
|
|
labels:
|
|
app.kubernetes.io/name: vault
|
|
app.kubernetes.io/instance: vault
|
|
spec:
|
|
hostnames:
|
|
- vault.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- name: vault
|
|
sectionName: https
|
|
rules:
|
|
- backendRefs:
|
|
- name: vault
|
|
port: 8200
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: vault-consul
|
|
namespace: vault
|
|
labels:
|
|
app.kubernetes.io/name: vault
|
|
app.kubernetes.io/instance: vault
|
|
spec:
|
|
hostnames:
|
|
- vault.service.consul
|
|
- vault.query.consul
|
|
parentRefs:
|
|
- name: vault
|
|
sectionName: vault-direct
|
|
rules:
|
|
- backendRefs:
|
|
- name: vault
|
|
port: 8200
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|