mirror of
https://github.com/wahyd4/home-argocd.git
synced 2026-08-08 21:05:09 +10:00
194 lines
7.3 KiB
YAML
194 lines
7.3 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: vault
|
|
namespace: argocd
|
|
spec:
|
|
project: default
|
|
source:
|
|
chart: vault
|
|
repoURL: https://helm.releases.hashicorp.com
|
|
path: vault
|
|
targetRevision: 0.19.0
|
|
helm:
|
|
releaseName: vault
|
|
# valueFiles: ['vault-values.yaml']
|
|
values: |
|
|
global:
|
|
enabled: true
|
|
|
|
server:
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 150m
|
|
limits:
|
|
memory: 256Mi
|
|
cpu: 250m
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
kubernetes.io/ingress.class: "nginx"
|
|
kubernetes.io/tls-acme: "true"
|
|
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: 10240m
|
|
nginx.ingress.kubernetes.io/auth-url: "https://id.junv.me/oauth2/auth"
|
|
nginx.ingress.kubernetes.io/auth-signin: "https://id.junv.me/oauth2/start?rd=https%3A%2F%2F$host$request_uri"
|
|
hosts:
|
|
- host: vault.junv.me
|
|
tls:
|
|
- hosts:
|
|
- vault.junv.me
|
|
secretName: vault-tls
|
|
dataStorage:
|
|
enabled: true
|
|
# Size of the PVC created
|
|
size: 10Gi
|
|
# Location where the PVC will be mounted.
|
|
mountPath: "/vault/data"
|
|
# Name of the storage class to use. If null it will use the
|
|
# configured default Storage Class.
|
|
storageClass: "nfs-client"
|
|
# Access Mode of the storage device being used for the PVC
|
|
accessMode: ReadWriteOnce
|
|
# Annotations to apply to the PVC
|
|
annotations: {}
|
|
auditStorage:
|
|
enabled: false
|
|
# Size of the PVC created
|
|
size: 10Gi
|
|
# Location where the PVC will be mounted.
|
|
mountPath: "/vault/audit"
|
|
# Name of the storage class to use. If null it will use the
|
|
# configured default Storage Class.
|
|
storageClass: "nfs-client"
|
|
# Access Mode of the storage device being used for the PVC
|
|
accessMode: ReadWriteOnce
|
|
# Annotations to apply to the PVC
|
|
annotations: {}
|
|
ui:
|
|
enabled: true
|
|
|
|
# secrets-store-csi-driver-provider-vault
|
|
csi:
|
|
# True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
|
|
#
|
|
# Requires installing the secrets-store-csi-driver separately, see:
|
|
# https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
|
|
#
|
|
# With the driver and provider installed, you can mount Vault secrets into volumes
|
|
# similar to the Vault Agent injector, and you can also sync those secrets into
|
|
# Kubernetes secrets.
|
|
enabled: true
|
|
|
|
# volumes is a list of volumes made available to all containers. These are rendered
|
|
# via toYaml rather than pre-processed like the extraVolumes value.
|
|
# The purpose is to make it easy to share volumes between containers.
|
|
volumes: null
|
|
# - name: tls
|
|
# secret:
|
|
# secretName: vault-tls
|
|
|
|
# volumeMounts is a list of volumeMounts for the main server container. These are rendered
|
|
# via toYaml rather than pre-processed like the extraVolumes value.
|
|
# The purpose is to make it easy to share volumes between containers.
|
|
volumeMounts: null
|
|
# - name: tls
|
|
# mountPath: "/vault/tls"
|
|
# readOnly: true
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
|
|
# Settings for the daemonSet used to run the provider.
|
|
daemonSet:
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
maxUnavailable: ""
|
|
# Extra annotations for the daemonSet. This can either be YAML or a
|
|
# YAML-formatted multi-line templated string map of the annotations to apply
|
|
# to the daemonSet.
|
|
annotations: {}
|
|
# Provider host path (must match the CSI provider's path)
|
|
providersDir: "/etc/kubernetes/secrets-store-csi-providers"
|
|
# Kubelet host path
|
|
kubeletRootDir: "/var/lib/kubelet"
|
|
# Extra labels to attach to the vault-csi-provider daemonSet
|
|
# This should be a YAML map of the labels to apply to the csi provider daemonSet
|
|
extraLabels: {}
|
|
|
|
pod:
|
|
# Extra annotations for the provider pods. This can either be YAML or a
|
|
# YAML-formatted multi-line templated string map of the annotations to apply
|
|
# to the pod.
|
|
annotations: {}
|
|
|
|
# Toleration Settings for provider pods
|
|
# This should be either a multi-line string or YAML matching the Toleration array
|
|
# in a PodSpec.
|
|
tolerations: []
|
|
|
|
# Extra labels to attach to the vault-csi-provider pod
|
|
# This should be a YAML map of the labels to apply to the csi provider pod
|
|
extraLabels: {}
|
|
|
|
|
|
|
|
# Priority class for csi pods
|
|
priorityClassName: ""
|
|
|
|
serviceAccount:
|
|
# Extra annotations for the serviceAccount definition. This can either be
|
|
# YAML or a YAML-formatted multi-line templated string map of the
|
|
# annotations to apply to the serviceAccount.
|
|
annotations: {}
|
|
|
|
# Extra labels to attach to the vault-csi-provider serviceAccount
|
|
# This should be a YAML map of the labels to apply to the csi provider serviceAccount
|
|
extraLabels: {}
|
|
|
|
# Used to configure readinessProbe for the pods.
|
|
readinessProbe:
|
|
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
|
failureThreshold: 2
|
|
# Number of seconds after the container has started before probe initiates
|
|
initialDelaySeconds: 5
|
|
# How often (in seconds) to perform the probe
|
|
periodSeconds: 5
|
|
# Minimum consecutive successes for the probe to be considered successful after having failed
|
|
successThreshold: 1
|
|
# Number of seconds after which the probe times out.
|
|
timeoutSeconds: 3
|
|
# Used to configure livenessProbe for the pods.
|
|
livenessProbe:
|
|
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
|
failureThreshold: 2
|
|
# Number of seconds after the container has started before probe initiates
|
|
initialDelaySeconds: 5
|
|
# How often (in seconds) to perform the probe
|
|
periodSeconds: 5
|
|
# Minimum consecutive successes for the probe to be considered successful after having failed
|
|
successThreshold: 1
|
|
# Number of seconds after which the probe times out.
|
|
timeoutSeconds: 3
|
|
|
|
# Enables debug logging.
|
|
debug: false
|
|
|
|
# Pass arbitrary additional arguments to vault-csi-provider.
|
|
extraArgs: []
|
|
|
|
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: vault
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|