k3s/services/vault/vault-configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: vault-config
  namespace: vault
data:
  extraconfig-from-values.hcl: |-
    disable_mlock = true
    ui = true

    listener "tcp" {
      tls_disable = 1
      address = "[::]:8200"
      cluster_address = "[::]:8201"
    }

    storage "raft" {
      path = "/vault/data"
      retry_join {
        leader_api_addr = "http://vault-0.vault-internal.vault.svc.cluster.local:8200"
      }
      retry_join {
        leader_api_addr = "http://vault-1.vault-internal.vault.svc.cluster.local:8200"
      }
      retry_join {
        leader_api_addr = "http://vault-2.vault-internal.vault.svc.cluster.local:8200"
      }
    }

    service_registration "kubernetes" {}

    seal "transit" {
      # Use the internal K8s service name for the Keykeeper
      address            = "http://vault-keykeeper.vault.svc.cluster.local:80"
      disable_renewal    = false
      key_name           = "nest-unseal-key"
      mount_path         = "transit/"
      token              = "REPLACE_WITH_TOKEN"
    }