From 380f1142a449d9b4ad6c810757b34747af685e07 Mon Sep 17 00:00:00 2001
From: Astra Logical <booksandpi@gmail.com>
Date: Thu, 11 Jun 2026 13:49:15 -0400
Subject: [PATCH] Migrate vault PVCs to longhorn

---
 data-restorer.yaml                            | 17 ++++++++++++++
 .../vault/keykeeper/keykeeper-deployment.yaml | 23 +++++++++++++++----
 services/vault/vault-statefulset.yaml         |  3 ++-
 3 files changed, 37 insertions(+), 6 deletions(-)
 create mode 100644 data-restorer.yaml

diff --git a/data-restorer.yaml b/data-restorer.yaml
new file mode 100644
index 0000000..ea0f123
--- /dev/null
+++ b/data-restorer.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: data-restorer
+  namespace: vault
+spec:
+  containers:
+  - name: alpine
+    image: alpine:latest
+    command: ["sleep", "infinity"]
+    volumeMounts:
+    - mountPath: /restore
+      name: target-volume
+  volumes:
+  - name: target-volume
+    persistentVolumeClaim:
+      claimName: keykeeper-data-pvc
diff --git a/services/vault/keykeeper/keykeeper-deployment.yaml b/services/vault/keykeeper/keykeeper-deployment.yaml
index 00e1d51..739789d 100644
--- a/services/vault/keykeeper/keykeeper-deployment.yaml
+++ b/services/vault/keykeeper/keykeeper-deployment.yaml
@@ -14,8 +14,6 @@ spec:
         app: vault-keykeeper
     spec:
       serviceAccountName: vault # Allows k8s auth for autounsealing
-      nodeSelector:
-        app: keykeeper # Should be Robin/some non-server node with a /keykeeper local dir chowned by 100:100
       containers:
       - name: vault
         image: hashicorp/vault:latest
@@ -57,6 +55,21 @@ spec:
           mountPath: /vault/file
       volumes:
       - name: vault-data
-        hostPath:
-          path: /keykeeper
-          type: DirectoryOrCreate
+        persistentVolumeClaim:
+          claimName: keykeeper-data-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: keykeeper-data-pvc
+  namespace: vault
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/services/vault/vault-statefulset.yaml b/services/vault/vault-statefulset.yaml
index c5a125b..156ff35 100644
--- a/services/vault/vault-statefulset.yaml
+++ b/services/vault/vault-statefulset.yaml
@@ -140,6 +140,7 @@ spec:
       name: data
     spec:
       accessModes: [ "ReadWriteOnce" ]
+      storageClassName: longhorn
       resources:
         requests:
-          storage: 10Gi
+          storage: 1Gi