apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: vault
  namespace: vault
spec:
  serviceName: vault-internal
  replicas: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: vault
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vault
    spec:
      serviceAccountName: vault
      terminationGracePeriodSeconds: 10
      # Force pods onto different physical server nodes
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: app.kubernetes.io/name
                    operator: In
                    values: ["vault"]
              topologyKey: "kubernetes.io/hostname"
      securityContext:
        runAsUser: 100
        runAsGroup: 1000
        fsGroup: 1000
      initContainers:
      - name: fix-raft-permissions
        image: busybox:latest
        command: ["sh", "-c", "chown -R 100:1000 /vault/data && chmod -R 700 /vault/data"]
        volumeMounts:
        - name: data
          mountPath: /vault/data
        securityContext:
          runAsUser: 0
          privileged: true
      containers:
      - name: vault
        image: hashicorp/vault:latest
        args: ["server", "-config=/etc/vault/extraconfig-from-values.hcl"]
        securityContext:
          allowPrivilegeEscalation: false
        env:
        - name: VAULT_API_ADDR
          value: "http://$(HOSTNAME).vault-internal:8200"
        - name: SKIP_SETCAP
          value: "true"
        - name: VAULT_ADDR
          value: "http://127.0.0.1:8200"
        - name: VAULT_CLUSTER_ADDR
          value: "http://$(HOSTNAME).vault-internal:8201"
        - name: VAULT_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: VAULT_K8S_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        ports:
        - containerPort: 8200
          name: http
        - containerPort: 8201
          name: https-internal
        volumeMounts:
        - name: config
          mountPath: /etc/vault
        - name: data
          mountPath: /vault/data
      volumes:
        - name: config
          configMap:
            name: vault-config
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 10Gi