39 lines
1 KiB
YAML
39 lines
1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: vault-config
|
|
namespace: vault
|
|
data:
|
|
extraconfig-from-values.hcl: |-
|
|
disable_mlock = true
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
retry_join {
|
|
leader_api_addr = "http://vault-0.vault-internal.vault.svc.cluster.local:8200"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "http://vault-1.vault-internal.vault.svc.cluster.local:8200"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "http://vault-2.vault-internal.vault.svc.cluster.local:8200"
|
|
}
|
|
}
|
|
|
|
service_registration "kubernetes" {}
|
|
|
|
seal "transit" {
|
|
# Use the internal K8s service name for the Keykeeper
|
|
address = "http://vault-keykeeper.vault.svc.cluster.local:80"
|
|
disable_renewal = false
|
|
key_name = "nest-unseal-key"
|
|
mount_path = "transit/"
|
|
token = "REPLACE_WITH_TOKEN"
|
|
}
|