apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: vault
  labels:
    app: vault
spec:
  serviceName: "vault"
  selector:
    matchLabels:
      app: vault
  template:
    metadata:
      labels:
        app: vault
    spec:
      initContainers:
        - name: config
          image: busybox
          env:
            - name: GCS_BUCKET_NAME
              valueFrom:
                configMapKeyRef:
                  name: vault
                  key: gcs-bucket-name
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /var/secrets/key.json
          command: ["/bin/sh", "-c"]
          args:
            - |
              cat > /etc/vault/config/vault.hcl <<EOF
              listener "tcp" {
                address = "0.0.0.0:8200"
                tls_cert_file = "/etc/vault/tls/vault.pem"
                tls_key_file = "/etc/vault/tls/vault-key.pem"
                tls_min_version = "tls12"
              }
              storage "gcs" {
                bucket = "${GCS_BUCKET_NAME}"
              }
              ui = true
              EOF
          volumeMounts:
            - name: vault-config
              mountPath: /etc/vault/config
            - name: service-account
              mountPath: /var/secrets
      containers:
        - name: vault
          image: "vault:0.10.3"
          imagePullPolicy: Always
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /var/secrets/key.json
            - name: GCS_BUCKET_NAME
              valueFrom:
                configMapKeyRef:
                  name: vault
                  key: gcs-bucket-name
          args: 
            - "server"
            - "-config=/etc/vault/config/vault.hcl"
          ports:
            - name: http
              containerPort: 8200
              protocol: "TCP"
            - name: server
              containerPort: 8201
              protocol: "TCP"
          readinessProbe:
            httpGet:
              path: "/v1/sys/health?standbyok=true"
              port: 8200
              scheme: HTTPS
            initialDelaySeconds: 5
            periodSeconds: 10
          securityContext:
            capabilities:
              add:
                - IPC_LOCK
          volumeMounts:
            - name: vault-config
              mountPath: /etc/vault/config
            - name: vault-tls
              mountPath: /etc/vault/tls
            - name: service-account
              mountPath: /var/secrets
        - name: vault-go
          image: "vault-go:v3"
          imagePullPolicy: Never
          env:
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /var/secrets/key.json
            - name: GCS_BUCKET_NAME
              valueFrom:
                configMapKeyRef:
                  name: vault
                  key: gcs-bucket-name
          volumeMounts:
            - name: service-account
              mountPath: /var/secrets
      volumes:
        - name: vault-config
          emptyDir: {}
        - name: vault-tls
          secret:
            secretName: vault
        - name: service-account
          secret:
            secretName: svc
