---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: vault
  namespace: vault
  labels:
    app: vault
spec:
  serviceName: vault
  replicas: 3
  selector:
    matchLabels:
      app: vault
  template:
    metadata:
      labels:
        app: vault
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values: ['vault']
            topologyKey: kubernetes.io/hostname
      terminationGracePeriodSeconds: 10
      containers:
#      - name: vault-init
#        image: registry.hub.docker.com/sethvargo/vault-init:0.1.1
#        imagePullPolicy: Always
#        env:
#        - name: CHECK_INTERVAL
#          value: "5"
#        - name: S3_BUCKET_NAME
#          valueFrom:
#            configMapKeyRef:
#              name: vault
#              key: s3_bucket_name
#        - name: KMS_KEY_ID
#          valueFrom:
#            configMapKeyRef:
#              name: vault
#              key: kms_key_id
      - name: vault
        image: registry.hub.docker.com/library/vault:0.10.4
        imagePullPolicy: Always
        args: ['server']
        securityContext:
          capabilities:
            add: ['IPC_LOCK']
        ports:
        - containerPort: 8200
          name: vault-port
          protocol: TCP
        - containerPort: 8201
          name: cluster-port
          protocol: TCP
        resources:
          requests:
            cpu: '200m'
            memory: '500M'
        volumeMounts:
        - name: vault-tls
          mountPath: /etc/vault/tls
        env:
        - name: POD_IP_ADDR
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: LOAD_BALANCER_DNS_NAME
          valueFrom:
            configMapKeyRef:
              name: vault
              key: load_balancer_dns_name
        - name: S3_BUCKET_NAME
          valueFrom:
            configMapKeyRef:
              name: vault
              key: s3_bucket_name
        - name: VAULT_LOCAL_CONFIG
          value: |
            api_addr     = "https://$(LOAD_BALANCER_DNS_NAME):8200"
            cluster_addr = "https://$(POD_IP_ADDR):8201"

            ui = false

            storage "s3" {
              bucket     = "$(S3_BUCKET_NAME)"
            }

            listener "tcp" {
              address       = "0.0.0.0:8200"
              tls_cert_file = "/etc/vault/tls/vault.crt"
              tls_key_file  = "/etc/vault/tls/vault.key"

              tls_disable_client_certs = true
            }
        readinessProbe:
          httpGet:
            path: /v1/sys/health?standbyok=true
            port: 8200
            scheme: HTTPS
          initialDelaySeconds: 5
          periodSeconds: 5
      volumes:
      - name: vault-tls
        secret:
          secretName: vault-tls
