apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: vault
  name: vault
spec:
  replicas: 2
  selector:
    matchLabels:
      app: vault
  template:
    metadata:
      labels:
        app: vault
    spec:
      containers:
      - image: vault:1.0.1
        name: vault
        ports:
        - containerPort: 8200
          name: vaultport
          protocol: TCP
        args:
        - server
        - -log-level=debug
        env:
        - name: SKIP_SETCAP
          value: 'true'
        - name: POD_IP
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: status.podIP
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: VAULT_LOCAL_CONFIG
          value: |
            {
              "storage":
              { "consul":
                { "address": "$(NODE_NAME):8500",
                  "path": "vault"
                }
              },
              "api_addr": "http://$(POD_IP):8200",
              "cluster_addr ": "http://$(POD_IP):8201",
              "default_lease_ttl": "168h",
              "max_lease_ttl": "720h" ,
              "disable_mlock": true,
              "listener":
              { "tcp":
                { "address" : "0.0.0.0:8200",
                  "cluster_address": "0.0.0.0:8201",
                  "tls_cert_file": "/etc/tls/tls.crt",
                  "tls_key_file": "/etc/tls/tls.key"
                }
              }
            }
        volumeMounts:
        - name: vault-cert
          mountPath: /etc/tls
        livenessProbe:
          httpGet:
            path: 'v1/sys/health?standbyok=true&standbycode=200&sealedcode=200&uninitcode=200'
            port: 8200
            scheme: HTTPS
        readinessProbe:
          httpGet:
            path: 'v1/sys/health?standbyok=true&standbycode=200&sealedcode=200&uninitcode=200'
            port: 8200
            scheme: HTTPS
      volumes:
      - name: vault-cert
        secret:
          secretName: vault-tls

          