apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/instance: RELEASE-NAME
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: vault
  name: RELEASE-NAME-vault
  namespace: default
spec:
  podManagementPolicy: Parallel
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: RELEASE-NAME
      app.kubernetes.io/name: vault
      component: server
  serviceName: RELEASE-NAME-vault-internal
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: RELEASE-NAME
        app.kubernetes.io/name: vault
        component: server
        helm.sh/chart: vault-0.16.1
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app.kubernetes.io/instance: RELEASE-NAME
                app.kubernetes.io/name: vault
                component: server
            topologyKey: kubernetes.io/hostname
      containers:
      - args:
        - |
          cp /vault/config/extraconfig-from-values.hcl /tmp/storageconfig.hcl;
          [ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /tmp/storageconfig.hcl;
          [ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /tmp/storageconfig.hcl;
          [ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /tmp/storageconfig.hcl;
          [ -n "${API_ADDR}" ] && sed -Ei "s|API_ADDR|${API_ADDR?}|g" /tmp/storageconfig.hcl;
          [ -n "${TRANSIT_ADDR}" ] && sed -Ei "s|TRANSIT_ADDR|${TRANSIT_ADDR?}|g" /tmp/storageconfig.hcl;
          [ -n "${RAFT_ADDR}" ] && sed -Ei "s|RAFT_ADDR|${RAFT_ADDR?}|g" /tmp/storageconfig.hcl;
          /usr/local/bin/docker-entrypoint.sh vault server -config=/tmp/storageconfig.hcl -config=/vault/userconfig/vault-storage-config/config.hcl
        command:
        - /bin/sh
        - -ec
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: POD_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: VAULT_K8S_POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: VAULT_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: VAULT_ADDR
          value: http://127.0.0.1:8200
        - name: VAULT_API_ADDR
          value: http://$(POD_IP):8200
        - name: SKIP_CHOWN
          value: "true"
        - name: SKIP_SETCAP
          value: "true"
        - name: HOSTNAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: VAULT_CLUSTER_ADDR
          value: https://$(HOSTNAME).RELEASE-NAME-vault-internal:8201
        - name: HOME
          value: /home/vault
        image: releases-docker.jfrog.io/hashicorp/vault:1.8.3
        imagePullPolicy: IfNotPresent
        lifecycle:
          preStop:
            exec:
              command:
              - /bin/sh
              - -c
              - sleep 5 && kill -SIGTERM $(pidof vault)
        livenessProbe:
          failureThreshold: 2
          httpGet:
            path: /v1/sys/health?standbyok=true
            port: 8200
            scheme: HTTP
          initialDelaySeconds: 60
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 3
        name: vault
        ports:
        - containerPort: 8200
          name: http
        - containerPort: 8201
          name: https-internal
        - containerPort: 8202
          name: http-rep
        readinessProbe:
          exec:
            command:
            - /bin/sh
            - -ec
            - vault status -tls-skip-verify
          failureThreshold: 2
          initialDelaySeconds: 5
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 3
        securityContext:
          allowPrivilegeEscalation: false
        volumeMounts:
        - mountPath: /vault/config
          name: config
        - mountPath: /vault/userconfig/vault-storage-config
          name: userconfig-vault-storage-config
          readOnly: true
        - mountPath: /home/vault
          name: home
      - env:
        - name: CHECK_INTERVAL
          value: 10s
        - name: VAULT_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: VAULT_ADDRESS
          value: http://localhost:8200
        image: releases-docker.jfrog.io/jfrog/pipelines-vault-init:1.17.9
        imagePullPolicy: IfNotPresent
        name: vault-init
        resources:
          limits:
            cpu: 50m
            memory: 50Mi
          requests:
            cpu: 10m
            memory: 10Mi
      securityContext:
        fsGroup: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        runAsUser: 100
      serviceAccountName: vault
      terminationGracePeriodSeconds: 10
      volumes:
      - configMap:
          name: RELEASE-NAME-vault-config
        name: config
      - name: userconfig-vault-storage-config
        secret:
          defaultMode: 420
          secretName: vault-storage-config
      - emptyDir: {}
        name: home
  updateStrategy:
    type: RollingUpdate
