apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: vault
  labels:
    app.kubernetes.io/name: vault
    component: server
spec:
  serviceName: vault
  podManagementPolicy: Parallel
  replicas: 1
  updateStrategy:
    type: "OnDelete"
  selector:
    matchLabels:
      app.kubernetes.io/name: vault
      component: server
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vault
        component: server
    spec:
      affinity:  
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: vault
                  component: server
              topologyKey: kubernetes.io/hostname
      terminationGracePeriodSeconds: 10
      serviceAccountName: vault  
      shareProcessNamespace: true
      securityContext:
        fsGroup: 1000
      volumes:
        - name: config
          configMap:
            name: vault-config
        - name: data
          persistentVolumeClaim:
            claimName: vault-pvc
      containers:
        - name: vault
          securityContext:
            runAsNonRoot: true
            runAsGroup: 1000
            runAsUser: 100
            capabilities:
              add: ["IPC_LOCK"]
          image: vault:1.3.1
          imagePullPolicy: IfNotPresent
          command: 
          - "/bin/sh"
          - "-ec"
          args:
          - |
            sed -E "s/HOST_IP/${HOST_IP?}/g" /vault/config/extraconfig-from-values.hcl > /tmp/storageconfig.hcl;
            sed -Ei "s/POD_IP/${POD_IP?}/g" /tmp/storageconfig.hcl;
            /usr/local/bin/docker-entrypoint.sh vault server -config=/tmp/storageconfig.hcl
          env:
            - name: HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
            - name: POD_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
            - name: VAULT_ADDR
              value: "http://127.0.0.1:8200"
            - name: VAULT_API_ADDR
              value: "http://$(POD_IP):8200"
            - name: SKIP_CHOWN
              value: "true"
            - name: SKIP_SETCAP
              value: "true"
          ports:
            - containerPort: 8200
              name: http
            - containerPort: 8201
              name: internal
            - containerPort: 8202
              name: replication
          volumeMounts:
          - name: config
            mountPath: /vault/config
          - name: data
            mountPath: /vault/data

      