apiVersion: v1
kind: Namespace
metadata:
  name: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
    app.kubernetes.io/part-of: telecom-platform
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vault
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
    app.kubernetes.io/part-of: telecom-platform
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: vault
      app.kubernetes.io/component: secrets
  template:
    metadata:
      labels:
        app.kubernetes.io/name: vault
        app.kubernetes.io/component: secrets
    spec:
      containers:
      - name: vault
        image: hashicorp/vault:1.14.0
        ports:
        - containerPort: 8200
          name: vault
        - containerPort: 8201
          name: cluster
        env:
        - name: VAULT_ADDR
          value: "http://localhost:8200"
        - name: VAULT_CLUSTER_ADDR
          value: "http://localhost:8201"
        - name: VAULT_LOCAL_CONFIG
          valueFrom:
            configMapKeyRef:
              name: vault-config
              key: vault.hcl
        - name: VAULT_LOCAL_CONFIG_SKIP_BACKEND_CONFIG
          value: "true"
        - name: VAULT_SKIP_VERIFY
          value: "true"
        - name: SKIP_CHOWN
          value: "true"
        - name: VAULT_CACERT
          value: "/vault/tls/ca.crt"
        - name: VAULT_TLSCERT
          value: "/vault/tls/server.crt"
        - name: VAULT_TLSKEY
          value: "/vault/tls/server.key"
        command:
        - vault
        - server
        - -config=/vault/config/vault.hcl
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
          limits:
            cpu: 500m
            memory: 512Mi
        securityContext:
          capabilities:
            add:
            - IPC_LOCK
        volumeMounts:
        - name: vault-config
          mountPath: /vault/config
        - name: vault-tls
          mountPath: /vault/tls
        livenessProbe:
          httpGet:
            path: /v1/sys/health
            port: vault
          initialDelaySeconds: 60
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /v1/sys/health
            port: vault
          initialDelaySeconds: 30
          periodSeconds: 5
      volumes:
      - name: vault-config
        configMap:
          name: vault-config
      - name: vault-tls
        emptyDir:
          medium: Memory
---
apiVersion: v1
kind: Service
metadata:
  name: vault
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
    app.kubernetes.io/part-of: telecom-platform
spec:
  ports:
  - port: 8200
    name: vault
    targetPort: 8200
  - port: 8201
    name: cluster
    targetPort: 8201
  selector:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
  type: ClusterIP
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: vault-config
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
    app.kubernetes.io/part-of: telecom-platform
data:
  vault.hcl: |
    ui = true
    
    listener "tcp" {
      address = "0.0.0.0:8200"
      cluster_address = "0.0.0.0:8201"
      tls_disable = 1
    }
    
    storage "consul" {
      address = "consul:8500"
      path = "vault/"
    }
    
    api_addr = "http://vault:8200"
    cluster_addr = "http://vault:8201"
    
    default_lease_ttl = "168h"
    max_lease_ttl = "720h"
    
    disable_mlock = true
    
    telemetry {
      prometheus_retention_time = "24h"
      disable_hostname = true
    }
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vault
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
    app.kubernetes.io/part-of: telecom-platform
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
    app.kubernetes.io/part-of: telecom-platform
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator
subjects:
- kind: ServiceAccount
  name: vault
  namespace: vault
---
apiVersion: v1
kind: Secret
metadata:
  name: vault-token
  namespace: vault
  labels:
    app.kubernetes.io/name: vault
    app.kubernetes.io/component: secrets
    app.kubernetes.io/part-of: telecom-platform
type: Opaque
data:
  token: cm9vdA== # root