freezer/mareshq-gitops-legacy
Archived
1
0
Fork 0
Code Activity

refactor(cherry/vault): drop internal tls

Browse source
This commit is contained in:
Vojtěch Mareš 2023-10-01 15:22:05 +02:00
parent af72089b74
commit 5d29e8b657
Signed by: vojtech.mares
GPG key ID: C6827B976F17240D
1 changed files with 5 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

58
clusters/cherry/apps/vault.yaml
View file

@ -3,6 +3,8 @@ kind: Application
metadata:
name: cherry-vault
namespace: argocd
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:
project: infrastructure
syncPolicy:
@ -23,7 +25,7 @@ spec:
valuesObject:
global:
enabled: true
tlsDisable: false
tlsDisable: true
injector:
enabled: false
@ -34,9 +36,6 @@ spec:
ingressClassName: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
nginx.ingress.kubernetes.io/server-snippet: |
proxy_ssl_verify off;
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
pathType: Prefix
tls:
- secretName: vault-ingress-tls
@ -47,15 +46,6 @@ spec:
paths:
- /
extraEnvironmentVars:
VAULT_CACERT: /vault/userconfig/server-ca/ca.crt
extraVolumes:
- type: secret
name: server-tls
- type: secret
name: server-ca
resources:
requests:
memory: 512Mi
@ -74,11 +64,11 @@ spec:
auditStorage:
enabled: true
size: 5Gi
size: 1Gi
dataStorage:
enabled: true
size: 5Gi
size: 1Gi
standalone:
enabled: false
@ -92,41 +82,3 @@ spec:
raft:
enabled: true
setNodeId: true
config: |
ui = true
listener "tcp" {
address = "[::]:8200"
cluster_address = "[::]:8201"
tls_cert_file = "/vault/userconfig/server-tls/tls.crt"
tls_key_file = "/vault/userconfig/server-tls/tls.key"
tls_client_ca_file = "/vault/userconfig/server-ca/tls-combined.pem"
}
storage "raft" {
path = "/vault/data"
retry_join {
leader_api_addr = "https://vault-0.vault-internal:8200"
leader_ca_cert_file = "/vault/userconfig/server-ca/ca.crt"
leader_client_cert_file = "/vault/userconfig/server-tls/tls.crt"
leader_client_key_file = "/vault/userconfig/server-tls/tls.key"
}
retry_join {
leader_api_addr = "https://vault-1.vault-internal:8200"
leader_ca_cert_file = "/vault/userconfig/server-ca/ca.crt"
leader_client_cert_file = "/vault/userconfig/server-tls/tls.crt"
leader_client_key_file = "/vault/userconfig/server-tls/tls.key"
}
retry_join {
leader_api_addr = "https://vault-2.vault-internal:8200"
leader_ca_cert_file = "/vault/userconfig/server-ca/ca.crt"
leader_client_cert_file = "/vault/userconfig/server-tls/tls.crt"
leader_client_key_file = "/vault/userconfig/server-tls/tls.key"
}
}
service_registration "kubernetes" {}