plural-artifacts/vault/helm/vault/values.yaml.tpl at 9a1bd49969ac0d53380a6619fe85e66837155cf4 · pluralsh/plural-artifacts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
vault:
  server:
    extraEnvironmentVars:
      {{- if eq .Provider "aws" }}
      VAULT_SEAL_TYPE: awskms
      {{- end }}
      {{- if eq .Provider "google" }}
      VAULT_SEAL_TYPE: gcpckms
      GOOGLE_PROJECT: {{ .Project }}
      GOOGLE_REGION: {{ importValue "Terraform" "google_kms_key_ring_location" }}
      {{- end }}
      {{- if .OIDC }}
      OIDC_DISCOVERY_URL: "https://oidc.plural.sh/"
      {{- end }}

    extraSecretEnvironmentVars:
    {{- if eq .Provider "aws" }}
    - envName: VAULT_AWSKMS_SEAL_KEY_ID
      secretName: vault-env-secret
      secretKey: VAULT_AWSKMS_SEAL_KEY_ID
    {{- end }}
    {{- if eq .Provider "google" }}
    - envName: VAULT_GCPCKMS_SEAL_CRYPTO_KEY
      secretName: vault-env-secret
      secretKey: VAULT_GCPCKMS_SEAL_CRYPTO_KEY
    - envName: VAULT_GCPCKMS_SEAL_KEY_RING
      secretName: vault-env-secret
      secretKey: VAULT_GCPCKMS_SEAL_KEY_RING
    {{- end }}
    {{- if .OIDC }}
    - envName: OIDC_CLIENT_ID
      secretName: vault-env-secret
      secretKey: OIDC_CLIENT_ID
    - envName: OIDC_CLIENT_SECRET
      secretName: vault-env-secret
      secretKey: OIDC_CLIENT_SECRET
    {{- end }}

    ingress:
      {{- if .Values.exposePrivate }}
      ingressClassName: internal-nginx
      {{- end }}
      hosts:
      - host: {{ .Values.hostname }}
        paths: []
      tls:
      - hosts:
        - {{ .Values.hostname }}
        secretName: vault-tls

    {{ if eq .Provider "aws" }}
    serviceAccount:
      annotations:
        eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-vault"
    {{ end }}
    {{ if eq .Provider "google" }}
    serviceAccount:
      create: false
      name: vault
    {{ end }}

envSecret:
  {{- if eq .Provider "aws" }}
  VAULT_AWSKMS_SEAL_KEY_ID: {{ importValue "Terraform" "aws_kms_key_id" }}
  {{- end }}
  {{- if eq .Provider "google" }}
  VAULT_GCPCKMS_SEAL_KEY_RING: {{ importValue "Terraform" "google_kms_key_ring_name" }}
  VAULT_GCPCKMS_SEAL_CRYPTO_KEY: {{ importValue "Terraform" "google_kms_crypto_key_name" }}
  {{- end }}
  {{- if .OIDC }}
  OIDC_CLIENT_ID: "{{ .OIDC.ClientId }}"
  OIDC_CLIENT_SECRET: "{{ .OIDC.ClientSecret }}"
  {{- end }}

{{- if .OIDC }}
oidc:
  enabled: true
  redirectHostname: {{ .Values.hostname }}
  adminEmail: {{ .Config.Email }}
{{- end }}