Mayne0213
ec09ea403f
- authelia: CPU 15m/15m, memory 100Mi/144Mi - authelia-redis: CPU 22m/32m, memory 100Mi/100Mi - cert-manager: CPU 15m/15m, memory 100Mi/100Mi - cert-manager-cainjector: CPU 15m/15m, memory 126Mi/248Mi - cert-manager-webhook: CPU 15m/15m, memory 100Mi/100Mi - external-secrets: CPU 15m/15m, memory 100Mi/109Mi - external-secrets-cert-controller: CPU 15m/15m, memory 144Mi/297Mi - external-secrets-webhook: CPU 15m/15m, memory 100Mi/100Mi - falco: CPU 34m/53m, memory 93Mi/144Mi - falcosidekick: CPU 15m/15m, memory 100Mi/100Mi - vault: CPU 34m/53m, memory 126Mi/163Mi
87 lines
1.7 KiB
YAML
87 lines
1.7 KiB
YAML
# HashiCorp Vault Helm Values
|
|
# Chart: https://github.com/hashicorp/vault-helm
|
|
|
|
global:
|
|
enabled: true
|
|
tlsDisable: true # 내부 클러스터에서는 TLS 비활성화
|
|
|
|
server:
|
|
enabled: true
|
|
|
|
# Production 모드
|
|
dev:
|
|
enabled: false
|
|
|
|
# Standalone 비활성화 (HA 사용)
|
|
standalone:
|
|
enabled: false
|
|
|
|
# HA 설정 - PostgreSQL storage (config from External Secret)
|
|
ha:
|
|
enabled: true
|
|
replicas: 3
|
|
raft:
|
|
enabled: false
|
|
# Empty config - actual config is in vault-config-secret
|
|
config: ""
|
|
|
|
# PVC 비활성화 (PostgreSQL 사용)
|
|
dataStorage:
|
|
enabled: false
|
|
|
|
# Config from External Secret
|
|
volumes:
|
|
- name: vault-config-secret
|
|
secret:
|
|
secretName: vault-config-secret
|
|
|
|
volumeMounts:
|
|
- name: vault-config-secret
|
|
mountPath: /vault/userconfig
|
|
readOnly: true
|
|
|
|
# Extra args to use config from secret
|
|
extraArgs: "-config=/vault/userconfig/extraconfig-from-values.hcl"
|
|
|
|
# Resource settings (VPA lowerBound/target)
|
|
resources:
|
|
requests:
|
|
cpu: 34m
|
|
memory: 126Mi
|
|
limits:
|
|
cpu: 53m
|
|
memory: 163Mi
|
|
|
|
# Ingress 설정
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: traefik
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hosts:
|
|
- host: vault0213.kro.kr
|
|
paths:
|
|
- /
|
|
tls:
|
|
- secretName: vault-tls
|
|
hosts:
|
|
- vault0213.kro.kr
|
|
|
|
# 서비스 타입
|
|
service:
|
|
enabled: true
|
|
type: ClusterIP
|
|
port: 8200
|
|
|
|
# High priority for critical secrets management
|
|
priorityClassName: high-priority
|
|
|
|
# UI 활성화
|
|
ui:
|
|
enabled: true
|
|
serviceType: ClusterIP
|
|
|
|
# Injector (나중에 필요하면 활성화)
|
|
injector:
|
|
enabled: false
|