feat: refactor apps

2026-04-07 20:20:01 -05:00
parent 6825615229
commit 1ce8f18df7
20 changed files with 52 additions and 316 deletions
--- a/clusters/cl01tl/helm/vault/Chart.yaml
+++ b/clusters/cl01tl/helm/vault/Chart.yaml
@@ -5,7 +5,7 @@ description: Vault
 keywords:
  - vault
  - secrets
-home: https://wiki.alexlebens.dev/s/5e40fae1-53a5-4bd0-9953-6fcbe88f1987
+home: https://docs.alexlebens.dev/applications/vault/
 sources:
  - https://github.com/hashicorp/vault
  - https://github.com/Angatar/s3cmd
@@ -29,6 +29,6 @@ dependencies:
    alias: unseal
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.6.2
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/vault.png
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/png/hashicorp-vault.png
 # renovate: datasource=github-releases depName=hashicorp/vault
 appVersion: 1.21.4
--- a/clusters/cl01tl/helm/vault/templates/external-secret.yaml
+++ b/clusters/cl01tl/helm/vault/templates/external-secret.yaml
@@ -14,17 +14,11 @@ spec:
  data:
    - secretKey: VAULT_APPROLE_ROLE_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/snapshot
-        metadataPolicy: None
        property: VAULT_APPROLE_ROLE_ID
    - secretKey: VAULT_APPROLE_SECRET_ID
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/snapshot
-        metadataPolicy: None
        property: VAULT_APPROLE_SECRET_ID

 ---
@@ -44,17 +38,11 @@ spec:
  data:
    - secretKey: .s3cfg
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/vault-backups
-        metadataPolicy: None
        property: s3cfg-local
    - secretKey: BUCKET
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/vault-backups
-        metadataPolicy: None
        property: BUCKET

 ---
@@ -74,17 +62,11 @@ spec:
  data:
    - secretKey: .s3cfg
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/vault-backups
-        metadataPolicy: None
        property: s3cfg-remote
    - secretKey: BUCKET
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /garage/home-infra/vault-backups
-        metadataPolicy: None
        property: BUCKET

 ---
@@ -104,17 +86,11 @@ spec:
  data:
    - secretKey: .s3cfg
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /digital-ocean/home-infra/vault-backup
-        metadataPolicy: None
        property: s3cfg
    - secretKey: BUCKET
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /digital-ocean/home-infra/vault-backup
-        metadataPolicy: None
        property: BUCKET

 ---
@@ -134,24 +110,15 @@ spec:
  data:
    - secretKey: NTFY_TOKEN
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /ntfy/user/cl01tl
-        metadataPolicy: None
        property: token
    - secretKey: NTFY_ENDPOINT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /ntfy/user/cl01tl
-        metadataPolicy: None
        property: endpoint
    - secretKey: NTFY_TOPIC
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/snapshot
-        metadataPolicy: None
        property: NTFY_TOPIC

 ---
@@ -171,66 +138,39 @@ spec:
  data:
    - secretKey: ENVIRONMENT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
        property: ENVIRONMENT
    - secretKey: CHECK_INTERVAL
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
        property: CHECK_INTERVAL
    - secretKey: MAX_CHECK_INTERVAL
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
        property: MAX_CHECK_INTERVAL
    - secretKey: NODES
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
        property: NODES
    - secretKey: TLS_SKIP_VERIFY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
        property: TLS_SKIP_VERIFY
    - secretKey: TOKENS
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
        property: TOKENS
    - secretKey: EMAIL_ENABLED
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
        property: EMAIL_ENABLED
    - secretKey: NOTIFY_MAX_ELAPSED
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
        property: NOTIFY_MAX_ELAPSED
    - secretKey: NOTIFY_QUEUE_DELAY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
        property: NOTIFY_QUEUE_DELAY

 ---
@@ -250,66 +190,39 @@ spec:
  data:
    - secretKey: ENVIRONMENT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
        property: ENVIRONMENT
    - secretKey: CHECK_INTERVAL
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
        property: CHECK_INTERVAL
    - secretKey: MAX_CHECK_INTERVAL
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
        property: MAX_CHECK_INTERVAL
    - secretKey: NODES
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
        property: NODES
    - secretKey: TLS_SKIP_VERIFY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
        property: TLS_SKIP_VERIFY
    - secretKey: TOKENS
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
        property: TOKENS
    - secretKey: EMAIL_ENABLED
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
        property: EMAIL_ENABLED
    - secretKey: NOTIFY_MAX_ELAPSED
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
        property: NOTIFY_MAX_ELAPSED
    - secretKey: NOTIFY_QUEUE_DELAY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
        property: NOTIFY_QUEUE_DELAY

 ---
@@ -329,66 +242,39 @@ spec:
  data:
    - secretKey: ENVIRONMENT
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
        property: ENVIRONMENT
    - secretKey: CHECK_INTERVAL
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
        property: CHECK_INTERVAL
    - secretKey: MAX_CHECK_INTERVAL
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
        property: MAX_CHECK_INTERVAL
    - secretKey: NODES
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
        property: NODES
    - secretKey: TLS_SKIP_VERIFY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
        property: TLS_SKIP_VERIFY
    - secretKey: TOKENS
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
        property: TOKENS
    - secretKey: EMAIL_ENABLED
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
        property: EMAIL_ENABLED
    - secretKey: NOTIFY_MAX_ELAPSED
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
        property: NOTIFY_MAX_ELAPSED
    - secretKey: NOTIFY_QUEUE_DELAY
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
        property: NOTIFY_QUEUE_DELAY

 ---
@@ -408,43 +294,25 @@ spec:
  data:
    - secretKey: token
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/token
-        metadataPolicy: None
        property: token
    - secretKey: unseal_key_1
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/token
-        metadataPolicy: None
        property: unseal_key_1
    - secretKey: unseal_key_2
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/token
-        metadataPolicy: None
        property: unseal_key_2
    - secretKey: unseal_key_3
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/token
-        metadataPolicy: None
        property: unseal_key_3
    - secretKey: unseal_key_4
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/token
-        metadataPolicy: None
        property: unseal_key_4
    - secretKey: unseal_key_5
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
        key: /cl01tl/vault/token
-        metadataPolicy: None
        property: unseal_key_5
--- a/clusters/cl01tl/helm/vault/templates/http-route.yaml
+++ b/clusters/cl01tl/helm/vault/templates/http-route.yaml
@@ -25,4 +25,3 @@ spec:
          kind: Service
          name: vault-active
          port: 8200
-          weight: 100
--- a/clusters/cl01tl/helm/vault/values.yaml
+++ b/clusters/cl01tl/helm/vault/values.yaml
@@ -1,9 +1,5 @@
 vault:
  global:
-    enabled: true
-    tlsDisable: true
-    psp:
-      enable: false
    serverTelemetry:
      prometheusOperator: true
  injector:
@@ -12,23 +8,14 @@ vault:
    enabled: true
    image:
      repository: hashicorp/vault
-      tag: 1.21.4
-    updateStrategyType: "RollingUpdate"
-    logLevel: debug
-    logFormat: standard
+      tag: 1.21.4@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
+    updateStrategyType: RollingUpdate
    resources:
      requests:
        cpu: 50m
-        memory: 512Mi
-    ingress:
-      enabled: false
-    route:
-      enabled: false
+        memory: 90Mi
    authDelegator:
      enabled: false
-    readinessProbe:
-      enabled: true
-      port: 8200
    livenessProbe:
      enabled: false
    volumes:
@@ -39,43 +26,17 @@ vault:
      - mountPath: /opt/backups/
        name: vault-storage-backup
        readOnly: false
-    affinity: |
-      podAntiAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-          - labelSelector:
-              matchLabels:
-                app.kubernetes.io/name: {{ template "vault.name" . }}
-                app.kubernetes.io/instance: "{{ .Release.Name }}"
-                component: server
-            topologyKey: kubernetes.io/hostname
-    networkPolicy:
-      enabled: false
-    service:
-      enabled: true
-      active:
-        enabled: true
-      standby:
-        enabled: false
-      type: ClusterIP
-      port: 8200
-      targetPort: 8200
    dataStorage:
-      enabled: true
      size: 1Gi
-      mountPath: "/vault/data"
-      accessMode: ReadWriteOnce
+      storageClass: ceph-block
    auditStorage:
-      enabled: false
+      enabled: true
      size: 5Gi
-      mountPath: "/vault/audit"
-      accessMode: ReadWriteOnce
-    dev:
-      enabled: false
+      storageClass: ceph-block
    standalone:
      enabled: false
    ha:
      enabled: true
-      replicas: 3
      raft:
        enabled: true
        config: |
@@ -109,30 +70,12 @@ vault:
            prometheus_retention_time = "30s"
            disable_hostname = true
          }
-
      disruptionBudget:
        enabled: true
-        maxUnavailable: null
-    serviceAccount:
-      create: true
-      serviceDiscovery:
-        enabled: true
-    hostNetwork: false
-  ui:
-    enabled: true
-    publishNotReadyAddresses: true
-    activeVaultPodOnly: false
-    serviceType: "ClusterIP"
-    serviceNodePort: null
-    externalPort: 8200
-    targetPort: 8200
-  csi:
-    enabled: false
+        maxUnavailable: 1
  serverTelemetry:
    serviceMonitor:
      enabled: true
-      interval: 30s
-      scrapeTimeout: 10s
    prometheusRules:
      enabled: true
      rules:
@@ -158,20 +101,15 @@ snapshot:
      type: cronjob
      cronjob:
        suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
+        timeZone: America/Chicago
        schedule: 0 4 * * *
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 1
-        failedJobsHistory: 3
        backoffLimit: 3
        parallelism: 1
      initContainers:
        snapshot:
          image:
            repository: hashicorp/vault
-            tag: 1.21.4
-            pullPolicy: IfNotPresent
+            tag: 1.21.4@sha256:4e33b126a59c0c333b76fb4e894722462659a6bec7c48c9ee8cea56fccfd2569
          command:
            - /bin/ash
          args:
@@ -328,53 +266,47 @@ unseal:
      type: deployment
      replicas: 1
      strategy: Recreate
-      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/lrstanley/vault-unseal
-            tag: 0.7.2
-            pullPolicy: IfNotPresent
+            tag: 0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
          envFrom:
            - secretRef:
                name: vault-unseal-config-1
          resources:
            requests:
-              cpu: 10m
-              memory: 24Mi
+              cpu: 1m
+              memory: 10Mi
    unseal-2:
      type: deployment
      replicas: 1
      strategy: Recreate
-      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/lrstanley/vault-unseal
-            tag: 0.7.2
-            pullPolicy: IfNotPresent
+            tag: 0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
          envFrom:
            - secretRef:
                name: vault-unseal-config-2
          resources:
            requests:
-              cpu: 10m
-              memory: 24Mi
+              cpu: 1m
+              memory: 10Mi
    unseal-3:
      type: deployment
      replicas: 1
      strategy: Recreate
-      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/lrstanley/vault-unseal
-            tag: 0.7.2
-            pullPolicy: IfNotPresent
+            tag: 0.7.2@sha256:b25d0c2f6a73d1b9a3907befa473f08fe9fac828d248d7e9702517c5b967733c
          envFrom:
            - secretRef:
                name: vault-unseal-config-3
          resources:
            requests:
-              cpu: 10m
-              memory: 24Mi
+              cpu: 1m
+              memory: 10Mi