migrate

clusters/cl01tl/helm/vault/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: vault
+  repository: https://helm.releases.hashicorp.com
+  version: 0.31.0
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.4.0
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.4.0
+digest: sha256:e34bdaf3c05467bebf34fbed0803702000eb5f4f729c687e28b90ec72bae01c1
+generated: "2025-12-01T20:27:53.344041-06:00"

clusters/cl01tl/helm/vault/Chart.yaml

@@ -0,0 +1,33 @@
+apiVersion: v2
+name: vault
+version: 1.0.0
+description: Vault
+keywords:
+  - vault
+  - secrets
+home: https://wiki.alexlebens.dev/s/5e40fae1-53a5-4bd0-9953-6fcbe88f1987
+sources:
+  - https://github.com/hashicorp/vault
+  - https://github.com/Angatar/s3cmd
+  - https://github.com/lrstanley/vault-unseal
+  - https://hub.docker.com/r/hashicorp/vault
+  - https://hub.docker.com/r/d3fk/s3cmd/
+  - https://github.com/lrstanley/vault-unseal/pkgs/container/vault-unseal
+  - https://github.com/hashicorp/vault-helm
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: vault
+    version: 0.31.0
+    repository: https://helm.releases.hashicorp.com
+  - name: app-template
+    alias: snapshot
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.4.0
+  - name: app-template
+    alias: unseal
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.4.0
+icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/vault.png
+appVersion: 1.19.3

clusters/cl01tl/helm/vault/templates/external-secret.yaml

@@ -0,0 +1,353 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-snapshot-agent-token
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-snapshot-agent-token
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: VAULT_APPROLE_ROLE_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/snapshot
+        metadataPolicy: None
+        property: VAULT_APPROLE_ROLE_ID
+    - secretKey: VAULT_APPROLE_SECRET_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/snapshot
+        metadataPolicy: None
+        property: VAULT_APPROLE_SECRET_ID
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-s3cmd-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-s3cmd-config
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: .s3cfg
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /digital-ocean/home-infra/vault-backup
+        metadataPolicy: None
+        property: s3cfg
+    - secretKey: BUCKET
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /digital-ocean/home-infra/vault-backup
+        metadataPolicy: None
+        property: BUCKET
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-unseal-config-1
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-unseal-config-1
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ENVIRONMENT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-1
+        metadataPolicy: None
+        property: ENVIRONMENT
+    - secretKey: CHECK_INTERVAL
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-1
+        metadataPolicy: None
+        property: CHECK_INTERVAL
+    - secretKey: MAX_CHECK_INTERVAL
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-1
+        metadataPolicy: None
+        property: MAX_CHECK_INTERVAL
+    - secretKey: NODES
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-1
+        metadataPolicy: None
+        property: NODES
+    - secretKey: TLS_SKIP_VERIFY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-1
+        metadataPolicy: None
+        property: TLS_SKIP_VERIFY
+    - secretKey: TOKENS
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-1
+        metadataPolicy: None
+        property: TOKENS
+    - secretKey: EMAIL_ENABLED
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-1
+        metadataPolicy: None
+        property: EMAIL_ENABLED
+    - secretKey: NOTIFY_MAX_ELAPSED
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-1
+        metadataPolicy: None
+        property: NOTIFY_MAX_ELAPSED
+    - secretKey: NOTIFY_QUEUE_DELAY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-1
+        metadataPolicy: None
+        property: NOTIFY_QUEUE_DELAY
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-unseal-config-2
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-unseal-config-2
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ENVIRONMENT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-2
+        metadataPolicy: None
+        property: ENVIRONMENT
+    - secretKey: CHECK_INTERVAL
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-2
+        metadataPolicy: None
+        property: CHECK_INTERVAL
+    - secretKey: MAX_CHECK_INTERVAL
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-2
+        metadataPolicy: None
+        property: MAX_CHECK_INTERVAL
+    - secretKey: NODES
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-2
+        metadataPolicy: None
+        property: NODES
+    - secretKey: TLS_SKIP_VERIFY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-2
+        metadataPolicy: None
+        property: TLS_SKIP_VERIFY
+    - secretKey: TOKENS
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-2
+        metadataPolicy: None
+        property: TOKENS
+    - secretKey: EMAIL_ENABLED
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-2
+        metadataPolicy: None
+        property: EMAIL_ENABLED
+    - secretKey: NOTIFY_MAX_ELAPSED
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-2
+        metadataPolicy: None
+        property: NOTIFY_MAX_ELAPSED
+    - secretKey: NOTIFY_QUEUE_DELAY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-2
+        metadataPolicy: None
+        property: NOTIFY_QUEUE_DELAY
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-unseal-config-3
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-unseal-config-3
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ENVIRONMENT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-3
+        metadataPolicy: None
+        property: ENVIRONMENT
+    - secretKey: CHECK_INTERVAL
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-3
+        metadataPolicy: None
+        property: CHECK_INTERVAL
+    - secretKey: MAX_CHECK_INTERVAL
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-3
+        metadataPolicy: None
+        property: MAX_CHECK_INTERVAL
+    - secretKey: NODES
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-3
+        metadataPolicy: None
+        property: NODES
+    - secretKey: TLS_SKIP_VERIFY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-3
+        metadataPolicy: None
+        property: TLS_SKIP_VERIFY
+    - secretKey: TOKENS
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-3
+        metadataPolicy: None
+        property: TOKENS
+    - secretKey: EMAIL_ENABLED
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-3
+        metadataPolicy: None
+        property: EMAIL_ENABLED
+    - secretKey: NOTIFY_MAX_ELAPSED
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-3
+        metadataPolicy: None
+        property: NOTIFY_MAX_ELAPSED
+    - secretKey: NOTIFY_QUEUE_DELAY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/unseal/config-3
+        metadataPolicy: None
+        property: NOTIFY_QUEUE_DELAY
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-token
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-token
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: token
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/token
+        metadataPolicy: None
+        property: token
+    - secretKey: unseal_key_1
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/token
+        metadataPolicy: None
+        property: unseal_key_1
+    - secretKey: unseal_key_2
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/token
+        metadataPolicy: None
+        property: unseal_key_2
+    - secretKey: unseal_key_3
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/token
+        metadataPolicy: None
+        property: unseal_key_3
+    - secretKey: unseal_key_4
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/token
+        metadataPolicy: None
+        property: unseal_key_4
+    - secretKey: unseal_key_5
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/token
+        metadataPolicy: None
+        property: unseal_key_5

clusters/cl01tl/helm/vault/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-route-vault
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: http-route-vault
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - vault.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: vault-active
+          port: 8200
+          weight: 100

clusters/cl01tl/helm/vault/templates/ingress.yaml

@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vault-tailscale
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-tailscale
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+    tailscale.com/proxy-class: no-metrics
+  annotations:
+    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
+spec:
+  ingressClassName: tailscale
+  tls:
+    - hosts:
+        - vault-cl01tl
+      secretName: vault-cl01tl
+  rules:
+    - host: vault-cl01tl
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vault-active
+                port:
+                  number: 8200

clusters/cl01tl/helm/vault/templates/persistent-volume-claim.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vault-nfs-storage-backup
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-nfs-storage-backup
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  volumeMode: Filesystem
+  storageClassName: nfs-client
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

clusters/cl01tl/helm/vault/values.yaml

@@ -0,0 +1,301 @@
+vault:
+  global:
+    enabled: true
+    tlsDisable: true
+    psp:
+      enable: false
+    serverTelemetry:
+      prometheusOperator: true
+  injector:
+    enabled: false
+  server:
+    enabled: true
+    image:
+      repository: hashicorp/vault
+      tag: 1.21.1
+    updateStrategyType: "RollingUpdate"
+    logLevel: debug
+    logFormat: standard
+    resources:
+      requests:
+        cpu: 50m
+        memory: 512Mi
+    ingress:
+      enabled: false
+    route:
+      enabled: false
+    authDelegator:
+      enabled: false
+    readinessProbe:
+      enabled: true
+      port: 8200
+    livenessProbe:
+      enabled: false
+    volumes:
+      - name: vault-nfs-storage-backup
+        persistentVolumeClaim:
+          claimName: vault-nfs-storage-backup
+    volumeMounts:
+      - mountPath: /opt/backups/
+        name: vault-nfs-storage-backup
+        readOnly: false
+    affinity: |
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: {{ template "vault.name" . }}
+                app.kubernetes.io/instance: "{{ .Release.Name }}"
+                component: server
+            topologyKey: kubernetes.io/hostname
+    networkPolicy:
+      enabled: false
+    service:
+      enabled: true
+      active:
+        enabled: true
+      standby:
+        enabled: false
+      type: ClusterIP
+      port: 8200
+      targetPort: 8200
+    dataStorage:
+      enabled: true
+      size: 1Gi
+      mountPath: "/vault/data"
+      accessMode: ReadWriteOnce
+    auditStorage:
+      enabled: false
+      size: 5Gi
+      mountPath: "/vault/audit"
+      accessMode: ReadWriteOnce
+    dev:
+      enabled: false
+    standalone:
+      enabled: false
+    ha:
+      enabled: true
+      replicas: 3
+      raft:
+        enabled: true
+        config: |
+          ui = true
+
+          listener "tcp" {
+            tls_disable = 1
+            address = "[::]:8200"
+            cluster_address = "[::]:8201"
+            telemetry {
+              unauthenticated_metrics_access = "true"
+            }
+          }
+
+          storage "raft" {
+            path = "/vault/data"
+            retry_join {
+              leader_api_addr = "http://vault-0.vault-internal:8200"
+            }
+            retry_join {
+              leader_api_addr = "http://vault-1.vault-internal:8200"
+            }
+            retry_join {
+              leader_api_addr = "http://vault-2.vault-internal:8200"
+            }
+          }
+
+          service_registration "kubernetes" {}
+
+          telemetry {
+            prometheus_retention_time = "30s"
+            disable_hostname = true
+          }
+
+      disruptionBudget:
+        enabled: true
+        maxUnavailable: null
+    serviceAccount:
+      create: true
+      serviceDiscovery:
+        enabled: true
+    hostNetwork: false
+  ui:
+    enabled: true
+    publishNotReadyAddresses: true
+    activeVaultPodOnly: false
+    serviceType: "ClusterIP"
+    serviceNodePort: null
+    externalPort: 8200
+    targetPort: 8200
+  csi:
+    enabled: false
+  serverTelemetry:
+    serviceMonitor:
+      enabled: true
+      interval: 30s
+      scrapeTimeout: 10s
+    prometheusRules:
+      enabled: true
+      rules:
+        - alert: vault-HighResponseTime
+          annotations:
+            message: The response time of Vault is over 500ms on average over the last 5 minutes.
+          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
+          for: 5m
+          labels:
+            severity: warning
+        - alert: vault-HighResponseTime
+          annotations:
+            message: The response time of Vault is over 1s on average over the last 5 minutes.
+          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
+          for: 5m
+          labels:
+            severity: critical
+snapshot:
+  global:
+    fullnameOverride: vault-snapshot
+  controllers:
+    snapshot:
+      type: cronjob
+      cronjob:
+        suspend: false
+        concurrencyPolicy: Forbid
+        timeZone: US/Central
+        schedule: 0 4 * * *
+        startingDeadlineSeconds: 90
+        successfulJobsHistory: 3
+        failedJobsHistory: 3
+        backoffLimit: 3
+        parallelism: 1
+      initContainers:
+        snapshot:
+          image:
+            repository: hashicorp/vault
+            tag: 1.21.1
+            pullPolicy: IfNotPresent
+          command:
+            - /bin/ash
+          args:
+            - -ec
+            - |
+              apk add --no-cache jq;
+              echo ">> Running Vault snapshot"
+              export VAULT_TOKEN=$(vault write auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID -format=json | jq -r .auth.client_token);
+              vault operator raft snapshot save /opt/backup/vault-snapshot-latest.snap;
+              cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap;
+              cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-s3.snap;
+              echo ">> Completed Vault snapshot"
+          envFrom:
+            - secretRef:
+                name: vault-snapshot-agent-token
+          env:
+            - name: VAULT_ADDR
+              value: http://vault-active.vault.svc.cluster.local:8200
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+      containers:
+        s3-backup:
+          image:
+            repository: d3fk/s3cmd
+            tag: latest@sha256:7bdbd33bb3d044884598898b9e9b383385759fbd6ebf52888700bd9b0e0fab91
+            pullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+          args:
+            - -ec
+            - |
+              echo ">> Running S3 backup for Vault snapshot"
+              s3cmd put --no-check-md5 --no-check-certificate -v /opt/backup/vault-snapshot-s3.snap ${BUCKET}/cl01tl/cl01tl-vault-snapshots/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap;
+              rm -f /opt/backup/vault-snapshot-s3.snap;
+              echo ">> Completed S3 backup for Vault snapshot"
+          env:
+            - name: BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: vault-s3cmd-config
+                  key: BUCKET
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+  persistence:
+    config:
+      existingClaim: vault-nfs-storage-backup
+      advancedMounts:
+        snapshot:
+          snapshot:
+            - path: /opt/backup
+              readOnly: false
+          s3-backup:
+            - path: /opt/backup
+              readOnly: false
+    s3cmd-config:
+      enabled: true
+      type: secret
+      name: vault-s3cmd-config
+      advancedMounts:
+        snapshot:
+          s3-backup:
+            - path: /root/.s3cfg
+              readOnly: true
+              mountPropagation: None
+              subPath: .s3cfg
+unseal:
+  global:
+    fullnameOverride: vault-unseal
+  controllers:
+    unseal-1:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/lrstanley/vault-unseal
+            tag: 0.7.2
+            pullPolicy: IfNotPresent
+          envFrom:
+            - secretRef:
+                name: vault-unseal-config-1
+          resources:
+            requests:
+              cpu: 10m
+              memory: 24Mi
+    unseal-2:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/lrstanley/vault-unseal
+            tag: 0.7.2
+            pullPolicy: IfNotPresent
+          envFrom:
+            - secretRef:
+                name: vault-unseal-config-2
+          resources:
+            requests:
+              cpu: 10m
+              memory: 24Mi
+    unseal-3:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/lrstanley/vault-unseal
+            tag: 0.7.2
+            pullPolicy: IfNotPresent
+          envFrom:
+            - secretRef:
+                name: vault-unseal-config-3
+          resources:
+            requests:
+              cpu: 10m
+              memory: 24Mi