apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://helm.releases.hashicorp.com
    chart: vault
    targetRevision: "0.29.1"
    helm:
      values: |
        server:
          image:
            repository: hashicorp/vault
            tag: "1.18.3"

          extraEnvironmentVars:
            GOOGLE_APPLICATION_CREDENTIALS: /vault/gcp/sa.json

          volumes:
            - name: gcp-sa
              secret:
                secretName: vault-gcp-sa

          volumeMounts:
            - name: gcp-sa
              mountPath: /vault/gcp
              readOnly: true

          ha:
            enabled: false

          dataStorage:
            enabled: true
            size: 10Gi

          standalone:
            enabled: true
            config: |
              ui = true

              listener "tcp" {
                tls_disable = 1
                address     = "[::]:8200"
                cluster_address = "[::]:8201"
              }

              storage "file" {
                path = "/vault/data"
              }

              seal "gcpckms" {
                project    = "neuron-785695"
                region     = "global"
                key_ring   = "vault"
                crypto_key = "vault-unseal"
              }

          ingress:
            enabled: true
            ingressClassName: traefik
            annotations:
              traefik.ingress.kubernetes.io/router.entrypoints: websecure
              cert-manager.io/cluster-issuer: letsencrypt-prod
            hosts:
              - host: vault.neuralplatform.ai
                paths:
                  - /
            tls:
              - secretName: vault-tls
                hosts:
                  - vault.neuralplatform.ai

        ui:
          enabled: true

        injector:
          enabled: false
  destination:
    server: https://kubernetes.default.svc
    namespace: vault
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true