cr.yaml

apiVersion: "vault.banzaicloud.com/v1alpha1"
kind: "Vault"
metadata:
  name: "vault"
spec:
  size: 1
  image: vault:0.11.0
  bankVaultsImage: banzaicloud/bank-vaults:latest

  # Support for custom Vault (and sidecar) pod annotations
  annotations:
    prometheus.io/scrape: "true"
    prometheus.io/port: "9102"

  # Specify the ServiceAccount where the Vault Pod and the Bank-Vaults configurer/unsealer is running
  serviceAccount: vault-operator

  # Specify the Service's type where the Vault Service is exposed
  serviceType: ClusterIP

  # Describe where you would like to store the Vault unseal keys and root token.
  unsealConfig:
    kubernetes:
      secretNamespace: default

  # A YAML representation of a final vault config file.
  # See https://www.vaultproject.io/docs/configuration/ for more information.
  config:
    storage:
      file:
        path: "/vault/file"
    listener:
      tcp:
        address: "0.0.0.0:8200"
        # Uncommenting the following line and deleting tls_cert_file and tls_key_file disables TLS
        # tls_disable: true
        tls_cert_file: /vault/tls/server.crt
        tls_key_file: /vault/tls/server.key
    telemetry:
      statsd_address: localhost:9125
    ui: true

  # See: https://github.com/banzaicloud/bank-vaults#example-external-vault-configuration for more details.
  externalConfig:
    policies:
    - name: allow_secrets
      rules: path "secret/*" {
              capabilities = ["create", "read", "update", "delete", "list"]
            }
    auth:
    - type: kubernetes
      roles:
        # Allow every pod in the default namespace to use the secret kv store
        - name: default
          bound_service_account_names: default
          bound_service_account_namespaces: default
          policies: allow_secrets
          ttl: 1h