argocd + vault on k8s with autounseal

vault-operator.yaml

## kubectl delete application.argoproj.io/vault-operator -n argocd
## kubectl patch apps/vault-operator -p '{"metadata":{"finalizers":[]}}' --type=merge -n argocd
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault-operator
  namespace: argocd
spec:
  project: default
  destination:
    server: https://kubernetes.default.svc
    namespace: vault
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
  source:
    repoURL: https://helm.releases.hashicorp.com
    targetRevision: 0.10.0
    chart: vault-secrets-operator
    helm:
      valuesObject:
        fullnameOverride: vault-operator

---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault-test
  namespace: argocd
spec:
  project: default
  destination:
    server: https://kubernetes.default.svc
    namespace: vault
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
  source:
    repoURL: https://cicd-toolkit.github.io/helm-charts
    targetRevision: 0.0.2
    chart: generic
    helm:
      valuesObject:
        extraObjects:
          - |
            apiVersion: secrets.hashicorp.com/v1beta1
            kind: VaultConnection
            metadata:
              name: vault-connection
            spec:
              address: https://vault.vault.svc.cluster.local:8200
              skipTLSVerify: true

          - |
            apiVersion: v1
            kind: ServiceAccount
            metadata:
              name: vault-auth-test


          - |
            apiVersion: secrets.hashicorp.com/v1beta1
            kind: VaultAuth
            metadata:
              name: vault-auth-test
            spec:
              vaultConnectionRef: vault-connection
              method: appRole
              mount: approle
              appRole:
                roleId: 84b863c8-a211-1475-8570-15f83a83bf1e
                secretRef: vault-approle-auth-test

          - |
            apiVersion: secrets.hashicorp.com/v1beta1
            kind: VaultStaticSecret
            metadata:
              name: vault-static-secret
            spec:
              vaultAuthRef: vault-auth-test
              path: test
              type: kv-v2
              mount: secret
              destination:
                name: test-vso
                type: Opaque
                create: true
                overwrite: true

vault.yaml

## kubectl delete application.argoproj.io/vault -n argocd
## kubectl patch apps/vault -p '{"metadata":{"finalizers":[]}}' --type=merge -n argocd
## kubectl delete ns vault
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault-ca
  namespace: argocd
spec:
  project: default
  destination:
    server: https://kubernetes.default.svc
    namespace: vault
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
  source:
    repoURL: https://cicd-toolkit.github.io/helm-charts
    targetRevision: 0.0.2
    chart: generic
    helm:
      valuesObject:
        extraObjects:
          - |
            apiVersion: cert-manager.io/v1
            kind: Issuer
            metadata:
              name: vault-bootstrap-issuer
            spec:
              selfSigned: {}
          - |
            apiVersion: cert-manager.io/v1
            kind: Certificate
            metadata:
              name: vault-root-ca
            spec:
              isCA: true
              commonName: "Vault Root CA"
              secretName: vault-root-ca-secret
              duration: 2160h0m0s
              renewBefore: 360h0m0s
              privateKey:
                algorithm: ECDSA
                size: 256
              issuerRef:
                name: vault-bootstrap-issuer
                kind: Issuer
                group: cert-manager.io

          - |
            apiVersion: cert-manager.io/v1
            kind: Issuer
            metadata:
              name: vault-ca-issuer
            spec:
              ca:
                secretName: vault-root-ca-secret

          - |
            apiVersion: cert-manager.io/v1
            kind: Certificate
            metadata:
              name: vault-server-cert
            spec:
              secretName: vault-server-tls
              duration: 2160h0m0s # 10 year
              renewBefore: 720h0m0s # 30 days
              commonName: vault.vault.svc
              dnsNames:
              - vault
              - vault.vault
              - vault.vault.svc.cluster.local              
              - vault.vault-internal
              - vault-0.vault-internal
              - vault-1.vault-internal
              - vault-2.vault-internal
              - "*.vault-internal"
              - localhost
              ipAddresses:
              - 127.0.0.1
              issuerRef:
                name: vault-ca-issuer
                kind: Issuer
              usages:
                - server auth
                - client auth



---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault
  namespace: argocd
spec:
  project: default
  destination:
    server: https://kubernetes.default.svc
    namespace: vault
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
  source:
    repoURL: https://helm.releases.hashicorp.com
    targetRevision: 0.30.1
    chart: vault
    helm:
      valuesObject:
        global:
          tlsDisable: false
        ui:
          enabled: true
        injector:
          enabled: false
        server:
          updateStrategyType: RollingUpdate
          extraEnvironmentVars:
            VAULT_SKIP_VERIFY: "true"
          volumes:
          - name: vault-key
            secret:
              secretName: vault-key
          - name: vault-tls
            secret:
              secretName: vault-server-tls
          volumeMounts:
          - mountPath: /tmp/key
            name: vault-key
            readOnly: true
          - name: vault-tls
            mountPath: /vault/tls
            readOnly: true

          annotations: |
            config-checksum: {{ include (print $.Template.BasePath "/server-config-configmap.yaml") . | sha256sum }}

          postStart:
            - sh
            - -c
            - |
              # add as trust cert
              cat /vault/tls/ca.crt >> /etc/ssl/certs/ca-certificates.crt
              # Wait for vault and unseal
              sleep 9
              while read -r line; do
                [ -z "$line" ] && continue
                key=$(echo "$line" | cut -d' ' -f4)
                echo "Unsealing vault with key: $key"
                [ -n "$key" ] && vault operator unseal "$key"
                vault status 2>/dev/null | grep -q "Sealed.*false" && break
                sleep 0.5
              done < /tmp/key/key
          ha:
            enabled: true
            replicas: 3
            raft:
              enabled: true
              setNodeId: true
              config: |
                ui = true
                cluster_name = "vault-integrated-storage"
                listener "tcp" {
                  address = "[::]:8200"
                  cluster_address = "[::]:8201"
                  tls_cert_file = "/vault/tls/tls.crt"
                  tls_key_file = "/vault/tls/tls.key"
                  tls_client_ca_file = "/vault/tls/ca.crt"
                  telemetry {
                    unauthenticated_metrics_access = "true"
                  }
                }

                storage "raft" {
                  path = "/vault/data"
                  node_id = "HOSTNAME"
                  retry_join {
                    leader_api_addr = "https://vault-0.vault-internal:8200"
                    leader_ca_cert_file = "/vault/tls/ca.crt"
                    leader_client_cert_file = "/vault/tls/tls.crt"
                    leader_client_key_file = "/vault/tls/tls.key"
                  }
                  retry_join {
                    leader_api_addr = "https://vault-1.vault-internal:8200"
                    leader_ca_cert_file = "/vault/tls/ca.crt"
                    leader_client_cert_file = "/vault/tls/tls.crt"
                    leader_client_key_file = "/vault/tls/tls.key"
                  }
                  retry_join {
                    leader_api_addr = "https://vault-2.vault-internal:8200"
                    leader_ca_cert_file = "/vault/tls/ca.crt"
                    leader_client_cert_file = "/vault/tls/tls.crt"
                    leader_client_key_file = "/vault/tls/tls.key"
                  }
                }

                telemetry {
                 prometheus_retention_time = "1m"
                 disable_hostname = true
                }
            disruptionBudget:
              enabled: true
              maxUnavailable: 1


# kubectl exec -i -t -n vault vault-0 -- sh -c "vault operator init > /tmp/key1 && cat /tmp/key1"
# kubectl exec -i -t -n vault vault-0 -- sh -c "cat /tmp/key1 | grep 'Key ' | awk '{print $NF}' | xargs -I{} vault operator unseal {}"
## copy the unseal keys in vault-key secret
# kubectl exec -i -t -n vault vault-0 -- sh -c "cat /tmp/key/key | grep 'Root Token: ' | cut -d' ' -f4 | xargs -I{} vault login {} && vault operator raft list-peers"