mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby Husky
f98c997293
Vault's OIDC auth method needs to resolve auth.kube.huskypup.net (the issuer URL) from inside its own pod - no in-cluster DNS entry exists for that public hostname, so add a hostAlias pointing at the live istio-ingressgateway LoadBalancer IP (verified current: 172.28.101.244). authentik-blueprints-vault (vault-blueprint.yaml) was already applied to the cluster and referenced by the authentik Deployment for some time - committing it now so git matches the live, working state instead of leaving it as an untracked local file.
50 lines
1002 B
YAML
50 lines
1002 B
YAML
server:
|
|
# HA mode with Raft integrated storage
|
|
ha:
|
|
enabled: true
|
|
replicas: 3
|
|
raft:
|
|
enabled: true
|
|
config: |
|
|
ui = true
|
|
listener "tcp" {
|
|
address = "0.0.0.0:8200"
|
|
tls_disable = 1
|
|
}
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
}
|
|
disable_mlock = true
|
|
service_registration "kubernetes" {}
|
|
telemetry {
|
|
prometheus_retention_time = "30s"
|
|
disable_hostname = true
|
|
}
|
|
|
|
hostAliases:
|
|
- ip: "172.28.101.244"
|
|
hostnames:
|
|
- auth.kube.huskypup.net
|
|
|
|
standalone:
|
|
enabled: false
|
|
|
|
dataStorage:
|
|
enabled: true
|
|
size: 10Gi
|
|
|
|
extraEnvironmentVars: {}
|
|
|
|
# Tolerate control-plane taint
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# Enable ServiceMonitor for Prometheus
|
|
serverTelemetry:
|
|
serviceMonitor:
|
|
enabled: true
|
|
selectors:
|
|
release: prometheus
|
|
interval: 30s |