add vault deployment

chart/templates/vault/gitrepository.yaml

+<<<<<<< HEAD
 {{- if and (not .Values.offline) .Values.addons.vault.enabled }}
+=======
+{{- if and (not .Values.offline) .Values.vault.enabled }}
+>>>>>>> eb61ff0b (add vault deployment)
 apiVersion: source.toolkit.fluxcd.io/v1beta1
 kind: GitRepository
 metadata:
@@ -10,9 +14,15 @@ metadata:
     {{- include "commonLabels" . | nindent 4}}
 spec:
   interval: {{ .Values.flux.interval }}
+<<<<<<< HEAD
   url: {{ .Values.addons.vault.git.repo }}
   ref:
     {{- include "validRef" .Values.addons.vault.git | nindent 4 }}
+=======
+  url: {{ .Values.vault.git.repo }}
+  ref:
+    {{- include "validRef" .Values.vault.git | nindent 4 }}
+>>>>>>> eb61ff0b (add vault deployment)
   {{ include "gitIgnore" . }}
   {{- include "gitCreds" . | nindent 2 }}
 {{- end }}

chart/templates/vault/twistlock-helmrelease.yaml

+{{- $fluxSettingsVault := merge .Values.vault.flux .Values.flux -}}
+{{- if .Values.vault.enabled }}
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault
+    app.kubernetes.io/component: "sandbox"
+    {{- include "commonLabels" . | nindent 4}}
+spec:
+  targetNamespace: vault
+  chart:
+    spec:
+      chart: {{ .Values.vault.git.path }}
+      interval: 5m
+      sourceRef:
+        kind: GitRepository
+        name: vault
+        namespace: {{ .Release.Namespace }}
+
+  {{- toYaml $fluxSettingsVault | nindent 2 }}
+  
+  {{- if .Values.vault.postRenderers }}
+  postRenderers:
+  {{ toYaml .Values.vault.postRenderers | nindent 4 }}
+  {{- end }}
+  valuesFrom:
+    - name: {{ .Release.Name }}-vault-values
+      kind: Secret
+      valuesKey: "common"
+    - name: {{ .Release.Name }}-vault-values
+      kind: Secret
+      valuesKey: "defaults"
+    - name: {{ .Release.Name }}-vault-values
+      kind: Secret
+      valuesKey: "overlays"
+
+  # TODO: DRY this up
+  {{- if or .Values.gatekeeper.enabled .Values.istio.enabled }}
+  dependsOn:
+    {{- if .Values.gatekeeper.enabled }}
+    - name: gatekeeper
+      namespace: {{ .Release.Namespace }}
+    {{- end }}
+    {{- if .Values.istio.enabled }}
+    - name: istio
+      namespace: {{ .Release.Namespace }}
+    {{- end }}
+    {{- if .Values.monitoring.enabled }}
+    - name: monitoring
+      namespace: {{ .Release.Namespace }}
+    {{- end }}
+  {{- end }}
+{{- end }}

chart/templates/vault/values.yaml

@@ -14,10 +14,11 @@ prometheus:
   servicemonitor:
     enabled: {{ .Values.monitoring.enabled }}
 
+imagePullSecrets:
+- name: private-registry
+
 networkPolicies:
   enabled: {{ .Values.networkPolicies.enabled }}
-  ingressLabels:
-    {{- $gateway := default "public" }}
   ingressLabels:
     {{- $gateway := default "public" .Values.twistlock.ingress.gateway }}
     {{- $default := dict "app" (dig "gateways" $gateway "ingressGateway" nil .Values.istio) "istio" nil }}

chart/values.yaml

@@ -562,6 +562,18 @@ addons:
     # -- Additional authservice chain configurations.
     chains: {}
 
+  # ----------------------------------------------------------------------------------------------------------------------  
+  # Vault
+ #
+  vault:
+  # -- Toggle deployment of vault.
+    enabled: true
+    git:
+      repo: https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/vault.git
+      path: "./chart"
+      branch: "deploy-vault"
+  # ----------------------------------------------------------------------------------------------------------------------  
+
   # ----------------------------------------------------------------------------------------------------------------------
   # Minio Operator and Instance
   #