reworking default namespace

apps/default/vaultwarden.yaml

@@ -1,3 +1,5 @@
+---
+# 1) Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,117 +10,124 @@ spec:
   selector:
     matchLabels:
       app: vaultwarden
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
         app: vaultwarden
     spec:
       containers:
-      - env:
-        - name: DOMAIN
-          value: https://vault.haven
-        - name: ADMIN_TOKEN
-          valueFrom:
-            secretKeyRef:
-              key: ADMIN_TOKEN
-              name: vaultwarden-admin-token
-        image: vaultwarden/server:latest
-        imagePullPolicy: Always
-        livenessProbe:
-          failureThreshold: 6
-          httpGet:
-            path: /alive
-            port: vault-port
-            scheme: HTTP
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 3
-        name: vaultwarden
-        ports:
-        - containerPort: 80
-          name: vault-port
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /alive
-            port: vault-port
-            scheme: HTTP
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 3
-        resources:
-          limits:
-            cpu: 250m
-            memory: 256Mi
-          requests:
-            cpu: 250m
-            memory: 64Mi
-        startupProbe:
-          failureThreshold: 30
-          httpGet:
-            path: /alive
-            port: vault-port
-            scheme: HTTP
-          periodSeconds: 5
-          successThreshold: 1
-          timeoutSeconds: 3
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - mountPath: /data
-          name: vaultwarden-data
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
+        - name: vaultwarden
+          image: vaultwarden/server:latest
+          imagePullPolicy: Always
+          env:
+            - name: DOMAIN
+              value: "https://vault.haven"
+            - name: ADMIN_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: vaultwarden-admin-token
+                  key: ADMIN_TOKEN
+          ports:
+            - containerPort: 80
+              name: vault-port
+          # /alive requires no authentication and verifies the Vaultwarden process
+          startupProbe:
+            httpGet:
+              path: /alive
+              port: vault-port
+              scheme: HTTP
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /alive
+              port: vault-port
+              scheme: HTTP
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /alive
+              port: vault-port
+              scheme: HTTP
+            periodSeconds: 15
+            timeoutSeconds: 3
+            failureThreshold: 6
+          volumeMounts:
+            - name: vaultwarden-data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: 250m
+              memory: 64Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
       volumes:
-      - name: vaultwarden-data
-        persistentVolumeClaim:
-          claimName: vaultwarden-data
+        - name: vaultwarden-data
+          persistentVolumeClaim:
+            claimName: vaultwarden-data
+---
+# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
   name: vaultwarden
   namespace: default
 spec:
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: vault-port
+  type: ClusterIP
   selector:
     app: vaultwarden
-  sessionAffinity: None
-  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: vault-port
+---
+# 3) PersistentVolumeClaim (for /data)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-data
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "vaultwarden-data"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+---
+# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: vaultwarden
   namespace: default
+  annotations:
+    cert-manager.io/cluster-issuer: internal-ca
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
   ingressClassName: nginx
-  rules:
-  - host: vault.haven
-    http:
-      paths:
-      - backend:
-          service:
-            name: vaultwarden
-            port:
-              number: 80
-        path: /
-        pathType: Prefix
   tls:
-  - hosts:
-    - vault.haven
-    secretName: vaultwarden-tls
+    - hosts:
+        - vault.haven
+      secretName: vaultwarden-tls
+  rules:
+    - host: vault.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vaultwarden
+                port:
+                  number: 80
+---
+# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -127,26 +136,13 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-  - host: vault.ivanch.me
-    http:
-      paths:
-      - backend:
-          service:
-            name: vaultwarden
-            port:
-              number: 80
-        path: /
-        pathType: Prefix
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vaultwarden-data
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem
+    - host: vault.ivanch.me
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vaultwarden
+                port:
+                  number: 80