helm repo add hashicorp https://helm.releases.hashicorp.com
helm install -n vault hashicorp/vault

k exec -it -n vault vault-0 -- vault operator init

>>>
Unseal Key 1: thb4LfR5mfQWoiDvV5Vhp6G5QLRdL633aCRrMy8jiTC0
Unseal Key 2: TxWOzDF6wOHJ2G/h4IuvVUjq36CKNLD1EOf4+ZiTeA/f
Unseal Key 3: KAMN99+ZEP8JyMO8WG1qvgron186VQ3lOmSXGrWWDDJz
Unseal Key 4: pyJiL6OvtfmG2fJ76lVEvCWRe0H11ie+QCIQKn70+cMi
Unseal Key 5: 4zTlV4UDrHCQtNWXJusvbizZ7hzdpupYbyllpAW0l0cT

Initial Root Token: hvs.0YbxXrzUrseKuFNukuNJEe9j

Vault initialized with 5 key shares and a key threshold of 3. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 3 of these keys to unseal it
before it can start servicing requests.

Vault does not store the generated root key. Without at least 3 keys to
reconstruct the root key, Vault will remain permanently sealed!

It is possible to generate new unseal keys, provided you have a quorum of
existing unseal keys shares. See "vault operator rekey" for more information.

repositories:
  - name: hashicorp
    url: https://helm.releases.hashicorp.com

releases:
  - name: vault
    namespace: vault
    chart: hashicorp/vault
    version: 0.31.0
    values:
      - server:
          ingress:
            enabled: true
            annotations:
              cert-manager.io/cluster-issuer: rootca-issuer
              kubernetes.io/tls-acme: "true"
            ingressClassName: nginx
            hosts:
              - host: "vault.Enterprise Cloud.hanacloudia.com"
            tls:
              - secretName: "vault.Enterprise Cloud.hanacloudia.com-tls"
                hosts:
                  - "vault.Enterprise Cloud.hanacloudia.com"
    set:
      - name: ui.enabled
        value: true

helmDefaults:
  wait: true
  timeout: 600
  atomic: true
  cleanupOnFail: true

hooks:
  - events: ["presync"]
    showlogs: true
    command: "helm"
    args:
      - "dependency"
      - "update"
      - "."
  - events: ["presync"]
    showlogs: true
    command: "kubectl"
    args:
      - "create"
      - "namespace"
      - "vault"
      - "--dry-run=client"
      - "-o"
      - "yaml"
      - "||"
      - "true"