Refining vaultwarden

vaultwarden-argocd-apps/templates/vaultwarden-requirements-app.yaml

@@ -23,6 +23,7 @@ spec:
             name: {{ .Values.vaultwarden.dataPvc.name }}
             storageClassName: {{ .Values.vaultwarden.dataPvc.storageClassName }}
             size: {{ .Values.vaultwarden.dataPvc.size }}
+        mainNamespace: {{ .Values.destnation.namespace }}
   destination:
     server: {{ .Values.destination.server }} 
     namespace: {{ .Values.destination.namespace }}

vaultwarden-argocd-apps/values.yaml

@@ -25,7 +25,7 @@ vaultwarden:
     size: 10Gi
   attachmentPvc:
     name: vaultwarden-attachments
-    storageClassName: ''
+    storageClassName: 'linode-block-storage-retain-luks-vw'
     size: 10Gi
   fqdn: vaultwarden.domain.net
   timeZone: "Europe/Lisbon"

vaultwarden-requirements/templates/encrypted-storage-class.yaml

@@ -0,0 +1,14 @@
+allowVolumeExpansion: true
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: linode-block-storage-retain-luks-vw
+  namespace: kube-system
+provisioner: linodebs.csi.linode.com
+reclaimPolicy: Retain
+parameters:
+  linodebs.csi.linode.com/luks-encrypted: "true"
+  linodebs.csi.linode.com/luks-cipher: "aes-xts-plain64"
+  linodebs.csi.linode.com/luks-key-size: "512"
+  csi.storage.k8s.io/node-stage-secret-namespace: {{ .Values.mainNamespace }}
+  csi.storage.k8s.io/node-stage-secret-name: vw-data-luks-key

vaultwarden-requirements/templates/vaultwarden-data.yaml

@@ -1,13 +0,0 @@
-{{- if false -}}
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: {{ .Values.vaultwarden.dataPvc.name }}
-spec:
-  storageClassName: {{ .Values.vaultwarden.dataPvc.storageClassName }}
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: {{ .Values.vaultwarden.dataPvc.size }}
-{{- end }}

vaultwarden-requirements/values.yaml

@@ -6,3 +6,4 @@ vaultwarden:
     name: vaultwarden-data
     storageClassName: ''
     size: 10Gi
+mainNamespace: vaultwarden