Update Helm chart vault to v0.32.0

[renovate]

This PR contains the following updates:

Package	Update	Change
vault (source)	minor	0.22.0 → 0.32.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

hashicorp/vault-helm (vault)

v0.32.0

Compare Source

Changes:

• Default vault version updated to 1.21.2
• Default vault-csi-provider version updated to 1.7.0
• Default vault-k8s version updated to 1.7.2
• Tested with Vault versions 1.21-1.19, 1.16
• Tested with Kubernetes versions 1.35-1.31
• Test with Kind v0.31.0

Features:

• server: Add OpenShift service-ca operator automation GH-1165

Improvements:

• server: Allow users to specify the target service for the ServiceMonitor GH-1148

Bugs:

• server: Add namespace to network policy template GH-1152
• server: Check if disable_mlock is already set before adding to end of HCL config GH-1154
• server: provide declarative parameters for volumeClaimTemplates GH-982

v0.31.0

Compare Source

Changes:

• Default vault version updated to 1.20.4
• Default vault-csi-provider version updated to 1.6.0
• Change default csi.daemonSet.providersDir to "/var/run/secrets-store-csi-providers"

Features:

• csi: Add Red Hat certified vault-csi-provider image to OpenShift defaults GH-1134

Improvements:

• server: Add metricRelabelings to serviceMonitor options GH-1131

v0.30.1

Compare Source

Changes:

• Default vault version updated to 1.20.1
• Default vault-k8s version updated to 1.7.0
• Default vault-csi-provider version updated to 1.5.1
• Tested with Kubernetes versions 1.29-1.33

Bugs:

• server: Allow server.service.active.annotations and server.service.standby.annotation to override server.service.annotations GH-1121

v0.30.0

Compare Source

Changes:

• Default vault version updated to 1.19.0
• Default vault-k8s version updated to 1.6.2
• Tested with Kubernetes versions 1.28-1.32

Features:

• server: Support setting custom preStop commands GH-1099

Improvements:

• server: Add pod labels to server-test.yaml GH-1094

Bugs:

• server: Fix invalid yaml in server test when volumeMounts or volumes are empty GH-855
• injector: Add RBAC for deleting configmaps GH-1100

v0.29.1

Compare Source

Bugs:

• server: restore support for templated config GH-1073

v0.29.0

Compare Source

KNOWN ISSUES:

• Template support in server config stopped working GH-1072

Changes:

• Default vault version updated to 1.18.1
• Default vault-k8s version updated to 1.5.0
• Default vault-csi-provider version updated to 1.5.0
• Tested with Kubernetes versions 1.27-1.31

Features:

• csi: Allow modification of the hostNetwork parameter on the DaemonSet GH-1046

Bugs:

• Properly handle JSON formatted server config GH-1049

v0.28.1

Compare Source

Changes:

• Default vault version updated to 1.17.2
• Default vault-k8s version updated to 1.4.2
• Default vault-csi-provider version updated to 1.4.3
• Tested with Kubernetes versions 1.26-1.30

Improvements:

• Configurable tlsConfig and authorization for Prometheus ServiceMonitor GH-1025
• Remove UPDATE from injector-mutating-webhook GH-783
• Add scope to mutating webhook GH-1037

v0.28.0

Compare Source

Changes:

• Default vault version updated to 1.16.1
• Default vault-k8s version updated to 1.4.1
• Default vault-csi-provider version updated to 1.4.2
• Tested with Kubernetes versions 1.25-1.29

Features:

• server: Add annotation on config change GH-1001

Bugs:

• injector: add missing get nodes permission to ClusterRole GH-1005

v0.27.0

Compare Source

Changes:

• Default vault version updated to 1.15.2

Features:

• server: Support setting persistentVolumeClaimRetentionPolicy on the StatefulSet GH-965
• server: Support setting labels on PVCs GH-969
• server: Support setting ingress rules for networkPolicy GH-877

Improvements:

• Support exec in the server liveness probe GH-971

v0.26.1

Compare Source

Bugs:

• Fix templating of server.ha.replicas when set via override file. The 0.26.0 chart would ignore server.ha.replicas and always deploy 3 server replicas when server.ha.enabled=true unless overridden by command line when issuing the helm command: --set server.ha.replicas=<some_number>. Fixed in GH-961

v0.26.0

Compare Source

Changes:

• Default vault version updated to 1.15.1
• Default vault-k8s version updated to 1.3.1
• Default vault-csi-provider version updated to 1.4.1
• Tested with Kubernetes versions 1.24-1.28
• server: OpenShift default readiness probe returns 204 when uninitialized GH-966

Features:

• server: Add support for dual stack clusters GH-833
• server: Support hostAliases for the StatefulSet pods GH-955
• server: Add server.service.active.annotations and server.service.standby.annotations GH-896
• server: Add long-lived service account token option GH-923

Bugs:

• csi: Add namespace field to csi-role and csi-rolebindings. GH-909

Improvements:

• global: Add global.namespace to override the helm installation namespace. GH-909
• server: use vault.fullname in Helm test GH-912
• server: Allow scaling HA replicas to zero GH-943

v0.25.0

Compare Source

Changes:

• Latest Kubernetes version tested is now 1.27
• server: Headless service ignores server.service.publishNotReadyAddresses setting and always sets it as true GH-902
• vault updated to 1.14.0 GH-916
• vault-csi-provider updated to 1.4.0 GH-916

Improvements:

• CSI: Make nodeSelector and affinity configurable for CSI daemonset's pods GH-862
• injector: Add ephemeralLimit and ephemeralRequest as options for configuring Agent's ephemeral storage resources GH-798
• Minimum kubernetes version for chart reverted to 1.20.0 to allow installation on clusters older than the oldest tested version GH-916

Bugs:

• server: Set the default for prometheusRules.rules to an empty list GH-886

v0.24.1

Compare Source

Bugs:

• csi: Add RBAC required by v1.3.0 to create secret for HMAC key used to generate secret versions GH-872

v0.24.0

Compare Source

Changes:

• Earliest Kubernetes version tested is now 1.22
• vault updated to 1.13.1 GH-863
• vault-k8s updated to 1.2.1 GH-868
• vault-csi-provider updated to 1.3.0 GH-749

Features:

• server: New extraPorts option for adding ports to the Vault server statefulset GH-841
• server: Add configurable Port Number in readinessProbe and livenessProbe for the server-statefulset GH-831
• injector: Make livenessProbe and readinessProbe configurable and add configurable startupProbe GH-852
• csi: Add an Agent sidecar to Vault CSI Provider pods to provide lease caching and renewals GH-749

v0.23.0

Compare Source

Changes:

• vault updated to 1.12.1 GH-814
• vault-k8s updated to 1.1.0 GH-814
• vault-csi-provider updated to 1.2.1 GH-814

Features:

• server: Add extraLabels for Vault server serviceAccount GH-806
• server: Add server.service.active.enabled and server.service.standby.enabled options to selectively disable additional services GH-811
• server: Add server.serviceAccount.serviceDiscovery.enabled option to selectively disable a Vault service discovery role and role binding GH-811
• server: Add server.service.instanceSelector.enabled option to allow selecting pods outside the helm chart deployment GH-813

Bugs:

• server: Quote .server.ha.clusterAddr value GH-810

v0.22.1

Compare Source

Changes:

• vault updated to 1.12.0 GH-803
• vault-k8s updated to 1.0.1 GH-803

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.