add helm charts

2025-11-09 13:22:40 +03:30
parent 282c3e52d0
commit 38e4d749ad
1352 changed files with 190457 additions and 0 deletions
--- a/backing-services/vault/templates/injector/clusterrolebinding.yaml
+++ b/backing-services/vault/templates/injector/clusterrolebinding.yaml
@@ -0,0 +1,27 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.injector.enabled .Values.injector.rbac.create }}
+kind: ClusterRoleBinding
+apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
+metadata:
+  name: {{ include "vault.injector.fullname.namespace" . }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/part-of: vault
+    app.kubernetes.io/component: injector
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "vault.injector.fullname.namespace" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "vault.injector.serviceAccountName" . }}
+    namespace: {{ include "common.names.namespace" . | quote }}
+{{- end }}
--- a/backing-services/vault/templates/injector/clusterroles.yaml
+++ b/backing-services/vault/templates/injector/clusterroles.yaml
@@ -0,0 +1,30 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.injector.enabled .Values.injector.rbac.create }}
+kind: ClusterRole
+apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
+metadata:
+  name: {{ include "vault.injector.fullname.namespace" . }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/part-of: vault
+    app.kubernetes.io/component: injector
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+rules:
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "patch"
+  {{- if .Values.injector.rbac.rules }}
+  {{- include "common.tplvalues.render" ( dict "value" .Values.injector.rbac.rules "context" $ ) | nindent 2 }}
+  {{- end }}
+{{- end }}
--- a/backing-services/vault/templates/injector/deployment.yaml
+++ b/backing-services/vault/templates/injector/deployment.yaml
@@ -0,0 +1,183 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.injector.enabled }}
+apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+  name: {{ template "vault.injector.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/part-of: vault
+    app.kubernetes.io/component: injector
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if not .Values.injector.autoscaling.enabled }}
+  replicas: {{ .Values.injector.replicaCount }}
+  {{- end }}
+  {{- if .Values.injector.updateStrategy }}
+  strategy: {{- toYaml .Values.injector.updateStrategy | nindent 4 }}
+  {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.injector.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/part-of: vault
+      app.kubernetes.io/component: injector
+  template:
+    metadata:
+      {{- if .Values.injector.podAnnotations }}
+      annotations: {{- include "common.tplvalues.render" (dict "value" .Values.injector.podAnnotations "context" $) | nindent 8 }}
+      {{- end }}
+      labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
+        app.kubernetes.io/part-of: vault
+        app.kubernetes.io/component: injector
+    spec:
+      serviceAccountName: {{ template "vault.injector.serviceAccountName" . }}
+      {{- include "vault.imagePullSecrets" . | nindent 6 }}
+      {{- if .Values.injector.hostAliases }}
+      hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.injector.hostAliases "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.injector.affinity }}
+      affinity: {{- include "common.tplvalues.render" ( dict "value" .Values.injector.affinity "context" $) | nindent 8 }}
+      {{- else }}
+      affinity:
+        podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.injector.podAffinityPreset "component" "injector" "customLabels" $podLabels "context" $) | nindent 10 }}
+        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.injector.podAntiAffinityPreset "component" "injector" "customLabels" $podLabels "context" $) | nindent 10 }}
+        nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.injector.nodeAffinityPreset.type "key" .Values.injector.nodeAffinityPreset.key "values" .Values.injector.nodeAffinityPreset.values) | nindent 10 }}
+      {{- end }}
+      {{- if .Values.injector.nodeSelector }}
+      nodeSelector: {{- include "common.tplvalues.render" ( dict "value" .Values.injector.nodeSelector "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.injector.tolerations }}
+      tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.injector.tolerations "context" .) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.injector.priorityClassName }}
+      priorityClassName: {{ .Values.injector.priorityClassName | quote }}
+      {{- end }}
+      {{- if .Values.injector.schedulerName }}
+      schedulerName: {{ .Values.injector.schedulerName | quote }}
+      {{- end }}
+      {{- if .Values.injector.topologySpreadConstraints }}
+      topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.injector.topologySpreadConstraints "context" .) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.injector.podSecurityContext.enabled }}
+      securityContext: {{- omit .Values.injector.podSecurityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      {{- if .Values.injector.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ .Values.injector.terminationGracePeriodSeconds }}
+      {{- end }}
+      {{- if .Values.injector.initContainers }}
+      initContainers:
+        {{- include "common.tplvalues.render" (dict "value" .Values.injector.initContainers "context" $) | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: sidecar-injector
+          image: {{ template "vault.injector.image" . }}
+          imagePullPolicy: {{ .Values.injector.image.pullPolicy }}
+          {{- if .Values.injector.containerSecurityContext.enabled }}
+          securityContext: {{- omit .Values.injector.containerSecurityContext "enabled" | toYaml | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
+          {{- else if .Values.injector.command }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.injector.command "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
+          {{- else if .Values.injector.args }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.injector.args "context" $) | nindent 12 }}
+          {{- else }}
+          args:
+            - agent-inject
+            - 2>&1
+            {{- if .Values.injector.image.debug }}
+            - -log-level=debug
+            {{- end }}
+          {{- end }}
+          env:
+            - name: AGENT_INJECT_LISTEN
+              value: :{{ .Values.injector.containerPorts.https }}
+            - name: AGENT_INJECT_VAULT_ADDR
+              value: http://{{ include "vault.server.fullname" . }}:{{ .Values.server.service.general.ports.http }}
+            - name: AGENT_INJECT_VAULT_AUTH_PATH
+              value: auth/kubernetes
+            - name: AGENT_INJECT_VAULT_IMAGE
+              value: {{ include "vault.server.image" . | quote }}
+            - name: AGENT_INJECT_TLS_AUTO
+              value: {{ include "vault.injector.fullname.namespace" . | quote }}
+            {{- $host := include "vault.injector.fullname" . }}
+            {{- $ns := include "common.names.namespace" . }}
+            - name: AGENT_INJECT_TLS_AUTO_HOSTS
+              value: {{ $host }},{{ printf "%s.%s" $host $ns }},{{ printf "%s.%s.svc" $host $ns }}
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+                 {{- if .Values.injector.extraEnvVars }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.injector.extraEnvVars "context" $) | nindent 12 }}
+            {{- end }}
+          envFrom:
+            {{- if .Values.injector.extraEnvVarsCM }}
+            - configMapRef:
+                name: {{ include "common.tplvalues.render" (dict "value" .Values.injector.extraEnvVarsCM "context" $) }}
+            {{- end }}
+            {{- if .Values.injector.extraEnvVarsSecret }}
+            - secretRef:
+                name: {{ include "common.tplvalues.render" (dict "value" .Values.injector.extraEnvVarsSecret "context" $) }}
+            {{- end }}
+          {{- if .Values.injector.resources }}
+          resources: {{- toYaml .Values.injector.resources | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: https
+              containerPort: {{ .Values.injector.containerPorts.https }}
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.injector.customLivenessProbe }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.injector.customLivenessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.injector.livenessProbe.enabled }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.injector.livenessProbe "enabled") "context" $) | nindent 12 }}
+            httpGet:
+              path: /health/ready
+              port: https
+              scheme: HTTPS
+          {{- end }}
+          {{- if .Values.injector.customReadinessProbe }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.injector.customReadinessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.injector.readinessProbe.enabled }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.injector.readinessProbe "enabled") "context" $) | nindent 12 }}
+            httpGet:
+              path: /health/ready
+              port: https
+              scheme: HTTPS
+          {{- end }}
+          {{- if .Values.injector.customStartupProbe }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.injector.customStartupProbe "context" $) | nindent 12 }}
+          {{- else if .Values.injector.startupProbe.enabled }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.injector.startupProbe "enabled") "context" $) | nindent 12 }}
+            httpGet:
+              path: /health/ready
+              port: https
+              scheme: HTTPS
+          {{- end }}
+          {{- end }}
+          {{- if .Values.injector.lifecycleHooks }}
+          lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.injector.lifecycleHooks "context" $) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+          {{- if .Values.injector.extraVolumeMounts }}
+          {{- include "common.tplvalues.render" (dict "value" .Values.injector.extraVolumeMounts "context" $) | nindent 12 }}
+          {{- end }}
+        {{- if .Values.injector.sidecars }}
+        {{- include "common.tplvalues.render" ( dict "value" .Values.injector.sidecars "context" $) | nindent 8 }}
+        {{- end }}
+      volumes:
+        {{- if .Values.injector.extraVolumes }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.injector.extraVolumes "context" $) | nindent 8 }}
+        {{- end }}
+{{- end }}
--- a/backing-services/vault/templates/injector/hpa.yaml
+++ b/backing-services/vault/templates/injector/hpa.yaml
@@ -0,0 +1,50 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.injector.autoscaling.enabled }}
+apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ template "vault.injector.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  scaleTargetRef:
+    apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
+    kind: Deployment
+    name: {{ template "vault.injector.fullname" . }}
+  minReplicas: {{ .Values.injector.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.injector.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.injector.autoscaling.targetCPU }}
+    - type: Resource
+      resource:
+        name: cpu
+        {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
+        targetAverageUtilization: {{ .Values.injector.autoscaling.targetCPU }}
+        {{- else }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.injector.autoscaling.targetCPU }}
+        {{- end }}
+    {{- end }}
+    {{- if .Values.injector.autoscaling.targetMemory }}
+    - type: Resource
+      resource:
+        name: memory
+        {{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) }}
+        targetAverageUtilization: {{ .Values.injector.autoscaling.targetMemory }}
+        {{- else }}
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.injector.autoscaling.targetMemory }}
+        {{- end }}
+    {{- end }}
+{{- end }}
--- a/backing-services/vault/templates/injector/mutating-webhook.yaml
+++ b/backing-services/vault/templates/injector/mutating-webhook.yaml
@@ -0,0 +1,43 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.injector.enabled }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ include "vault.injector.fullname.namespace" . }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/part-of: vault
+    app.kubernetes.io/component: injector
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+webhooks:
+  - name: vault.hashicorp.com
+    failurePolicy: Ignore
+    matchPolicy: Exact
+    sideEffects: None
+    timeoutSeconds: 30
+    admissionReviewVersions: ["v1", "v1beta1"]
+    clientConfig:
+      service:
+        name: {{ include "vault.injector.fullname" . }}
+        namespace: {{ include "common.names.namespace" . | quote }}
+        path: "/mutate"
+      caBundle: ""
+    rules:
+      - operations: ["CREATE", "UPDATE"]
+        apiGroups: [""]
+        apiVersions: ["v1"]
+        resources: ["pods"]
+    objectSelector:
+      matchExpressions:
+        - key: app.kubernetes.io/component
+          operator: NotIn
+          values:
+            - injector
+{{- end }}
--- a/backing-services/vault/templates/injector/pdb.yaml
+++ b/backing-services/vault/templates/injector/pdb.yaml
@@ -0,0 +1,32 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.injector.pdb.create }}
+apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "vault.injector.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/part-of: vault
+    app.kubernetes.io/component: injector
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.injector.pdb.minAvailable }}
+  minAvailable: {{ .Values.injector.pdb.minAvailable }}
+  {{- end }}
+  {{- if .Values.injector.pdb.maxUnavailable }}
+  maxUnavailable: {{ .Values.injector.pdb.maxUnavailable }}
+  {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.injector.podLabels .Values.commonLabels ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/part-of: vault
+      app.kubernetes.io/component: injector
+{{- end }}
--- a/backing-services/vault/templates/injector/role.yaml
+++ b/backing-services/vault/templates/injector/role.yaml
@@ -0,0 +1,59 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.injector.enabled .Values.injector.rbac.create }}
+kind: Role
+apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
+metadata:
+  name: {{ printf "%s-leader-election" (include "vault.injector.fullname.namespace" .) | trunc 63 | trimSuffix "-" }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/part-of: vault
+    app.kubernetes.io/component: injector
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps/status
+    verbs:
+      - get
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+  - apiGroups:
+      - "coordination.k8s.io"
+    resources:
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+{{- end }}
--- a/backing-services/vault/templates/injector/rolebinding.yaml
+++ b/backing-services/vault/templates/injector/rolebinding.yaml
@@ -0,0 +1,28 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.injector.enabled .Values.injector.rbac.create }}
+kind: RoleBinding
+apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
+metadata:
+  name: {{ printf "%s-leader-election" (include "vault.injector.fullname.namespace" .) | trunc 63 | trimSuffix "-" }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/part-of: vault
+    app.kubernetes.io/component: injector
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ printf "%s-leader-election" (include "vault.injector.fullname.namespace" .) | trunc 63 | trimSuffix "-" }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "vault.injector.serviceAccountName" . }}
+    namespace: {{ include "common.names.namespace" . | quote }}
+{{- end }}
--- a/backing-services/vault/templates/injector/service-account.yaml
+++ b/backing-services/vault/templates/injector/service-account.yaml
@@ -0,0 +1,20 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.injector.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "vault.injector.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+  {{- if or .Values.injector.serviceAccount.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.injector.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.injector.serviceAccount.automountServiceAccountToken }}
+{{- end }}
--- a/backing-services/vault/templates/injector/service.yaml
+++ b/backing-services/vault/templates/injector/service.yaml
@@ -0,0 +1,58 @@
+{{- /*
+Copyright VMware, Inc.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.injector.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "vault.injector.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.injector.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/part-of: vault
+    app.kubernetes.io/component: injector
+  {{- if or .Values.injector.service.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.injector.service.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.injector.service.type }}
+  {{- if and .Values.injector.service.clusterIP (eq .Values.injector.service.type "ClusterIP") }}
+  clusterIP: {{ .Values.injector.service.clusterIP }}
+  {{- end }}
+  {{- if .Values.injector.service.sessionAffinity }}
+  sessionAffinity: {{ .Values.injector.service.sessionAffinity }}
+  {{- end }}
+  {{- if .Values.injector.service.sessionAffinityConfig }}
+  sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.injector.service.sessionAffinityConfig "context" $) | nindent 4 }}
+  {{- end }}
+  {{- if or (eq .Values.injector.service.type "LoadBalancer") (eq .Values.injector.service.type "NodePort") }}
+  externalTrafficPolicy: {{ .Values.injector.service.externalTrafficPolicy | quote }}
+  {{- end }}
+  {{- if and (eq .Values.injector.service.type "LoadBalancer") (not (empty .Values.injector.service.loadBalancerSourceRanges)) }}
+  loadBalancerSourceRanges: {{ .Values.injector.service.loadBalancerSourceRanges }}
+  {{- end }}
+  {{- if and (eq .Values.injector.service.type "LoadBalancer") (not (empty .Values.injector.service.loadBalancerIP)) }}
+  loadBalancerIP: {{ .Values.injector.service.loadBalancerIP }}
+  {{- end }}
+  ports:
+    - name: https
+      port: {{ .Values.injector.service.ports.https }}
+      protocol: TCP
+      {{- if and (or (eq .Values.injector.service.type "NodePort") (eq .Values.injector.service.type "LoadBalancer")) (not (empty .Values.injector.service.nodePorts.https)) }}
+      nodePort: {{ .Values.injector.service.nodePorts.https }}
+      {{- else if eq .Values.injector.service.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+      targetPort: https
+    {{- if .Values.injector.service.extraPorts }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.injector.service.extraPorts "context" $) | nindent 4 }}
+    {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.injector.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/part-of: vault
+    app.kubernetes.io/component: injector
+{{- end }}