apiVersion: "vault.banzaicloud.com/v1alpha1"
kind: "Vault"
metadata:
  name: "vault"
spec:
  size: 2
  image: vault:1.1.0
  bankVaultsImage: banzaicloud/bank-vaults:latest

  # Describe where you would like to store the Vault unseal keys and root token
  # in GCS encrypted with KMS.
  unsealConfig:
    google:
      kmsKeyRing: "vault"
      kmsCryptoKey: "vault-unsealer"
      kmsLocation: "global"
      kmsProject: "continual-air-196513"
      storageBucket: "vault-ha"

  # Specify the ServiceAccount where the Vault Pod and the Bank-Vaults configurer/unsealer is running
  serviceAccount: vault

  # A YAML representation of a final vault config file, this config represents
  # a HA config in Google Cloud.
  # See https://www.vaultproject.io/docs/configuration/ for more information.
  config:
    storage:
      gcs:
        bucket: "vault-ha"
        ha_enabled: "true"
    listener:
      tcp:
        address: "0.0.0.0:8200"
        tls_cert_file: /vault/tls/server.crt
        tls_key_file: /vault/tls/server.key
    seal:
      gcpckms:
        project: "continual-air-196513"
        region: "global"
        key_ring: "vault"
        crypto_key: "vault-unsealer"
    api_addr: https://vault.default:8200
    telemetry:
      statsd_address: localhost:9125
    ui: true

  # See: https://github.com/banzaicloud/bank-vaults#example-external-vault-configuration for more details.
  externalConfig:
    policies:
      - name: allow_secrets
        rules: path "secret/*" {
          capabilities = ["create", "read", "update", "delete", "list"]
          }
    auth:
      - type: kubernetes
        roles:
          # Allow every pod in the default namespace to use the secret kv store
          - name: default
            bound_service_account_names: default
            bound_service_account_namespaces: default
            policies: allow_secrets
            ttl: 1h

  # If you are not using a Service Account to authenticate against GCP you can pass in an
  # GCP credentials refering to a Secret with the following configuration block. You have to
  # create the "gcp-sa" secret manually, it has to have a key called "service-account.json"
  # holding the configuration in the following format:
  # https://cloud.google.com/docs/authentication/getting-started
  credentialsConfig:
    env: GOOGLE_APPLICATION_CREDENTIALS
    path: /etc/gcp/service-account.json
    secretName: gcp-sa

Add example CR configuration with autounseal on GCP
Add example CR configuration with autounseal on GCP
