new k8s.helm.v2.Chart(config.project, {
  chart: 'vault',
  version: 'v0.1.2',
  fetchOpts: {
    repo: '<https://github.com/hashicorp/vault-helm.git>'
  },
  namespace: namespace.metadata.name,
  values: {
    fullnameOverride: 'vault',
    ha: {
      enabled: true,
      config: pulumi.interpolate`
ui = true

listener "tcp" {
  tls_disable = 1
  address = "[::]:8200"
  cluster_address = "[::]:8201"
}

storage "spanner" {
  database = "projects/${config.gcp.require('project')}/instances/${gcp.spannerInstance.name}/databases/${gcp.spannerDatabase.name}"
  ha_enabled  = "true"
}

seal "gcpckms" {
  project = "${config.gcp.get('project')}"
  region = "${config.gcp.get('region')}"
  key_ring = "${gcp.keyRing.name}"
  crypto_key = "${gcp.cryptoKey.name}"
}
`
    },
    ui: {
      enabled: true
    },
    extraEnvironmentVars: {
      GOOGLE_APPLICATION_CREDENTIALS: '/vault/gcp-credentials.json'
    },
    extraVolumes: [
      {
        type: 'secret',
        name: gcpCredentials.metadata.name,
        path: '/vault/gcp-credentials.json'
      }
    ],
    annotations: {
      '<http://ad.datadoghq.com/vault.check_names|ad.datadoghq.com/vault.check_names>': JSON.stringify(['http_check', 'vault']),
      '<http://ad.datadoghq.com/vault.init_configs|ad.datadoghq.com/vault.init_configs>': JSON.stringify([{}, {}]),
      '<http://ad.datadoghq.com/vault.instances|ad.datadoghq.com/vault.instances>': JSON.stringify([
        [
          {
            name: config.project,
            url: `https://${config.appDnsHost}/`,
            // eslint-disable-next-line @typescript-eslint/camelcase
            disable_ssl_validation: false
          }
        ],
        [
          {
            // eslint-disable-next-line @typescript-eslint/camelcase
            api_url: `https://${config.appDnsHost}/v1`
          }
        ]
      ]),
      '<http://ad.datadoghq.com/vault.logs|ad.datadoghq.com/vault.logs>': JSON.stringify([{}])
    }
  }
});