<p>I deployed hashicorp vault with 3 replicas. Pod vault-0 is running but the other two pods are in pending status.
<a href="https://i.stack.imgur.com/Lqeay.png" rel="nofollow noreferrer">enter image description here</a></p>
<p>This is my override yaml,</p>
<pre><code># Vault Helm Chart Value Overrides
global:
  enabled: true
  tlsDisable: true

injector:
  enabled: true
  # Use the Vault K8s Image https://github.com/hashicorp/vault-k8s/
  image:
    repository: &quot;hashicorp/vault-k8s&quot;
    tag: &quot;0.9.0&quot;

  resources:
    requests:
      memory: 256Mi
      cpu: 250m
    limits:
      memory: 256Mi
      cpu: 250m
  affinity: &quot;&quot;
server:
  auditStorage:
    enabled: true
  standalone:
    enabled: false
  image:
    repository: &quot;hashicorp/vault&quot;
    tag: &quot;1.6.3&quot;
  resources:
    requests:
      memory: 4Gi
      cpu: 1000m
    limits:
      memory: 8Gi
      cpu: 1000m 
  ha:
    enabled: true
    replicas: 3    
    raft:
      enabled: true
      setNodeId: true
      config: |
        ui = true

        listener &quot;tcp&quot; {
          tls_disable = true
          address = &quot;[::]:8200&quot;
          cluster_address = &quot;[::]:8201&quot;
        }

        storage &quot;raft&quot; {
          path = &quot;/vault/data&quot;
        }

        service_registration &quot;kubernetes&quot; {}
    config: |
      ui = true

      listener &quot;tcp&quot; {
        tls_disable = true
        address = &quot;[::]:8200&quot;
        cluster_address = &quot;[::]:8201&quot;
      }

      service_registration &quot;kubernetes&quot; {}


# Vault UI
ui:
  enabled: true
  serviceType: &quot;ClusterIP&quot;
  externalPort: 8200
</code></pre>
<p>Did a kubectl describe into the pending pods and can see the following status message. I am not sure I am adding the correct affinity settings in the override file. Not sure what I am doing wrong. I am using vault helm charts to deploy to a docker desktop local cluster. Appreciate any help.</p>
<p><a href="https://i.stack.imgur.com/YSo55.png" rel="nofollow noreferrer">enter image description here</a></p>

Joshua
<p>There are a few problems in your values.yaml file.</p>
<p>1.You set</p>
<pre><code>server:
  auditStorage:
    enabled: true
</code></pre>
<p>but you didn't specify how the PVC would be created and what the Storage class is. The chart expects you to do that if you enable the storage. Look at: <a href="https://github.com/hashicorp/vault-helm/blob/v0.9.0/values.yaml#L443" rel="nofollow noreferrer">https://github.com/hashicorp/vault-helm/blob/v0.9.0/values.yaml#L443</a>
Turn it false if you just testing on your local machine or specify storage config.</p>
<p>2.You set empty affinity variable for the injector but not for the server. Set</p>
<pre><code>affinity: &quot;&quot;
</code></pre>
<p>for the server too. Look at: <a href="https://github.com/hashicorp/vault-helm/blob/v0.9.0/values.yaml#L338" rel="nofollow noreferrer">https://github.com/hashicorp/vault-helm/blob/v0.9.0/values.yaml#L338</a></p>
<p>3.An uninitialised and sealed Vault cluster is not really usable. You need to initialize and unseal Vault before it becomes ready. That means setting up a <code>readinessProbe</code>. Something like this:</p>
<pre><code>server:
  readinessProbe:
    path: &quot;/v1/sys/health?standbyok=true&amp;sealedcode=204&amp;uninitcode=204&quot;
</code></pre>
<p>4.Last one but this is kinda optional. Those memory requests:</p>
<pre><code>resources:
  requests:
    memory: 4Gi
    cpu: 1000m
  limits:
    memory: 8Gi
    cpu: 1000m 
</code></pre>
<p>are a bit on the higher side. Setting up an HA cluster of 3 replicas with each requesting 4Gi of memory might result in <code>Insufficient memory</code> errors - most likely to happen when deploying on a local cluster.</p>
<p>But then again, you local machine might have 32 gigs of memory - I wouldn't know ;) If it doesn't, trim down those to fit on your machine.</p>
<p>So the following values works for me:</p>
<pre><code># Vault Helm Chart Value Overrides
global:
  enabled: true
  tlsDisable: true

injector:
  enabled: true
  # Use the Vault K8s Image https://github.com/hashicorp/vault-k8s/
  image:
    repository: &quot;hashicorp/vault-k8s&quot;
    tag: &quot;0.9.0&quot;

  resources:
    requests:
      memory: 256Mi
      cpu: 250m
    limits:
      memory: 256Mi
      cpu: 250m
  affinity: &quot;&quot;
server:
  auditStorage:
    enabled: false
  standalone:
    enabled: false
  image:
    repository: &quot;hashicorp/vault&quot;
    tag: &quot;1.6.3&quot;
  resources:
    requests:
      memory: 256Mi
      cpu: 200m
    limits:
      memory: 512Mi
      cpu: 400m
  affinity: &quot;&quot;
  readinessProbe:
    enabled: true
    path: &quot;/v1/sys/health?standbyok=true&amp;sealedcode=204&amp;uninitcode=204&quot;
  ha:
    enabled: true
    replicas: 3
    raft:
      enabled: true
      setNodeId: true
      config: |
        ui = true

        listener &quot;tcp&quot; {
          tls_disable = true
          address = &quot;[::]:8200&quot;
          cluster_address = &quot;[::]:8201&quot;
        }

        storage &quot;raft&quot; {
          path = &quot;/vault/data&quot;
        }

        service_registration &quot;kubernetes&quot; {}
    config: |
      ui = true

      listener &quot;tcp&quot; {
        tls_disable = true
        address = &quot;[::]:8200&quot;
        cluster_address = &quot;[::]:8201&quot;
      }

      service_registration &quot;kubernetes&quot; {}


# Vault UI
ui:
  enabled: true
  serviceType: &quot;ClusterIP&quot;
  externalPort: 8200
</code></pre>
<p><a href="https://i.stack.imgur.com/dmHVY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/dmHVY.png" alt="all pods healhty" /></a></p>
