diff --git a/platform/staging/app-template.yaml b/platform/staging/app-template.yaml
new file mode 100644
index 0000000..7e7f8a4
--- /dev/null
+++ b/platform/staging/app-template.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: app-template
+  namespace: flux-system
+spec:
+  type: oci
+  url: oci://docker.io/khuedoan
diff --git a/platform/staging/vault.yaml b/platform/staging/vault.yaml
index 7b139f1..f17715e 100644
--- a/platform/staging/vault.yaml
+++ b/platform/staging/vault.yaml
@@ -47,3 +47,143 @@ spec:
   values:
     env:
       VAULT_ADDR: http://vault-cluster.vault.svc.cluster.local:8200
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: flux-system
+spec:
+  interval: 30m
+  releaseName: vault
+  targetNamespace: vault
+  install:
+    createNamespace: true
+  chart:
+    spec:
+      chart: app-template
+      version: 4.6.0
+      sourceRef:
+        kind: HelmRepository
+        name: app-template
+  values:
+    persistence:
+      data:
+        accessMode: ReadWriteOnce
+        size: 2Gi
+    rawResources:
+      cluster:
+        apiVersion: vault.banzaicloud.com/v1alpha1
+        kind: Vault
+        spec:
+          spec:
+            config:
+              listener:
+                tcp:
+                  address: 0.0.0.0:8200
+                  tls_disable: true
+              storage:
+                file:
+                  path: /vault/data
+              ui: true
+            externalConfig:
+              auth:
+              - roles:
+                - bound_service_account_names:
+                  - '*'
+                  bound_service_account_namespaces:
+                  - '*'
+                  name: default
+                  policies:
+                  - allow_secrets
+                  ttl: 1h
+                type: kubernetes
+              policies:
+              - name: allow_secrets
+                rules: |
+                  # TODO optimize this
+                  path "secret/*" {
+                    capabilities = ["create", "read", "update", "delete", "list"]
+                  }
+              secrets:
+              - options:
+                  version: 2
+                path: secret
+                type: kv
+            image: docker.io/hashicorp/vault:1.20.2
+            ingress:
+              annotations:
+                cert-manager.io/cluster-issuer: letsencrypt-prod
+              spec:
+                ingressClassName: nginx
+                rules:
+                - host: vault.cloudlab.khuedoan.com
+                  http:
+                    paths:
+                    - backend:
+                        service:
+                          name: vault-cluster
+                          port:
+                            number: 8200
+                      path: /
+                      pathType: Prefix
+                tls:
+                - hosts:
+                  - vault.cloudlab.khuedoan.com
+                  secretName: vault-tls-certificate
+            serviceAccount: vault
+            size: 1
+            unsealConfig:
+              kubernetes:
+                secretNamespace: '{{ .Release.Namespace }}'
+            volumeMounts:
+            - mountPath: /vault/data
+              name: vault-data
+            volumes:
+            - name: vault-data
+              persistentVolumeClaim:
+                claimName: vault-data
+    rbac:
+      bindings:
+        cluster:
+          forceRename: vault
+          roleRef:
+            apiGroup: rbac.authorization.k8s.io
+            kind: ClusterRole
+            name: system:auth-delegator
+          subjects:
+          - kind: ServiceAccount
+            name: vault
+            namespace: '{{ .Release.Namespace }}'
+          type: ClusterRoleBinding
+        namespace:
+          forceRename: vault
+          roleRef:
+            apiGroup: rbac.authorization.k8s.io
+            kind: Role
+            name: vault
+          subjects:
+          - kind: ServiceAccount
+            name: vault
+            namespace: '{{ .Release.Namespace }}'
+          type: RoleBinding
+      roles:
+        vault:
+          rules:
+          - apiGroups:
+            - ""
+            resources:
+            - secrets
+            verbs:
+            - '*'
+          - apiGroups:
+            - ""
+            resources:
+            - pods
+            verbs:
+            - get
+            - update
+            - patch
+          type: Role
+    serviceAccount:
+      vault: {}