Terminate TLS on OpenBao with a cert-manager self-signed certificate

Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting
secret into the OpenBao pod, and switches the listener config from
tls_disable=1 to a TLS-enabled listener. UI/API is now served over
https://<node-ip>:30200 instead of plain HTTP.

Also updates ClusterSecretStore/bootstrap Job to use https + trust the
self-signed cert via caProvider/BAO_SKIP_VERIFY.

Co-authored-by: Copilot <[email protected]>

README.md

@@ -8,16 +8,37 @@ via Vault's Kubernetes auth method.
 This chart wraps the official [`openbao-helm`](https://github.com/openbao/openbao-helm)
 chart as a dependency and adds:
 
+- A self-signed TLS certificate (via cert-manager) that OpenBao terminates
+  itself, so both the UI and API are served over HTTPS
 - A `ClusterSecretStore` (ESO CRD) pointing at the OpenBao service
 - A one-time bootstrap `Job` (disabled by default) that enables the
   Kubernetes auth method, a read-only policy, and a role bound to ESO's
   ServiceAccount
 
+## TLS
+
+OpenBao terminates HTTPS itself using a certificate issued by a dedicated
+`ClusterIssuer/openbao-selfsigned` (cert-manager, `selfSigned` type - no
+external CA involved). The UI/API is reachable at
+`https://<node-ip>:30200` (NodePort, same pattern as ArgoCD).
+
+Because the certificate is self-signed, browsers will show a trust warning
+- this is expected. `ExternalSecret`/`ClusterSecretStore` traffic from ESO
+trusts it automatically via `caProvider` (pointing at the same
+`openbao-tls` Secret cert-manager creates), so no manual CA import is
+needed for that path.
+
+If you add/replace a node, or want a different reachable hostname, add it to
+`tls.ipAddresses` / `tls.dnsNames` in `values.yaml` and cert-manager will
+reissue the certificate automatically.
+
 ## Prerequisites
 
 - ESO must already be installed in the cluster (deployed separately via the
   `apps-in-apps` repo) with a ServiceAccount named `eso.serviceAccountName`
   (default: `external-secrets`) in `eso.namespace` (default: `external-secrets`).
+- cert-manager must already be installed (used for the self-signed TLS cert,
+  see below).
 
 ## Deployment & manual init/unseal