Terminate TLS on OpenBao with a cert-manager self-signed certificate

Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting
secret into the OpenBao pod, and switches the listener config from
tls_disable=1 to a TLS-enabled listener. UI/API is now served over
https://<node-ip>:30200 instead of plain HTTP.

Also updates ClusterSecretStore/bootstrap Job to use https + trust the
self-signed cert via caProvider/BAO_SKIP_VERIFY.

Co-authored-by: Copilot <[email protected]>

templates/bootstrap-job.yaml

@@ -29,7 +29,11 @@ spec:
           image: {{ .Values.bootstrap.image }}
           env:
             - name: BAO_ADDR
-              value: "http://{{ include "openbao-gitops.openbaoFullname" . }}:8200"
+              value: "{{ if .Values.tls.enabled }}https{{ else }}http{{ end }}://{{ include "openbao-gitops.openbaoFullname" . }}:8200"
+            {{- if .Values.tls.enabled }}
+            - name: BAO_SKIP_VERIFY
+              value: "true"
+            {{- end }}
             - name: BAO_TOKEN
               valueFrom:
                 secretKeyRef:

templates/clustersecretstore.yaml

@@ -8,9 +8,16 @@ metadata:
 spec:
   provider:
     vault:
-      server: "http://{{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc:8200"
+      server: "{{ if .Values.tls.enabled }}https{{ else }}http{{ end }}://{{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc:8200"
       path: {{ .Values.eso.kvMountPath }}
       version: v2
+      {{- if .Values.tls.enabled }}
+      caProvider:
+        type: Secret
+        name: {{ .Values.tls.secretName }}
+        namespace: {{ .Release.Namespace }}
+        key: tls.crt
+      {{- end }}
       auth:
         kubernetes:
           mountPath: kubernetes

templates/tls.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.tls.enabled }}
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: openbao-selfsigned
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ .Values.tls.secretName }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  secretName: {{ .Values.tls.secretName }}
+  duration: {{ .Values.tls.duration }}
+  renewBefore: {{ .Values.tls.renewBefore }}
+  issuerRef:
+    name: openbao-selfsigned
+    kind: ClusterIssuer
+  dnsNames:
+    - {{ include "openbao-gitops.openbaoFullname" . }}
+    - {{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}
+    - {{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc
+    - {{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
+    - localhost
+    {{- range .Values.tls.dnsNames }}
+    - {{ . }}
+    {{- end }}
+  ipAddresses:
+    - "127.0.0.1"
+    {{- range .Values.tls.ipAddresses }}
+    - {{ . | quote }}
+    {{- end }}
+{{- end }}