Terminate TLS on OpenBao with a cert-manager self-signed certificate

Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting
secret into the OpenBao pod, and switches the listener config from
tls_disable=1 to a TLS-enabled listener. UI/API is now served over
https://<node-ip>:30200 instead of plain HTTP.

Also updates ClusterSecretStore/bootstrap Job to use https + trust the
self-signed cert via caProvider/BAO_SKIP_VERIFY.

Co-authored-by: Copilot <[email protected]>

values.yaml

@@ -10,6 +10,24 @@ openbao:
     # Standalone mode: single replica, file storage backend, PVC-backed.
     standalone:
       enabled: true
+      # TLS terminated directly by OpenBao itself, using the cert-manager
+      # issued self-signed certificate mounted below (see templates/tls.yaml
+      # and the `tls:` section further down). "-tls-skip-verify" is already
+      # baked into the chart's readiness/liveness probes, so this doesn't
+      # need any extra values there.
+      config: |
+        ui = true
+
+        listener "tcp" {
+          tls_disable = 0
+          address = "[::]:8200"
+          cluster_address = "[::]:8201"
+          tls_cert_file = "/openbao/userconfig/openbao-tls/tls.crt"
+          tls_key_file  = "/openbao/userconfig/openbao-tls/tls.key"
+        }
+        storage "file" {
+          path = "/openbao/data"
+        }
 
     dataStorage:
       enabled: true
@@ -24,6 +42,12 @@ openbao:
       authDelegator:
         enabled: true
 
+    # Mounts the cert-manager issued TLS secret at
+    # /openbao/userconfig/openbao-tls/{tls.crt,tls.key,ca.crt}.
+    extraVolumes:
+      - type: secret
+        name: openbao-tls
+
     resources:
       requests:
         cpu: 250m
@@ -35,7 +59,7 @@ openbao:
   ui:
     enabled: true
     # NodePort, same pattern as ArgoCD (30080/30443) and Gitea (30300):
-    # reachable at http://<node-ip>:30200 without needing an Ingress.
+    # reachable at https://<node-ip>:30200 without needing an Ingress.
     serviceType: NodePort
     serviceNodePort: 30200
 
@@ -43,6 +67,21 @@ openbao:
     # Sidecar-injector webhook is not needed for ESO integration.
     enabled: false
 
+# --- TLS (self-signed via cert-manager) -------------------------------------
+
+tls:
+  enabled: true
+  secretName: openbao-tls
+  # cert-manager Certificate validity/renewal.
+  duration: 2160h # 90d
+  renewBefore: 360h # 15d
+  # Extra SANs beyond the in-cluster service names (which are always
+  # included). Add your node IP(s)/hostname(s) here so browsers hitting the
+  # NodePort get a matching cert.
+  ipAddresses:
+    - 192.168.2.218
+  dnsNames: []
+
 # --- ESO <-> OpenBao binding -------------------------------------------------
 
 eso: