From d174a0c666c62ecc4ee1c3a63c8d2a74de4ce3c7 Mon Sep 17 00:00:00 2001 From: SmokyZone Date: Fri, 18 Sep 2026 20:06:11 +0200 Subject: [PATCH] Fix service name resolution for OpenBao (release name collision) When the ArgoCD release name is 'openbao' (same as the subchart name), Helm's fullname helper collapses '-' to just the release name instead of appending '-openbao'. Our ClusterSecretStore and bootstrap Job hardcoded the '-openbao' form, which pointed at a non-existent Service and made the ClusterSecretStore fail with 'unable to create client' / DNS lookup errors. Add a helper that replicates the subchart's fullname logic. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- templates/_helpers.tpl | 15 +++++++++++++++ templates/bootstrap-job.yaml | 2 +- templates/clustersecretstore.yaml | 2 +- 3 files changed, 17 insertions(+), 2 deletions(-) create mode 100644 templates/_helpers.tpl diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl new file mode 100644 index 0000000..daca6d2 --- /dev/null +++ b/templates/_helpers.tpl @@ -0,0 +1,15 @@ +{{/* +Replicates the openbao-helm subchart's "openbao.fullname" naming logic so our +own templates (ClusterSecretStore, bootstrap Job) can address its Service +without hardcoding "-openbao", which is wrong whenever the release +name already contains "openbao" (Helm's standard fullname collapsing). +*/}} +{{- define "openbao-gitops.openbaoFullname" -}} +{{- if (index .Values "openbao" "fullnameOverride") -}} +{{- index .Values "openbao" "fullnameOverride" | trunc 63 | trimSuffix "-" -}} +{{- else if contains "openbao" .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-openbao" .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} diff --git a/templates/bootstrap-job.yaml b/templates/bootstrap-job.yaml index 89c01a7..887edc0 100644 --- a/templates/bootstrap-job.yaml +++ b/templates/bootstrap-job.yaml @@ -29,7 +29,7 @@ spec: image: {{ .Values.bootstrap.image }} env: - name: BAO_ADDR - value: "http://{{ .Release.Name }}-openbao:8200" + value: "http://{{ include "openbao-gitops.openbaoFullname" . }}:8200" - name: BAO_TOKEN valueFrom: secretKeyRef: diff --git a/templates/clustersecretstore.yaml b/templates/clustersecretstore.yaml index 14e6290..46d685d 100644 --- a/templates/clustersecretstore.yaml +++ b/templates/clustersecretstore.yaml @@ -8,7 +8,7 @@ metadata: spec: provider: vault: - server: "http://{{ .Release.Name }}-openbao.{{ .Release.Namespace }}.svc:8200" + server: "http://{{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc:8200" path: {{ .Values.eso.kvMountPath }} version: v2 auth: