Fix service name resolution for OpenBao (release name collision)

When the ArgoCD release name is 'openbao' (same as the subchart name),
Helm's fullname helper collapses '<release>-<chart>' to just the release
name instead of appending '-openbao'. Our ClusterSecretStore and
bootstrap Job hardcoded the '<release>-openbao' form, which pointed at a
non-existent Service and made the ClusterSecretStore fail with
'unable to create client' / DNS lookup errors. Add a helper that
replicates the subchart's fullname logic.

Co-authored-by: Copilot <[email protected]>

templates/_helpers.tpl

@@ -0,0 +1,15 @@
+{{/*
+Replicates the openbao-helm subchart's "openbao.fullname" naming logic so our
+own templates (ClusterSecretStore, bootstrap Job) can address its Service
+without hardcoding "<release>-openbao", which is wrong whenever the release
+name already contains "openbao" (Helm's standard fullname collapsing).
+*/}}
+{{- define "openbao-gitops.openbaoFullname" -}}
+{{- if (index .Values "openbao" "fullnameOverride") -}}
+{{- index .Values "openbao" "fullnameOverride" | trunc 63 | trimSuffix "-" -}}
+{{- else if contains "openbao" .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-openbao" .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}

templates/bootstrap-job.yaml

@@ -29,7 +29,7 @@ spec:
           image: {{ .Values.bootstrap.image }}
           env:
             - name: BAO_ADDR
-              value: "http://{{ .Release.Name }}-openbao:8200"
+              value: "http://{{ include "openbao-gitops.openbaoFullname" . }}:8200"
             - name: BAO_TOKEN
               valueFrom:
                 secretKeyRef:

templates/clustersecretstore.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   provider:
     vault:
-      server: "http://{{ .Release.Name }}-openbao.{{ .Release.Namespace }}.svc:8200"
+      server: "http://{{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc:8200"
       path: {{ .Values.eso.kvMountPath }}
       version: v2
       auth: