From e27524177cd692a06a711cce718b07585ebc5867 Mon Sep 17 00:00:00 2001 From: SmokyZone Date: Fri, 18 Sep 2026 20:33:12 +0200 Subject: [PATCH] Use global.tlsDisable=false instead of duplicating BAO_ADDR Setting a second BAO_ADDR via extraEnvironmentVars produced two entries with the same name in the container env list. kubectl itself warns this 'may be dropped when using apply', and in practice the live StatefulSet kept only the first (http) value, leaving the pod stuck NotReady. The chart already exposes global.tlsDisable specifically to drive BAO_ADDR/health-check scheme - use that instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- values.yaml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/values.yaml b/values.yaml index 280c7cc..41bcd5a 100644 --- a/values.yaml +++ b/values.yaml @@ -6,6 +6,11 @@ ## here - see `helm show values openbao/openbao` for the full list. openbao: + # Tells the chart's own helpers (BAO_ADDR, health-check scheme, etc.) that + # the server listener speaks TLS - avoids duplicate/conflicting env vars. + global: + tlsDisable: false + server: # Standalone mode: single replica, file storage backend, PVC-backed. standalone: @@ -56,13 +61,6 @@ openbao: cpu: 500m memory: 512Mi - # The chart hardcodes BAO_ADDR=http://127.0.0.1:8200 for internal CLI - # calls (readiness/liveness probes, etc.). Override it now that the - # listener speaks TLS, otherwise the pod never becomes Ready. - extraEnvironmentVars: - BAO_ADDR: https://127.0.0.1:8200 - BAO_SKIP_VERIFY: "true" - ui: enabled: true # NodePort, same pattern as ArgoCD (30080/30443) and Gitea (30300):