Setting a second BAO_ADDR via extraEnvironmentVars produced two entries
with the same name in the container env list. kubectl itself warns
this 'may be dropped when using apply', and in practice the live
StatefulSet kept only the first (http) value, leaving the pod stuck
NotReady. The chart already exposes global.tlsDisable specifically to
drive BAO_ADDR/health-check scheme - use that instead.
Co-authored-by: Copilot <[email protected]>
The chart hardcodes BAO_ADDR=http://127.0.0.1:8200 for its own
readiness/liveness probe CLI calls. With TLS enabled this made the pod
permanently NotReady ('Client sent an HTTP request to an HTTPS server').
Override via server.extraEnvironmentVars (Kubernetes uses last-wins for
duplicate env var names).
Co-authored-by: Copilot <[email protected]>
Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting
secret into the OpenBao pod, and switches the listener config from
tls_disable=1 to a TLS-enabled listener. UI/API is now served over
https://<node-ip>:30200 instead of plain HTTP.
Also updates ClusterSecretStore/bootstrap Job to use https + trust the
self-signed cert via caProvider/BAO_SKIP_VERIFY.
Co-authored-by: Copilot <[email protected]>
When the ArgoCD release name is 'openbao' (same as the subchart name),
Helm's fullname helper collapses '<release>-<chart>' to just the release
name instead of appending '-openbao'. Our ClusterSecretStore and
bootstrap Job hardcoded the '<release>-openbao' form, which pointed at a
non-existent Service and made the ClusterSecretStore fail with
'unable to create client' / DNS lookup errors. Add a helper that
replicates the subchart's fullname logic.
Co-authored-by: Copilot <[email protected]>
SmokyZoneandCopilot