The chart hardcodes BAO_ADDR=http://127.0.0.1:8200 for its own
readiness/liveness probe CLI calls. With TLS enabled this made the pod
permanently NotReady ('Client sent an HTTP request to an HTTPS server').
Override via server.extraEnvironmentVars (Kubernetes uses last-wins for
duplicate env var names).
Co-authored-by: Copilot <[email protected]>
Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting
secret into the OpenBao pod, and switches the listener config from
tls_disable=1 to a TLS-enabled listener. UI/API is now served over
https://<node-ip>:30200 instead of plain HTTP.
Also updates ClusterSecretStore/bootstrap Job to use https + trust the
self-signed cert via caProvider/BAO_SKIP_VERIFY.
Co-authored-by: Copilot <[email protected]>
When the ArgoCD release name is 'openbao' (same as the subchart name),
Helm's fullname helper collapses '<release>-<chart>' to just the release
name instead of appending '-openbao'. Our ClusterSecretStore and
bootstrap Job hardcoded the '<release>-openbao' form, which pointed at a
non-existent Service and made the ClusterSecretStore fail with
'unable to create client' / DNS lookup errors. Add a helper that
replicates the subchart's fullname logic.
Co-authored-by: Copilot <[email protected]>
SmokyZoneandCopilot