From a3429adf2c91f1377eabaf8dbe585a2fac568c0d Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Sat, 12 Sep 2026 14:42:35 +0530 Subject: [PATCH] GKE: register Vault as an Application Fresh install, unlike the homelab's adoption of a running Vault, so there is no live state to diff against. nameOverride pins the release to "vault" in namespace "vault" because Terraform's Workload Identity binding names that exact pair; a different release name renames the service account and leaves Vault sealed. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N --- .../incubator-infra-gke-toolshed-prd-usc1-values.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/values/incubator-infra-gke-toolshed-prd-usc1-values.yaml b/values/incubator-infra-gke-toolshed-prd-usc1-values.yaml index 0cea55c..4935fe3 100644 --- a/values/incubator-infra-gke-toolshed-prd-usc1-values.yaml +++ b/values/incubator-infra-gke-toolshed-prd-usc1-values.yaml @@ -51,6 +51,17 @@ appSpec: # Contour's HTTPProxy CRD embeds a large schema, same 256KiB # last-applied-configuration problem as cert-manager's. serverSideApply: true + - name: vault + # Fresh install here, unlike the homelab's adoption of a running Vault. + # nameOverride pinned so the release is "vault" in namespace "vault": + # the Workload Identity binding Terraform created names that exact + # namespace/serviceaccount pair, and a different release name renames + # the service account, which leaves Vault unable to reach KMS and + # therefore sealed. + nameOverride: vault + namespace: vault + chartDir: vault + valuesDir: vault - name: cert-manager nameOverride: cert-manager namespace: cert-manager