Fresh install, unlike the homelab's adoption of a running Vault, so there is no live state to diff against. nameOverride pins the release to "vault" in namespace "vault" because Terraform's Workload Identity binding names that exact pair; a different release name renames the service account and leaves Vault sealed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N