From 9581f1bb3efe71bae0be6b146b472f72441d5fc5 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sun, 15 Mar 2026 10:58:26 +0100
Subject: [PATCH] Change tls vault

---
 vault/configure-oidc.yaml | 12 +-----------
 vault/overrides.yaml      | 26 ++++----------------------
 2 files changed, 5 insertions(+), 33 deletions(-)

diff --git a/vault/configure-oidc.yaml b/vault/configure-oidc.yaml
index d8345e9..fc6233c 100644
--- a/vault/configure-oidc.yaml
+++ b/vault/configure-oidc.yaml
@@ -36,9 +36,7 @@ spec:
           image: hashicorp/vault:1.15
           env:
             - name: VAULT_ADDR
-              value: "https://vault-active.vault.svc:8200"
-            - name: VAULT_CACERT
-              value: "/vault-tls/vault.ca"
+              value: "http://vault-active.vault.svc:8200"
             - name: VAULT_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -49,10 +47,6 @@ spec:
                 secretKeyRef:
                   name: vault-oidc-config
                   key: client_secret
-          volumeMounts:
-            - name: vault-tls
-              mountPath: /vault-tls
-              readOnly: true
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -68,8 +62,4 @@ spec:
                 user_claim="preferred_username" \
                 groups_claim="groups" \
                 policies="default"
-      volumes:
-        - name: vault-tls
-          secret:
-            secretName: vault-ha-tls
       restartPolicy: OnFailure
diff --git a/vault/overrides.yaml b/vault/overrides.yaml
index 2f20dc8..1836e2c 100644
--- a/vault/overrides.yaml
+++ b/vault/overrides.yaml
@@ -1,24 +1,11 @@
 global:
    enabled: true
-   tlsDisable: false
+   tlsDisable: true
 injector:
    enabled: true
 server:
    dataStorage:
       storageClass: longhorn
-   extraEnvironmentVars:
-      VAULT_CACERT: /vault/userconfig/vault-ha-tls/vault.ca
-      VAULT_TLSCERT: /vault/userconfig/vault-ha-tls/vault.crt
-      VAULT_TLSKEY: /vault/userconfig/vault-ha-tls/vault.key
-   volumes:
-      - name: userconfig-vault-ha-tls
-        secret:
-         defaultMode: 420
-         secretName: vault-ha-tls
-   volumeMounts:
-      - mountPath: /vault/userconfig/vault-ha-tls
-        name: userconfig-vault-ha-tls
-        readOnly: true
    standalone:
       enabled: false
    affinity: ""
@@ -32,12 +19,9 @@ server:
             cluster_name = "vault-integrated-storage"
             ui = true
             listener "tcp" {
-               tls_disable = 0
+               tls_disable = 1
                address = "[::]:8200"
                cluster_address = "[::]:8201"
-               tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"
-               tls_key_file  = "/vault/userconfig/vault-ha-tls/vault.key"
-               tls_client_ca_file = "/vault/userconfig/vault-ha-tls/vault.ca"
             }
             storage "raft" {
                path = "/vault/data"
@@ -48,12 +32,10 @@ server:
       enabled: true
       annotations:
         cert-manager.io/cluster-issuer: prod-cluster-issuer
-        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-        nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
       ingressClassName: nginx
       tls:
-          - secretName:  letsencrypt-prod
+          - secretName: letsencrypt-prod
             hosts:
               - vault.hensen.io
-      hosts: 
+      hosts:
         - host: "vault.hensen.io"