<p>Having trouble deploying Hashicorp Vault on kubernetes/helm. Can't get vault to work at all. I've really tried changing almost all the parameters I could and still can't get it to work and I don't know where the issue lies exactly.</p>
<p>The error I get is mainly based on <code>Error Checking Seal status/Client sent an HTTP request to an HTTPS server.</code></p>
<p>If I set <code>tls_disable=true</code> inside the .Values.ha.config then I get an error that vault is sealed but I still can't view the UI... I feel like deploying vault has been bipolar and it sometimes works and sometimes doesn't. Then I can't replicate where the bug lied either. This has been a headache.</p>
<p>Here is my values.yaml file:</p>
<pre><code>server:
  enabled: true
  ingress:
    enabled: true
    annotations:
      cert.&lt;issuer&gt;.cloud/issuer: &lt;intermediate-hostname&gt;
      cert.&lt;issuer&gt;.cloud/secretname: vault-server-tls
      cert.&lt;issuer&gt;.cloud/purpose: managed
      dns.&lt;issuer&gt;.cloud/class: &lt;class&gt;
      dns.&lt;issuer&gt;.cloud/dnsnames: &quot;&lt;hostname&gt;&quot;
      dns.&lt;issuer&gt;.cloud/ttl: &quot;600&quot;
    hosts:
      - host: &quot;vault.&lt;hostname&gt;&quot;
        paths: []
    tls:
      - secretName: vault-server-tls
        hosts:
          - vault.&lt;hostname&gt;
  extraVolumes:
    - type: secret
      name: vault-server-tls
  service:
    enabled: true
    port: 8200
    targetPort: 443
  ha:
    enabled: true
    replicas: 3
    raft:
      enabled: true
      config: |
        ui = true
        listener &quot;tcp&quot; {
          tls_disable = false
          address = &quot;[::]:8200&quot;
          cluster_address = &quot;[::]:8201&quot;
          tls_cert_file = &quot;/vault/userconfig/vault-server-tls/tls.crt&quot;
          tls_key_file = &quot;/vault/userconfig/vault-server-tls/tls.key&quot;
          tls_client_ca_file = &quot;/vault/userconfig/vault-server-tls/vault.ca&quot;
        }
        storage &quot;raft&quot; {
          path = &quot;/vault/data&quot;
        }
    config: |
      ui = true
      listener &quot;tcp&quot; {
        tls_disable = false
        address = &quot;[::]:443&quot;
        cluster_address = &quot;[::]:8201&quot;
        tls_cert_file = &quot;/vault/userconfig/vault-server-tls/tls.crt&quot;
        tls_key_file = &quot;/vault/userconfig/vault-server-tls/tls.key&quot;
        tls_client_ca_file = &quot;/vault/userconfig/vault-server-tls/vault.ca&quot;
        tls_require_and_verify_client_cert = false
      }
      storage &quot;consul&quot; {
        path = &quot;vault&quot;
        address = &quot;HOST_IP:8500&quot;
      }
      disable_mlock = true

ui:
  enabled: true
  serviceType: LoadBalancer
  externalPort: 443
  targetPort: 8200
</code></pre>
<p>EDIT: I'm now able to view the UI from the LoadBalancer but not from the hostname set in <code>dns.&lt;issuer&gt;.cloud/dnsnames: &quot;&lt;hostname&gt;&quot;</code> under the ingress.annotations</p>
<p>Still get the error but can view the UI via the LoadBalancer: <code>Readiness probe failed. Error unsealing: Error making API request. URL: PUT http://127.0.0.1:8200/v1/sys/unsealCode: 400. Raw Message: Client sent an HTTP request to an HTTPS server.</code></p>

<p>As you mentioned you faced issued of <code>Error Checking Seal status/Client sent an HTTP request to an HTTPS server &amp; vault is sealed</code></p>
<p>Once you have deployed the vault using the helm chart you have to unseal the vault using the CLI first time and after that UI will be available to use.</p>
<p>Reference document : <a href="https://learn.hashicorp.com/tutorials/vault/kubernetes-raft-deployment-guide?in=vault/kubernetes#initialize-and-unseal-vault" rel="nofollow noreferrer">https://learn.hashicorp.com/tutorials/vault/kubernetes-raft-deployment-guide?in=vault/kubernetes#initialize-and-unseal-vault</a></p>
<p>Get the list of <strong>pods</strong></p>
<pre><code>kubectl get pods --selector='app.kubernetes.io/name=vault' --namespace=' vault'
</code></pre>
<p><strong>Exec</strong> into the pods</p>
<pre><code>kubectl exec --stdin=true --tty=true vault-0 -- vault operator init

kubectl exec --stdin=true --tty=true vault-0 -- vault operator unseal
</code></pre>
<p>once you will unseal the vault your PODs status will get changed to <strong>1/1</strong> in <strong>Ready</strong> instead of <strong>0/1</strong></p>
