Having trouble deploying Hashicorp Vault on kubernetes/helm. Can't get vault to work at all. I've really tried changing almost all the parameters I could and still can't get it to work and I don't know where the issue lies exactly.

The error I get is mainly based on Error Checking Seal status/Client sent an HTTP request to an HTTPS server.

If I set tls_disable=true inside the .Values.ha.config then I get an error that vault is sealed but I still can't view the UI... I feel like deploying vault has been bipolar and it sometimes works and sometimes doesn't. Then I can't replicate where the bug lied either. This has been a headache.

Here is my values.yaml file:

server:
  enabled: true
  ingress:
    enabled: true
    annotations:
      cert.<issuer>.cloud/issuer: <intermediate-hostname>
      cert.<issuer>.cloud/secretname: vault-server-tls
      cert.<issuer>.cloud/purpose: managed
      dns.<issuer>.cloud/class: <class>
      dns.<issuer>.cloud/dnsnames: "<hostname>"
      dns.<issuer>.cloud/ttl: "600"
    hosts:
      - host: "vault.<hostname>"
        paths: []
    tls:
      - secretName: vault-server-tls
        hosts:
          - vault.<hostname>
  extraVolumes:
    - type: secret
      name: vault-server-tls
  service:
    enabled: true
    port: 8200
    targetPort: 443
  ha:
    enabled: true
    replicas: 3
    raft:
      enabled: true
      config: |
        ui = true
        listener "tcp" {
          tls_disable = false
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_cert_file = "/vault/userconfig/vault-server-tls/tls.crt"
          tls_key_file = "/vault/userconfig/vault-server-tls/tls.key"
          tls_client_ca_file = "/vault/userconfig/vault-server-tls/vault.ca"
        }
        storage "raft" {
          path = "/vault/data"
        }
    config: |
      ui = true
      listener "tcp" {
        tls_disable = false
        address = "[::]:443"
        cluster_address = "[::]:8201"
        tls_cert_file = "/vault/userconfig/vault-server-tls/tls.crt"
        tls_key_file = "/vault/userconfig/vault-server-tls/tls.key"
        tls_client_ca_file = "/vault/userconfig/vault-server-tls/vault.ca"
        tls_require_and_verify_client_cert = false
      }
      storage "consul" {
        path = "vault"
        address = "HOST_IP:8500"
      }
      disable_mlock = true

ui:
  enabled: true
  serviceType: LoadBalancer
  externalPort: 443
  targetPort: 8200

EDIT: I'm now able to view the UI from the LoadBalancer but not from the hostname set in dns.<issuer>.cloud/dnsnames: "<hostname>" under the ingress.annotations

Still get the error but can view the UI via the LoadBalancer: Readiness probe failed. Error unsealing: Error making API request. URL: PUT http://127.0.0.1:8200/v1/sys/unsealCode: 400. Raw Message: Client sent an HTTP request to an HTTPS server.