fix(openbao): make script hook configmaps idempotent

[nvjmcnamee]

TL;DR

Add before-hook-creation to the OpenBao init script hook ConfigMaps so stale hook resources do not cause Helm install/upgrade retries to fail with configmaps "openbao-server-init-script" already exists.

Additional Details

The OpenBao chart creates openbao-server-init-script and openbao-server-utils-script as post-install,post-upgrade hook ConfigMaps.

Previously they only used:

helm.sh/hook-delete-policy: hook-succeeded

That works for the normal success path, but if one of those fixed-name hook ConfigMaps is left behind, a later Helm upgrade attempts to create it again and fails with an AlreadyExists collision.

This keeps the existing hook-succeeded behavior and intentionally does not add hook-failed, preserving the existing retry behavior documented in the chart comments.

For the Reviewer

Please focus on:

• deploy/helm/openbao/helm/templates/hook-post-01-initcluster.yaml

This mirrors the existing idempotent hook cleanup pattern used by other Helm hooks while preserving the OpenBao-specific decision not to delete these script ConfigMaps on hook failure.

For QA

Verified locally:

• helm dependency build deploy/helm/openbao/helm
• helm lint deploy/helm/openbao/helm
• helm template test-openbao deploy/helm/openbao/helm --namespace vault-system --set openbao.migrations.image.registry=example.invalid --set openbao.migrations.image.repository=nvcf-openbao-migrations --set openbao.migrations.image.tag=test

Rendered output confirms both openbao-server-init-script and openbao-server-utils-script now have:

helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

Issues

NO-REF

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• Bug Fixes
  • Improved deployment reliability by allowing initialization resources to be replaced before subsequent setup runs.
  • Successful initialization resources continue to be cleaned up automatically.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b9275044-ff01-41f7-82d6-11835f2fc691

📥 Commits

Reviewing files that changed from the base of the PR and between efc98c7 and 01df207.

📒 Files selected for processing (1)

• deploy/helm/openbao/helm/templates/hook-post-01-initcluster.yaml

---

📝 Walkthrough

Walkthrough

The Helm chart updates the deletion policy for the initialization and utilities ConfigMaps. Both policies now include before-hook-creation and retain hook-succeeded.

Changes

Helm hook policy

Layer / File(s)	Summary
Update ConfigMap hook cleanup policies deploy/helm/openbao/helm/templates/hook-post-01-initcluster.yaml	The initialization and utilities ConfigMaps add before-hook-creation to their existing hook-succeeded deletion policies.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: vrv3814

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits and accurately describes the OpenBao hook ConfigMap idempotency fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jmcnamee/fix/openbao-hook-configmap-cleanup

---

_{Comment @coderabbitai help to get the list of available commands.}