Deploy service-vault as its own HelmRelease with kubevault bundled

[ArnobKumarSaha]

Ships a relay-enabled VaultServer and installs it as a first-class platform release: ace-installer creates the service-vault HelmRelease itself and the ace release depends on it, rather than carrying service-vault as an ace subchart. The chart bundles the KubeVault operator as a subchart, the same relationship service-gateway has with voyager-gateway.

Install wiring

• charts/ace-installer/values.yaml — new helm.releases.service-vault entry (enabled: false, v2026.9.11). That flag is the only switch; there is no separate secretManagement block.
• charts/ace-installer/templates/featuresets/opscenter-secret-management/service-vault.yaml (new) — HelmRelease into the ace namespace, labelled part-of: opscenter-secret-management, dependsOn opscenter-features / cert-manager / gateway-api. It injects global.registryFQDN, global.imagePullSecrets, clusterMetadata.name: ace, and infra.host / infra.hostType read off helm.releases.ace.values.global.platform (only when a host is set, so the chart default is not blanked). Same defaults-then-mergeOverwrite shape as the sibling feature templates.
• resourcetemplates/helmreleases/ace/ace.yaml — the ace release gains a dependsOn: service-vault entry when the release is enabled.
• charts/service-vault/Chart.yaml — depends on kubevault v2026.8.7 from oci://ghcr.io/appscode-charts; new Chart.lock, and charts/service-vault/charts is gitignored like the other umbrella charts.
• charts/service-vault/values.yaml — adds a global block (license, licenseSecretName, registry, registryFQDN, imagePullSecrets, distro) that the kubevault subchart inherits.
• templates/_helpers.tpl — distro.openshift / operator.ubi now read .Values.global.distro with a .Values.distro fallback, copied from charts/service-gateway/templates/_helpers.tpl. Helm helper names are chart-tree-global, so without this the parent definitions shadowed kubevault's and its tests/test-connection.yaml failed with nil pointer evaluating interface {}.openshift. New service-vault.clusterName / gatewayHost / pkiDomain helpers replace the inline printf in gw.yaml and issuer.yaml.

VaultServer

• values.yaml — vaultServer grows from {name} into a full spec: version, replicas, isolateTenants, serviceType, terminationPolicy, persistence, unsealer, tls.caSecretName, relay.{clusterSet,namespace,bootstrapTokenTTL}.
• apis/installer/v1alpha1/service_vault_types.go — ServiceVaultSpec.VaultServer changes from LocalObjectReference to a new VaultServerSpec; adds ClusterMetadata and Global.
• templates/vault/ca-issuer.yaml (new) — namespaced cert-manager Issuer {{ service-vault.fullname }}-ca-issuer for the VaultServer's serving TLS. Uses ca.secretName when vaultServer.tls.caSecretName is set, otherwise selfSigned: {}. Named distinctly from the existing vault-issuer ClusterIssuer, which serves the opposite flow (cert-manager issuing certs from Vault's PKI).
• templates/vault/vault-server.yaml — rewritten around the new values. serviceTemplates is emitted only when serviceType is not ClusterIP, so the Gateway/HTTPRoute exposure in gw.yaml stays the default. The monitor block is preserved.
• hack/scripts/import-crds.sh — bumps KUBEVAULT_APIMACHINERY_TAG from v0.23.0 to v0.25.0. v0.23.0 had no isolateTenants, relayPlacementRef, or relayTemplate on VaultServer, so structural-schema pruning would have dropped all three at the API server; all four fields the templates emit are present under v1alpha2 in the re-imported CRD. Gateway API and caprovider CRDs are no longer vendored into this chart — their own releases install them first.

Removed from the ace chart

charts/ace/Chart.yaml (dependency + Chart.lock), charts/ace/values.yaml, and AceSpec.ServiceVault in apis/installer/v1alpha1/ace_ace_types.go.

Verification

• make refresh run; deepcopy, values schemas, chart docs, certified charts, and catalog/imagelist.yaml are current
• go build ./... clean
• helm template checked for charts/ace, charts/ace-installer (with helm.releases.service-vault.enabled=true, confirming the new release and the ace dependsOn entry), and charts/service-vault (rendering the chart plus kubevault, kubevault-catalog, kubevault-operator, kubevault-webhook-server, ace-user-roles)
• sigilr-2.6.1.1, the default vaultServer.version, is present in the bundled kubevault-catalog