my related question: why isn’t the service with the straight forward name – “vault” – that the agent use by default scoped to vault-active: "true"?
As the helm chart configures things by default the vault service sometimes stops working if any of the pods from the statefulset restart and are sealed.