Comment 1 for bug 1988448

We get to this state by
1) deploying cdk 1.25/beta with vault. Relating vault as both the certificate manager and for managing the vault-kv store
2) once vault settles, we unseal it following the steps in the charm documentation
3) run the action "reissue certificates" from vault - https://charmhub.io/vault/actions?channel=1.7/stable#reissue-certificates

Once vault has been unsealed and certificates are re-issued, sometimes k8s cp will reach this state, I would guess it happens about 30% of the time based on our small sample size