diff --git a/pkg/daemon/ceph/osd/kms/envs_test.go b/pkg/daemon/ceph/osd/kms/envs_test.go
index 2db0d0c14..0a6693b2a 100644
--- a/pkg/daemon/ceph/osd/kms/envs_test.go
+++ b/pkg/daemon/ceph/osd/kms/envs_test.go
@@ -18,7 +18,6 @@ package kms
 
 import (
 	"os"
-	"reflect"
 	"testing"
 
 	cephv1 "github.com/rook/rook/pkg/apis/ceph.rook.io/v1"
@@ -27,83 +26,23 @@ import (
 )
 
 func TestVaultTLSEnvVarFromSecret(t *testing.T) {
-	type args struct {
-		kmsConfig map[string]string
-	}
-	tests := []struct {
-		name string
-		args args
-		want []v1.EnvVar
-	}{
-		{"no tls", args{kmsConfig: map[string]string{"foo": "bar"}}, []v1.EnvVar{}},
-		{"ca cert tls", args{kmsConfig: map[string]string{"foo": "bar", "VAULT_CACERT": "vault-ca-cert-secret"}}, []v1.EnvVar{{Name: "VAULT_CACERT", Value: "/etc/vault/vault.ca"}}},
-		{"ca cert tls and client ca/key", args{kmsConfig: map[string]string{
-			"foo":               "bar",
-			"VAULT_CACERT":      "vault-ca-cert-secret",
-			"VAULT_CLIENT_CERT": "vault-client-cert-secret",
-			"VAULT_CLIENT_KEY":  "vault-key-cert-secret",
-		}},
-			[]v1.EnvVar{
-				{Name: "VAULT_CACERT", Value: "/etc/vault/vault.ca"},
-				{Name: "VAULT_CLIENT_CERT", Value: "/etc/vault/vault.crt"},
-				{Name: "VAULT_CLIENT_KEY", Value: "/etc/vault/vault.key"},
-			}},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := vaultTLSEnvVarFromSecret(tt.args.kmsConfig); !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("vaultTLSEnvVarFromSecret() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
+	// No TLS
+	spec := cephv1.ClusterSpec{Security: cephv1.SecuritySpec{KeyManagementService: cephv1.KeyManagementServiceSpec{TokenSecretName: "vault-token", ConnectionDetails: map[string]string{"KMS_PROVIDER": "vault", "VAULT_ADDR": "http://1.1.1.1:8200"}}}}
+	envVars := VaultConfigToEnvVar(spec)
+	assert.Equal(t, 3, len(envVars))
+	assert.Contains(t, envVars, v1.EnvVar{Name: "KMS_PROVIDER", Value: "vault"})
+	assert.Contains(t, envVars, v1.EnvVar{Name: "VAULT_ADDR", Value: "http://1.1.1.1:8200"})
+	assert.Contains(t, envVars, v1.EnvVar{Name: "VAULT_TOKEN", ValueFrom: &v1.EnvVarSource{SecretKeyRef: &v1.SecretKeySelector{LocalObjectReference: v1.LocalObjectReference{Name: "vault-token"}, Key: "token"}}})
+
+	// TLS
+	spec = cephv1.ClusterSpec{Security: cephv1.SecuritySpec{KeyManagementService: cephv1.KeyManagementServiceSpec{TokenSecretName: "vault-token", ConnectionDetails: map[string]string{"KMS_PROVIDER": "vault", "VAULT_ADDR": "http://1.1.1.1:8200", "VAULT_CACERT": "vault-ca-cert-secret"}}}}
+	envVars = VaultConfigToEnvVar(spec)
+	assert.Equal(t, 4, len(envVars))
+	assert.Contains(t, envVars, v1.EnvVar{Name: "KMS_PROVIDER", Value: "vault"})
+	assert.Contains(t, envVars, v1.EnvVar{Name: "VAULT_ADDR", Value: "http://1.1.1.1:8200"})
+	assert.Contains(t, envVars, v1.EnvVar{Name: "VAULT_CACERT", Value: "/etc/vault/vault.ca"})
+	assert.Contains(t, envVars, v1.EnvVar{Name: "VAULT_TOKEN", ValueFrom: &v1.EnvVarSource{SecretKeyRef: &v1.SecretKeySelector{LocalObjectReference: v1.LocalObjectReference{Name: "vault-token"}, Key: "token"}}})
 
-func TestVaultConfigToEnvVar(t *testing.T) {
-	type args struct {
-		spec cephv1.ClusterSpec
-	}
-	tests := []struct {
-		name string
-		args args
-		want []v1.EnvVar
-	}{
-		{"no tls", args{spec: cephv1.ClusterSpec{Security: cephv1.SecuritySpec{KeyManagementService: cephv1.KeyManagementServiceSpec{TokenSecretName: "vault-token", ConnectionDetails: map[string]string{"KMS_PROVIDER": "vault", "VAULT_ADDR": "http://1.1.1.1:8200"}}}}}, []v1.EnvVar{
-			{Name: "KMS_PROVIDER", Value: "vault"},
-			{Name: "VAULT_ADDR", Value: "http://1.1.1.1:8200"},
-			{Name: "VAULT_TOKEN", ValueFrom: &v1.EnvVarSource{
-				SecretKeyRef: &v1.SecretKeySelector{
-					LocalObjectReference: v1.LocalObjectReference{
-						Name: "vault-token",
-					},
-					Key: "token",
-				},
-			},
-			},
-		},
-		},
-		{" tls", args{spec: cephv1.ClusterSpec{Security: cephv1.SecuritySpec{KeyManagementService: cephv1.KeyManagementServiceSpec{TokenSecretName: "vault-token", ConnectionDetails: map[string]string{"KMS_PROVIDER": "vault", "VAULT_ADDR": "http://1.1.1.1:8200", "VAULT_CACERT": "vault-ca-cert-secret"}}}}}, []v1.EnvVar{
-			{Name: "KMS_PROVIDER", Value: "vault"},
-			{Name: "VAULT_ADDR", Value: "http://1.1.1.1:8200"},
-			{Name: "VAULT_TOKEN", ValueFrom: &v1.EnvVarSource{
-				SecretKeyRef: &v1.SecretKeySelector{
-					LocalObjectReference: v1.LocalObjectReference{
-						Name: "vault-token",
-					},
-					Key: "token",
-				},
-			},
-			},
-			{Name: "VAULT_CACERT", Value: "/etc/vault/vault.ca"},
-		},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := VaultConfigToEnvVar(tt.args.spec); !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("VaultConfigToEnvVar() = %v, want %v", got, tt.want)
-			}
-		})
-	}
 }
 
 func TestConfigEnvsToMapString(t *testing.T) {