[muhammad-tahir-nawaz]

Summary

The integration-tests workflow reads the OpenBao CA from the vault/vault-ca ConfigMap instead of the vault-tls Secret.

Why

Security review follow-up: vault-tls also holds the OpenBao server private key, and CI's service account should have no access to Secrets. The ConfigMap is already published in dev by wanaware-infrastructure, so this can merge now.

QA Report

• No QA report required — CI workflow change, no user-facing API.

Integration Tests

• No integration tests required — CI workflow only; exercised by the next run of the workflow.

Dependencies

• Must merge before the wanaware-iam change that removes container.secrets.* from tf-deploy@ (CustomRole359). Same for RDE and kde's NATS CA PRs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused workflow change correctly removes CI’s dependency on Secret access.

Review effort: Balanced
Findings: None

What changed in this PR

Updates integration-test CI to read the OpenBao CA without requiring Secret access.

Changes:

• Reads ca.crt from the vault/vault-ca ConfigMap.
• Removes unnecessary Base64 decoding.

File	Description
.github/​workflows/​integration-tests.yaml	Sources the Vault CA from a ConfigMap.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[greptile-apps]

Confidence Score: 5/5

[Low risk] Integration test workflow reads vault certificate from different source.

The PR appears safe to merge based on the reviewed workflow change.

Summary

The integration-tests workflow now reads the OpenBao CA from the vault/vault-ca ConfigMap rather than the vault-tls Secret, avoiding a CI read of a Secret that also contains the server private key.

_{Reviews (1) · Last reviewed commit: "chore: read the CA from a ConfigMap inst..."}