From 7fd16bb2615dd98e3db545389cf07c0189440f67 Mon Sep 17 00:00:00 2001
From: Muhammad Tahir Nawaz <tahir@themoonshotfactory.com>
Date: Sat, 3 Oct 2026 20:45:51 +0500
Subject: [PATCH] chore: read the CA from a ConfigMap instead of a Secret

CI no longer needs access to Kubernetes Secrets: the Vault and NATS CAs are
published as the vault/vault-ca and nats/nats-ca ConfigMaps. vault-tls also
holds the OpenBao server private key.
---
 .github/workflows/integration-tests.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/integration-tests.yaml b/.github/workflows/integration-tests.yaml
index 1cade89..62bec8f 100644
--- a/.github/workflows/integration-tests.yaml
+++ b/.github/workflows/integration-tests.yaml
@@ -387,8 +387,10 @@ jobs:
           # Convention: KSA <service>-ksa lives in namespace <service>.
           ns="${VAULT_KSA_NAMESPACE:-${VAULT_KSA%-ksa}}"
 
-          kubectl get secret vault-tls -n vault -o jsonpath='{.data.ca\.crt}' \
-            | base64 -d > /tmp/vault-ca.crt
+          # A ConfigMap, not the vault-tls Secret: that Secret also holds the
+          # OpenBao server key, and CI has no access to Secrets.
+          kubectl get configmap vault-ca -n vault -o jsonpath='{.data.ca\.crt}' \
+            > /tmp/vault-ca.crt
           if [ ! -s /tmp/vault-ca.crt ]; then
             echo "Vault CA bundle came back empty"; exit 1
           fi