From 00ba3516ba61248dbc5158ec7ef5d4cc22c9f361 Mon Sep 17 00:00:00 2001
From: Muhammad Tahir Nawaz <tahir@themoonshotfactory.com>
Date: Wed, 14 Oct 2026 17:05:45 +0500
Subject: [PATCH] fix: read the nats ca from a configmap in integration tests

---
 .github/workflows/integration-tests.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.github/workflows/integration-tests.yaml b/.github/workflows/integration-tests.yaml
index 62bec8f..fd998d8 100644
--- a/.github/workflows/integration-tests.yaml
+++ b/.github/workflows/integration-tests.yaml
@@ -310,6 +310,19 @@ jobs:
           location: ${{ env.CLUSTER_REGION }}
           project_id: ${{ env.GCP_PROJECT }}
 
+      # The service env's NATS_TLS_CA_FILE is the pod's mount path, which a runner
+      # does not have. Same as the Vault CA: a public ConfigMap, CI has no access to Secrets.
+      - name: Fetch NATS CA
+        if: ${{ inputs.use_nats_port_forward }}
+        run: |
+          set -euo pipefail
+          kubectl get configmap nats-ca -n nats -o jsonpath='{.data.ca\.crt}' \
+            > /tmp/nats-ca.crt
+          if [ ! -s /tmp/nats-ca.crt ]; then
+            echo "NATS CA bundle came back empty"; exit 1
+          fi
+          echo "NATS_TLS_CA_FILE=/tmp/nats-ca.crt" >> $GITHUB_ENV
+
       - name: Port-forward NATS via in-cluster service
         if: ${{ inputs.use_nats_port_forward }}
         run: |