[mlorenzofr]

The previous implementation used openssl s_client from the Vault pod to fetch the discovery endpoint certificate. That fails on minimal UBI-based Vault images and was a poor fit for in-cluster SPIRE URLs (service CA vs ingress/router cert). Using the platform service CA (or an explicit pattern-provided bundle) matches how ZTVP configures JWT trust elsewhere.

Changes

Vault JWT OIDC discovery no longer depends on openssl inside the Vault pod, which unblocks the HashiCorp Vault chart 2.1.2-ubi images that do not ship OpenSSL.

• Default trust (in-cluster OIDC): When oidc_discovery_ca_pem is omitted or empty, the role reads the OpenShift service CA from ConfigMap openshift-service-ca.crt in vault_ns (service-ca.crt) and passes it to vault write auth/jwt/config as oidc_discovery_ca_pem.
• External OIDC: Patterns can pass oidc_discovery_ca_pem as an extra var (same as oidc_discovery_url)—a PEM string or list of PEMs—for discovery endpoints signed by a corporate or external CA.
• Idempotency: JWT config updates are gated by a single vault_jwt_config_needs_update fact (JWT auth missing, discovery config missing, or oidc_discovery_url / default_role drift).
• Docs: New Vault JWT authentication section in roles/vault_utils/README.md (workflow, extra vars table, and pattern override examples).