Needed:

• Create a ServiceAccount in the Konflux cluster with RBAC to create/get Release and get ReleasePlan/PipelineRun resources in the relevant namespaces (ai-tenant, etc.)
• Store the kubeconfig/token in HashiCorp Vault
• Configure GitLab CI/CD to pull the secret from Vault (or as a masked CI variable sourced from Vault)

Acceptance Criteria:

• ServiceAccount can authenticate to Konflux and has required permissions