feat: use Github jwt authentication for Vault secrets

Author: BernhardFuchs

.github/workflows/docker-latest.yml

@@ -18,10 +18,6 @@ on:
     secrets:
       VAULT_ADDR:
         required: true
-      CI_SECRET_READER_PERIODIC_TOKEN:
-        required: true
-      VAULTCA:
-        required: true
       SLACK_WEBHOOK_URL:
         required: true
 
@@ -44,15 +40,18 @@ jobs:
 
   publish-image:
     runs-on: ubuntu-latest
+    permission:
+      id-token: write
+
     steps:
       - uses: actions/checkout@master
 
       - name: Import Secrets
         uses: hashicorp/vault-action@v3
         with:
           url: ${{ secrets.VAULT_ADDR }}
-          token: ${{ secrets.CI_SECRET_READER_PERIODIC_TOKEN }}
-          caCertificate: ${{ secrets.VAULTCA }}
+          method: jwt
+          role: github-actions
           secrets: |
             ci/data/gh-workflows/${{ inputs.GLOBAL_REPO_NAME }} username | DOCKER_USERNAME ;
             ci/data/gh-workflows/${{ inputs.GLOBAL_REPO_NAME }} password | DOCKER_PASSWORD ;

.github/workflows/docker-release.yml

@@ -21,10 +21,6 @@ on:
     secrets:
       VAULT_ADDR:
         required: true
-      CI_SECRET_READER_PERIODIC_TOKEN:
-        required: true
-      VAULTCA:
-        required: true
       SLACK_WEBHOOK_URL:
         required: true
 
@@ -39,15 +35,16 @@ jobs:
     timeout-minutes: 15
     permissions:
       contents: write
+      id-token: write
 
     steps:
       - name: Import Secrets maven
         if: ${{ inputs.GLOBAL_FRAMEWORK == 'maven' || inputs.GLOBAL_FRAMEWORK == 'triggered' || inputs.GLOBAL_FRAMEWORK == 'did-science' }}
         uses: hashicorp/vault-action@v3
         with:
           url: ${{ secrets.VAULT_ADDR }}
-          token: ${{ secrets.CI_SECRET_READER_PERIODIC_TOKEN }}
-          caCertificate: ${{ secrets.VAULTCA }}
+          method: jwt
+          role: github-actions
           secrets: |
             ci/data/gh-workflows/${{ inputs.GLOBAL_REPO_NAME }} username | DOCKER_USERNAME ;
             ci/data/gh-workflows/${{ inputs.GLOBAL_REPO_NAME }} password | DOCKER_PASSWORD ;

.github/workflows/maven-release.yml

@@ -25,10 +25,6 @@ on:
     secrets:
       VAULT_ADDR:
         required: true
-      CI_SECRET_READER_PERIODIC_TOKEN:
-        required: true
-      VAULTCA:
-        required: true
       SLACK_WEBHOOK_URL:
         required: true
       DEPLOY_KEY:
@@ -38,6 +34,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       contents: write
 
     steps:
@@ -80,8 +77,8 @@ jobs:
         uses: hashicorp/vault-action@v3
         with:
           url: ${{ secrets.VAULT_ADDR }}
-          token: ${{ secrets.CI_SECRET_READER_PERIODIC_TOKEN }}
-          caCertificate: ${{ secrets.VAULTCA }}
+          method: jwt
+          role: github-actions
           secrets: |
             ci/data/gh-workflows/maven-danubetech-nexus username | DANUBETECH_MAVEN_INTERNAL_USERNAME ;
             ci/data/gh-workflows/maven-danubetech-nexus password | DANUBETECH_MAVEN_INTERNAL_PASSWORD

.github/workflows/maven-snapshot.yml

@@ -15,17 +15,14 @@ on:
     secrets:
       VAULT_ADDR:
         required: true
-      CI_SECRET_READER_PERIODIC_TOKEN:
-        required: true
-      VAULTCA:
-        required: true
       SLACK_WEBHOOK_URL:
         required: true
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       contents: read
 
     steps:
@@ -46,8 +43,8 @@ jobs:
         uses: hashicorp/vault-action@v3
         with:
           url: ${{ secrets.VAULT_ADDR }}
-          token: ${{ secrets.CI_SECRET_READER_PERIODIC_TOKEN }}
-          caCertificate: ${{ secrets.VAULTCA }}
+          method: jwt
+          role: github-actions
           secrets: |
             ci/data/gh-workflows/maven-danubetech-nexus username | DANUBETECH_MAVEN_INTERNAL_USERNAME ;
             ci/data/gh-workflows/maven-danubetech-nexus password | DANUBETECH_MAVEN_INTERNAL_PASSWORD