Skip to content

Commit 81a5a89

Browse files
kubabuczakkubabuczak
committed
CSPL-4201 Update GitHub Actions workflows to use OIDC tokens instead of static credentials
- Replaced aws-actions/configure-aws-credentials@v1 with v5 across multiple workflows. - Updated AWS credential configuration to use role-based access with role-to-assume and role-session-name. - Added permissions for contents, packages, and pull-requests in several workflows.
1 parent b5d8704 commit 81a5a89

24 files changed

+213
-130
lines changed

‎.github/workflows/arm-AL2023-build-test-push-workflow-AL2023.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -89,11 +89,11 @@ jobs:
8989
sudo chmod +x operator-sdk_${OS}_${ARCH}
9090
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
9191
- name: Configure AWS credentials
92-
uses: aws-actions/configure-aws-credentials@v1
92+
uses: aws-actions/configure-aws-credentials@v5
9393
with:
94-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
95-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
96-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
94+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
95+
role-session-name: github-${{ github.run_id }}
96+
aws-region: ${{ vars.AWS_REGION }}
9797
- name: Login to Amazon ECR
9898
id: login-ecr
9999
uses: aws-actions/amazon-ecr-login@v1
@@ -211,11 +211,11 @@ jobs:
211211
run: |
212212
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
213213
- name: Configure AWS credentials
214-
uses: aws-actions/configure-aws-credentials@v1
214+
uses: aws-actions/configure-aws-credentials@v5
215215
with:
216-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
217-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
218-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
216+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
217+
role-session-name: github-${{ github.run_id }}
218+
aws-region: ${{ vars.AWS_REGION }}
219219
- name: Login to Amazon ECR
220220
id: login-ecr
221221
uses: aws-actions/amazon-ecr-login@v1

‎.github/workflows/arm-AL2023-int-test-workflow.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ jobs:
3939
sudo chmod +x operator-sdk_${OS}_${ARCH}
4040
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
4141
- name: Configure AWS credentials
42-
uses: aws-actions/configure-aws-credentials@v1
42+
uses: aws-actions/configure-aws-credentials@v5
4343
with:
44-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
45-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
46-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
44+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
45+
role-session-name: github-${{ github.run_id }}
46+
aws-region: ${{ vars.AWS_REGION }}
4747
- name: Login to Amazon ECR
4848
id: login-ecr
4949
uses: aws-actions/amazon-ecr-login@v1
@@ -161,11 +161,11 @@ jobs:
161161
run: |
162162
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
163163
- name: Configure AWS credentials
164-
uses: aws-actions/configure-aws-credentials@v1
164+
uses: aws-actions/configure-aws-credentials@v5
165165
with:
166-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
167-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
168-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
166+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
167+
role-session-name: github-${{ github.run_id }}
168+
aws-region: ${{ vars.AWS_REGION }}
169169
- name: Login to Amazon ECR
170170
id: login-ecr
171171
uses: aws-actions/amazon-ecr-login@v1

‎.github/workflows/arm-RHEL-build-test-push-workflow.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ jobs:
3939
sudo chmod +x operator-sdk_${OS}_${ARCH}
4040
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
4141
- name: Configure AWS credentials
42-
uses: aws-actions/configure-aws-credentials@v1
42+
uses: aws-actions/configure-aws-credentials@v5
4343
with:
44-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
45-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
46-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
44+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
45+
role-session-name: github-${{ github.run_id }}
46+
aws-region: ${{ vars.AWS_REGION }}
4747
- name: Login to Amazon ECR
4848
id: login-ecr
4949
uses: aws-actions/amazon-ecr-login@v1
@@ -161,11 +161,11 @@ jobs:
161161
run: |
162162
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
163163
- name: Configure AWS credentials
164-
uses: aws-actions/configure-aws-credentials@v1
164+
uses: aws-actions/configure-aws-credentials@v5
165165
with:
166-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
167-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
168-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
166+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
167+
role-session-name: github-${{ github.run_id }}
168+
aws-region: ${{ vars.AWS_REGION }}
169169
- name: Login to Amazon ECR
170170
id: login-ecr
171171
uses: aws-actions/amazon-ecr-login@v1

‎.github/workflows/arm-RHEL-int-test-workflow.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ jobs:
3939
sudo chmod +x operator-sdk_${OS}_${ARCH}
4040
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
4141
- name: Configure AWS credentials
42-
uses: aws-actions/configure-aws-credentials@v1
42+
uses: aws-actions/configure-aws-credentials@v5
4343
with:
44-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
45-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
46-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
44+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
45+
role-session-name: github-${{ github.run_id }}
46+
aws-region: ${{ vars.AWS_REGION }}
4747
- name: Login to Amazon ECR
4848
id: login-ecr
4949
uses: aws-actions/amazon-ecr-login@v1
@@ -161,11 +161,11 @@ jobs:
161161
run: |
162162
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
163163
- name: Configure AWS credentials
164-
uses: aws-actions/configure-aws-credentials@v1
164+
uses: aws-actions/configure-aws-credentials@v5
165165
with:
166-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
167-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
168-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
166+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
167+
role-session-name: github-${{ github.run_id }}
168+
aws-region: ${{ vars.AWS_REGION }}
169169
- name: Login to Amazon ECR
170170
id: login-ecr
171171
uses: aws-actions/amazon-ecr-login@v1

‎.github/workflows/arm-Ubuntu-build-test-push-workflow.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -89,11 +89,11 @@ jobs:
8989
sudo chmod +x operator-sdk_${OS}_${ARCH}
9090
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
9191
- name: Configure AWS credentials
92-
uses: aws-actions/configure-aws-credentials@v1
92+
uses: aws-actions/configure-aws-credentials@v5
9393
with:
94-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
95-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
96-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
94+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
95+
role-session-name: github-${{ github.run_id }}
96+
aws-region: ${{ vars.AWS_REGION }}
9797
- name: Login to Amazon ECR
9898
id: login-ecr
9999
uses: aws-actions/amazon-ecr-login@v1
@@ -211,11 +211,11 @@ jobs:
211211
run: |
212212
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
213213
- name: Configure AWS credentials
214-
uses: aws-actions/configure-aws-credentials@v1
214+
uses: aws-actions/configure-aws-credentials@v5
215215
with:
216-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
217-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
218-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
216+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
217+
role-session-name: github-${{ github.run_id }}
218+
aws-region: ${{ vars.AWS_REGION }}
219219
- name: Login to Amazon ECR
220220
id: login-ecr
221221
uses: aws-actions/amazon-ecr-login@v1

‎.github/workflows/arm-Ubuntu-int-test-workflow.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ jobs:
3939
sudo chmod +x operator-sdk_${OS}_${ARCH}
4040
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
4141
- name: Configure AWS credentials
42-
uses: aws-actions/configure-aws-credentials@v1
42+
uses: aws-actions/configure-aws-credentials@v5
4343
with:
44-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
45-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
46-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
44+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
45+
role-session-name: github-${{ github.run_id }}
46+
aws-region: ${{ vars.AWS_REGION }}
4747
- name: Login to Amazon ECR
4848
id: login-ecr
4949
uses: aws-actions/amazon-ecr-login@v1
@@ -161,11 +161,11 @@ jobs:
161161
run: |
162162
echo "SPLUNK_OPERATOR_IMAGE=${{ env.SPLUNK_OPERATOR_IMAGE_NAME }}:$GITHUB_SHA" >> $GITHUB_ENV
163163
- name: Configure AWS credentials
164-
uses: aws-actions/configure-aws-credentials@v1
164+
uses: aws-actions/configure-aws-credentials@v5
165165
with:
166-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
167-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
168-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
166+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
167+
role-session-name: github-${{ github.run_id }}
168+
aws-region: ${{ vars.AWS_REGION }}
169169
- name: Login to Amazon ECR
170170
id: login-ecr
171171
uses: aws-actions/amazon-ecr-login@v1

‎.github/workflows/automated-release-workflow.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
name: Automated Release Workflow
2+
permissions:
3+
contents: read
4+
packages: write
5+
id-token: write
6+
pull-requests: write
27
on:
38
workflow_dispatch:
49
inputs:
@@ -37,11 +42,11 @@ jobs:
3742
uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359
3843

3944
- name: Configure AWS credentials
40-
uses: aws-actions/configure-aws-credentials@v4
45+
uses: aws-actions/configure-aws-credentials@v5
4146
with:
42-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
43-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
44-
aws-region: us-east-1
47+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
48+
role-session-name: github-${{ github.run_id }}
49+
aws-region: ${{ vars.AWS_REGION }}
4550

4651
- name: Login to Amazon ECR
4752
id: login-ecr-public

‎.github/workflows/bias-language-workflow.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
name: Bias Language
2+
permissions:
3+
contents: read
4+
packages: write
5+
pull-requests: write
26
on: [push]
37
jobs:
48
biased_lang:

‎.github/workflows/build-test-push-workflow.yml‎

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
name: Build and Test
2+
permissions:
3+
contents: read
4+
packages: write
5+
id-token: write
6+
pull-requests: write
27
on:
38
pull_request: {}
49
push:
@@ -85,11 +90,11 @@ jobs:
8590
sudo chmod +x operator-sdk_${OS}_${ARCH}
8691
sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
8792
- name: Configure AWS credentials
88-
uses: aws-actions/configure-aws-credentials@v1
93+
uses: aws-actions/configure-aws-credentials@v5
8994
with:
90-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
91-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
92-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
95+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
96+
role-session-name: github-${{ github.run_id }}
97+
aws-region: ${{ vars.AWS_REGION }}
9398
- name: Login to Amazon ECR
9499
id: login-ecr
95100
uses: aws-actions/amazon-ecr-login@v1
@@ -125,11 +130,11 @@ jobs:
125130
- name: Set up Docker Buildx
126131
uses: docker/[email protected]
127132
- name: Configure AWS credentials
128-
uses: aws-actions/configure-aws-credentials@v1
133+
uses: aws-actions/configure-aws-credentials@v5
129134
with:
130-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
131-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
132-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
135+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
136+
role-session-name: github-${{ github.run_id }}
137+
aws-region: ${{ vars.AWS_REGION }}
133138

134139
- name: Login to Amazon ECR
135140
uses: aws-actions/amazon-ecr-login@v1
@@ -256,11 +261,11 @@ jobs:
256261
- name: Pull Splunk Enterprise Image
257262
run: docker pull ${{ env.SPLUNK_ENTERPRISE_IMAGE }}
258263
- name: Configure AWS credentials
259-
uses: aws-actions/configure-aws-credentials@v1
264+
uses: aws-actions/configure-aws-credentials@v5
260265
with:
261-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
262-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
263-
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
266+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
267+
role-session-name: github-${{ github.run_id }}
268+
aws-region: ${{ vars.AWS_REGION }}
264269
- name: Login to Amazon ECR
265270
id: login-ecr
266271
uses: aws-actions/amazon-ecr-login@v1

‎.github/workflows/bundle-push-post-release.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
name: Bundle Push Post Release Workflow
2+
permissions:
3+
contents: read
4+
packages: write
5+
pull-requests: write
26
on:
37
workflow_dispatch:
48
inputs:

0 commit comments

Comments
 (0)