Using OIDC With HashiCorp Vault and GitHub Actions
summary
Demonstrates replacing static creds with Vault-issued short-lived tokens: configures HCP Vault OIDC auth method, creates a role bound to repo:ref (repo:Ned1313/vault-oidc:ref:heads:main), a policy granting read to KV path tacos/data/sauce_recipe, then a GitHub Actions workflow that requests an ID token and uses hashicorp/vault-action (v2.4.0) to log in. Token TTL is 100s, troubleshooting step prints the JWT and Vault response, the run succeeds and the secret is retrieved (output masked).
AI-written summary · about
chapters (10)
- 0:00The problem with static secrets
- 2:34Why dynamic secrets are better
- 4:24Understanding secret zero
- 5:30Authentication options
- 10:25Introduction to OIDC and JWT
- 14:56JWT claim fields
- 17:22Vault configuration demo
- 26:21GitHub secrets setup
- 28:04GitHub actions workflow
- 33:40Running the demo
related talks
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
18mCodify Your JWT-OIDC Vault Auth Method with Terraform
24mDeveloper-First Application Security and DevSecOps
29mI Can OIDC You Clearly Now: How We Made Static Credentials a...
28mSecret Management with Hashicorp´s Vault
23mUsing Hashicorp Vault in Kubernetes Clusters
20mSecuring OIDC Federation in CI/CD Workflows
25mBetter Together: JWT and Vault in Modern Apps