vault-oidc-ssh-cert-action/action.yaml at main · andreaso/vault-oidc-ssh-cert-action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
---

name: Vault OIDC SSH client certs
description: Use OIDC authentication to get SSH client certificates from Vault alt. OpenBao
author: Andreas Olsson

inputs:
  vault_server:
    description: URL of the Vault server
    required: true
  jwt_oidc_backend_path:
    description: Path to Vault's GitHub configured JWT OIDC backend
    required: true
  jwt_oidc_role:
    description: Name of the Vault server JWT OIDC role to use
    required: true
  ssh_backend_path:
    description: Path to Vault's SSH CA backend
    required: true
  ssh_role:
    description: Name of the Vault server SSH certificate role to use
    required: true
  jwt_audience:
    description: Custom JWT audience. Defaults to the vault_server hostname
    required: false

outputs:
  cert_path:
    description: Full path to the generated SSH certificate
    value: ${{ steps.run_action.outputs.cert_path }}
  key_path:
    description: Full path to the corresponding private SSH key
    value: ${{ steps.run_action.outputs.key_path }}

runs:
  using: composite
  steps:
    - name: Run Action
      id: run_action
      shell: bash
      run: /usr/bin/python3 vault_oidc_ssh_cert_action.py
      working-directory: ${{ github.action_path }}
      env:
        JWT_AUDIENCE: ${{ inputs.jwt_audience }}
        JWT_OIDC_BACKEND_PATH: ${{ inputs.jwt_oidc_backend_path }}
        JWT_OIDC_ROLE: ${{ inputs.jwt_oidc_role }}
        SSH_BACKEND_PATH: ${{ inputs.ssh_backend_path }}
        SSH_ROLE: ${{ inputs.ssh_role }}
        VAULT_SERVER: ${{ inputs.vault_server }}
        TMPDIR: ${{ runner.temp }}

branding:
  icon: terminal
  color: yellow