setting up vault for GitHub Action OIDC auth

vault_gh_setup.sh

export VAULT_ADDR="https://xxxx:8200"
export VAULT_NAMESPACE="admin"

export VAULT_TOKEN=xxx

tee vault-action.hcl <<EOF
path "kv/data/ci" {
    capabilities = ["read"]
}

EOF

## KV v2 backend was pre-created
vault kv put kv/ci app_secret=a_secret


vault policy write vault-action vault-action.hcl

vault auth enable jwt

vault write auth/jwt/config \
      oidc_discovery_url="https://token.actions.githubusercontent.com" \
      bound_issuer="https://token.actions.githubusercontent.com" \
      default_role="demo"


vault write auth/jwt/role/demo \
    role_type="jwt" \
    bound_subject="repo:gitrgoliveira/vault-action-exampleapp:ref:refs/*" \
    bound_audiences="https://github.com/gitrgoliveira" \
    user_claim="workflow" \ # this will define the entity alias
    policies="vault-action" \
    ttl=1h

vault read  auth/jwt/role/demo