kdihalas/Simple Vault Action

An action that helps you inderact with a Hashicorp Vault Instance

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Apr 6, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: kdihalas/vault-action@2dd3e9b6ac2a7431bad66169bf72dd76220b9d8f # v2.1.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
url	The URL of the Vault instance	yes	—
role	The Vault role to use for authentication	no	github-action
jwt_claim	The JWT claim to use for authentication	no	actor
output_token	Output the Vault token	no	false
secrets	A list of secrets to read from Vault	no	empty
namespace	Kubernetes namespace to use for kube_secrets entries (overridden by per-entry namespace if provided)	no	""
aws_secrets	A list of Vault AWS secrets engine roles to generate dynamic AWS credentials from. Format: "<mount>/<role> \| <ENV_PREFIX>" (one per line, semicolon-separated). Exports <PREFIX>_ACCESS_KEY_ID, <PREFIX>_SECRET_ACCESS_KEY, and (when present) <PREFIX>_SESSION_TOKEN.	no	empty
aws_duration	Duration for AWS credentials (e.g. "900s", "15m"). Only applies to aws_secrets entries.	no	900s
kube_secrets	A list of Vault Kubernetes secrets engine roles to generate short-lived service account tokens from. Format: "<mount>/<role> <namespace> <api_server_url> <ca_cert_b64> \| <context_name>" (one per line, semicolon-separated). Writes a merged kubeconfig to $RUNNER_TEMP, exports KUBECONFIG, and sets the kubeconfig output.	no	empty

Outputs

name	description
kubeconfig	Path to the generated kubeconfig file containing all Kubernetes contexts from kube_secrets entries. Only set when kube_secrets is provided.