LCORE-1724: use OIDC federation for AWS credentials

Replace static AWS access keys with short-lived STS credentials
obtained via OIDC federation. Separate get-aws-creds task ensures
creds are available for both provision and destroy steps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: are-ces

.tekton/integration-tests/pipeline/lightspeed-stack-rhelai-test.yaml

@@ -40,19 +40,65 @@ spec:
       default: 'false'
       type: string
   tasks:
+    # ── AWS OIDC authentication ──
+    - name: get-aws-creds
+      description: Obtain temporary AWS credentials via OIDC federation.
+      taskSpec:
+        results:
+          - name: aws-access-key-id
+          - name: aws-secret-access-key
+          - name: aws-session-token
+        volumes:
+          - name: oidc-token
+            projected:
+              sources:
+                - serviceAccountToken:
+                    audience: sts.amazonaws.com
+                    expirationSeconds: 3600
+                    path: token
+        steps:
+          - name: assume-role
+            image: amazon/aws-cli:latest
+            volumeMounts:
+              - name: oidc-token
+                mountPath: /var/run/secrets/oidc
+                readOnly: true
+            script: |
+              #!/bin/sh
+              set -euo pipefail
+              echo "[sts] Assuming role via OIDC..."
+              CREDS=$(aws sts assume-role-with-web-identity \
+                --role-arn "arn:aws:iam::313828097073:role/konflux-rhelai-ci" \
+                --role-session-name "rhelai-$(context.pipelineRun.name)" \
+                --web-identity-token file:///var/run/secrets/oidc/token \
+                --duration-seconds 14400 \
+                --output json)
+              echo "$CREDS" | python3 -c "
+              import json, sys
+              c = json.load(sys.stdin)['Credentials']
+              open('$(results.aws-access-key-id.path)', 'w').write(c['AccessKeyId'])
+              open('$(results.aws-secret-access-key.path)', 'w').write(c['SecretAccessKey'])
+              open('$(results.aws-session-token.path)', 'w').write(c['SessionToken'])
+              "
+              echo "[sts] Temporary credentials obtained (valid 4h)."
+
     # ── RHEL AI provisioning (MAPT) ──
     - name: provision-rhelai
       description: Provision a RHEL AI instance with vLLM auto-started.
       timeout: 2h
       runAfter:
         - provision-cluster
+        - get-aws-creds
       taskSpec:
         params:
           - name: rhelai-version
           - name: instance-type
           - name: model
           - name: debug
           - name: spot
+          - name: aws-access-key-id
+          - name: aws-secret-access-key
+          - name: aws-session-token
         results:
           - name: host
             description: "RHEL AI instance hostname or IP"
@@ -90,8 +136,9 @@ spec:
               #!/bin/sh
               set -uo pipefail
 
-              export AWS_ACCESS_KEY_ID=$(cat /opt/aws-credentials/AWS_ACCESS_KEY_ID)
-              export AWS_SECRET_ACCESS_KEY=$(cat /opt/aws-credentials/AWS_SECRET_ACCESS_KEY)
+              export AWS_ACCESS_KEY_ID="$(params.aws-access-key-id)"
+              export AWS_SECRET_ACCESS_KEY="$(params.aws-secret-access-key)"
+              export AWS_SESSION_TOKEN="$(params.aws-session-token)"
               BUCKET=$(cat /opt/aws-credentials/S3_BUCKET)
               RUN_ID="$(context.pipelineRun.name)"
               HF_TOKEN=$(cat /opt/aws-credentials/HUGGING_FACE_HUB_TOKEN)
@@ -182,6 +229,12 @@ spec:
           value: "$(params.debug)"
         - name: spot
           value: "$(params.spot)"
+        - name: aws-access-key-id
+          value: "$(tasks.get-aws-creds.results.aws-access-key-id)"
+        - name: aws-secret-access-key
+          value: "$(tasks.get-aws-creds.results.aws-secret-access-key)"
+        - name: aws-session-token
+          value: "$(tasks.get-aws-creds.results.aws-session-token)"
 
     # ── OpenShift cluster provisioning (same as existing e2e pipeline) ──
     - name: eaas-provision-space
@@ -416,9 +469,18 @@ spec:
       params:
         - name: debug
           value: "$(params.debug)"
+        - name: aws-access-key-id
+          value: "$(tasks.get-aws-creds.results.aws-access-key-id)"
+        - name: aws-secret-access-key
+          value: "$(tasks.get-aws-creds.results.aws-secret-access-key)"
+        - name: aws-session-token
+          value: "$(tasks.get-aws-creds.results.aws-session-token)"
       taskSpec:
         params:
           - name: debug
+          - name: aws-access-key-id
+          - name: aws-secret-access-key
+          - name: aws-session-token
         volumes:
           - name: aws-credentials
             secret:
@@ -445,8 +507,9 @@ spec:
               #!/bin/sh
               set -uo pipefail
 
-              export AWS_ACCESS_KEY_ID=$(cat /opt/aws-credentials/AWS_ACCESS_KEY_ID)
-              export AWS_SECRET_ACCESS_KEY=$(cat /opt/aws-credentials/AWS_SECRET_ACCESS_KEY)
+              export AWS_ACCESS_KEY_ID="$(params.aws-access-key-id)"
+              export AWS_SECRET_ACCESS_KEY="$(params.aws-secret-access-key)"
+              export AWS_SESSION_TOKEN="$(params.aws-session-token)"
               export AWS_DEFAULT_REGION="us-east-1"
               BUCKET=$(cat /opt/aws-credentials/S3_BUCKET)
               RUN_ID="$(context.pipelineRun.name)"