LCORE-1724: use native AWS SDK OIDC auth instead of pre-exchanged STS creds

Mount OIDC token directly in MAPT containers and let the AWS SDK
handle the STS exchange internally via AWS_WEB_IDENTITY_TOKEN_FILE
and AWS_ROLE_ARN. Remove get-aws-creds task. Role ARN read from
aws-mapt-credentials secret.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: are-ces

.tekton/integration-tests/pipeline/lightspeed-stack-rhelai-test.yaml

@@ -40,71 +40,20 @@ spec:
       default: 'false'
       type: string
   tasks:
-    # ── AWS OIDC authentication ──
-    - name: get-aws-creds
-      description: Obtain temporary AWS credentials via OIDC federation.
-      taskSpec:
-        results:
-          - name: aws-access-key-id
-          - name: aws-secret-access-key
-          - name: aws-session-token
-        volumes:
-          - name: oidc-token
-            projected:
-              sources:
-                - serviceAccountToken:
-                    audience: sts.amazonaws.com
-                    expirationSeconds: 3600
-                    path: token
-        steps:
-          - name: assume-role
-            image: amazon/aws-cli:latest
-            volumeMounts:
-              - name: oidc-token
-                mountPath: /var/run/secrets/oidc
-                readOnly: true
-            script: |
-              #!/bin/sh
-              set -euo pipefail
-              echo "[sts] Assuming role via OIDC..."
-              CREDS=$(aws sts assume-role-with-web-identity \
-                --role-arn "arn:aws:iam::313828097073:role/konflux-rhelai-ci" \
-                --role-session-name "rhelai-$(context.pipelineRun.name)" \
-                --web-identity-token file:///var/run/secrets/oidc/token \
-                --duration-seconds 14400 \
-                --output json)
-              echo "$CREDS" | python3 -c "
-              import json, sys
-              c = json.load(sys.stdin)['Credentials']
-              open('$(results.aws-access-key-id.path)', 'w').write(c['AccessKeyId'])
-              open('$(results.aws-secret-access-key.path)', 'w').write(c['SecretAccessKey'])
-              open('$(results.aws-session-token.path)', 'w').write(c['SessionToken'])
-              "
-              echo "[sts] Temporary credentials obtained (valid 4h)."
-              echo "[sts] Key ID length: $(wc -c < $(results.aws-access-key-id.path))"
-              echo "[sts] Secret length: $(wc -c < $(results.aws-secret-access-key.path))"
-              echo "[sts] Token length: $(wc -c < $(results.aws-session-token.path))"
-              echo "[sts] Key ID hash: $(md5sum $(results.aws-access-key-id.path) | cut -d' ' -f1)"
-              echo "[sts] Token hash: $(md5sum $(results.aws-session-token.path) | cut -d' ' -f1)"
-
     # ── RHEL AI provisioning (MAPT) ──
     - name: provision-rhelai
       description: Provision a RHEL AI instance with vLLM auto-started.
       timeout: 2h
       runAfter:
         # TODO: restore provision-cluster dependency
-        - get-aws-creds
-        - get-aws-creds
+        - provision-cluster
       taskSpec:
         params:
           - name: rhelai-version
           - name: instance-type
           - name: model
           - name: debug
           - name: spot
-          - name: aws-access-key-id
-          - name: aws-secret-access-key
-          - name: aws-session-token
         results:
           - name: host
             description: "RHEL AI instance hostname or IP"
@@ -118,19 +67,36 @@ spec:
               secretName: aws-mapt-credentials
           - name: host-info
             emptyDir: {}
+          - name: oidc-token
+            projected:
+              sources:
+                - serviceAccountToken:
+                    audience: sts.amazonaws.com
+                    expirationSeconds: 3600
+                    path: token
         steps:
           - name: create-instance
             image: ghcr.io/redhat-developer/mapt:pr-848
             imagePullPolicy: Always
             env:
               - name: HOME
                 value: /opt/mapt/run
+              - name: AWS_WEB_IDENTITY_TOKEN_FILE
+                value: /var/run/secrets/oidc/token
+              - name: AWS_ROLE_ARN
+                valueFrom:
+                  secretKeyRef:
+                    name: aws-mapt-credentials
+                    key: AWS_ROLE_ARN
             volumeMounts:
               - name: aws-credentials
                 mountPath: /opt/aws-credentials
                 readOnly: true
               - name: host-info
                 mountPath: /opt/host-info
+              - name: oidc-token
+                mountPath: /var/run/secrets/oidc
+                readOnly: true
             resources:
               requests:
                 cpu: "100m"
@@ -142,15 +108,6 @@ spec:
               #!/bin/sh
               set -uo pipefail
 
-              export AWS_ACCESS_KEY_ID="$(params.aws-access-key-id)"
-              export AWS_SECRET_ACCESS_KEY="$(params.aws-secret-access-key)"
-              export AWS_SESSION_TOKEN="$(params.aws-session-token)"
-              export AWS_STS_REGIONAL_ENDPOINTS=regional
-              echo "[mapt] Key ID length: ${#AWS_ACCESS_KEY_ID}"
-              echo "[mapt] Secret length: ${#AWS_SECRET_ACCESS_KEY}"
-              echo "[mapt] Token length: ${#AWS_SESSION_TOKEN}"
-              echo "[mapt] Key ID hash: $(echo -n "$AWS_ACCESS_KEY_ID" | md5sum | cut -d' ' -f1)"
-              echo "[mapt] Token hash: $(echo -n "$AWS_SESSION_TOKEN" | md5sum | cut -d' ' -f1)"
               BUCKET=$(cat /opt/aws-credentials/S3_BUCKET)
               RUN_ID="$(context.pipelineRun.name)"
               HF_TOKEN=$(cat /opt/aws-credentials/HUGGING_FACE_HUB_TOKEN)
@@ -241,12 +198,6 @@ spec:
           value: "$(params.debug)"
         - name: spot
           value: "$(params.spot)"
-        - name: aws-access-key-id
-          value: "$(tasks.get-aws-creds.results.aws-access-key-id)"
-        - name: aws-secret-access-key
-          value: "$(tasks.get-aws-creds.results.aws-secret-access-key)"
-        - name: aws-session-token
-          value: "$(tasks.get-aws-creds.results.aws-session-token)"
 
     # ── OpenShift cluster provisioning (same as existing e2e pipeline) ──
     - name: eaas-provision-space
@@ -481,33 +432,41 @@ spec:
       params:
         - name: debug
           value: "$(params.debug)"
-        - name: aws-access-key-id
-          value: "$(tasks.get-aws-creds.results.aws-access-key-id)"
-        - name: aws-secret-access-key
-          value: "$(tasks.get-aws-creds.results.aws-secret-access-key)"
-        - name: aws-session-token
-          value: "$(tasks.get-aws-creds.results.aws-session-token)"
       taskSpec:
         params:
           - name: debug
-          - name: aws-access-key-id
-          - name: aws-secret-access-key
-          - name: aws-session-token
         volumes:
           - name: aws-credentials
             secret:
               secretName: aws-mapt-credentials
+          - name: oidc-token
+            projected:
+              sources:
+                - serviceAccountToken:
+                    audience: sts.amazonaws.com
+                    expirationSeconds: 3600
+                    path: token
         steps:
           - name: destroy-instance
             image: ghcr.io/redhat-developer/mapt:pr-848
             imagePullPolicy: Always
             env:
               - name: HOME
                 value: /opt/mapt/run
+              - name: AWS_WEB_IDENTITY_TOKEN_FILE
+                value: /var/run/secrets/oidc/token
+              - name: AWS_ROLE_ARN
+                valueFrom:
+                  secretKeyRef:
+                    name: aws-mapt-credentials
+                    key: AWS_ROLE_ARN
             volumeMounts:
               - name: aws-credentials
                 mountPath: /opt/aws-credentials
                 readOnly: true
+              - name: oidc-token
+                mountPath: /var/run/secrets/oidc
+                readOnly: true
             resources:
               requests:
                 cpu: "100m"
@@ -519,9 +478,6 @@ spec:
               #!/bin/sh
               set -uo pipefail
 
-              export AWS_ACCESS_KEY_ID="$(params.aws-access-key-id)"
-              export AWS_SECRET_ACCESS_KEY="$(params.aws-secret-access-key)"
-              export AWS_SESSION_TOKEN="$(params.aws-session-token)"
               export AWS_DEFAULT_REGION="us-east-1"
               BUCKET=$(cat /opt/aws-credentials/S3_BUCKET)
               RUN_ID="$(context.pipelineRun.name)"