- shell: |
          #!/usr/local/bin/runbld --redirect-stderr
          set -euo pipefail

          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export data=$(vault read -format=json aws-test/creds/elasticsearch-ci-s3)
          export amazon_s3_access_key=$(echo $data | jq -r .data.access_key)

          #!/usr/local/bin/runbld --redirect-stderr
          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export eql_test_credentials_file="$(pwd)/x-pack/plugin/eql/qa/correctness/credentials.gcs.json"
          vault read -field=credentials.gcs.json secret/elasticsearch-ci/eql_test_credentials > ${eql_test_credentials_file}

          set -euo pipefail
          export google_storage_service_account=$(pwd)/gcs_service_account.json

          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          vault read -field=private_key_data gcp-elastic-ci-prod/key/elasticsearch-ci-thirdparty-gcs | base64 --decode > $google_storage_service_account
          unset VAULT_TOKEN

}

final String vaultToken = System.getenv('VAULT_TOKEN') ?: new Vault(
  new VaultConfig()
    .address(System.env.VAULT_ADDR)
    .engineVersion(1)
    .build()
)
  .withRetries(5, 1000)
  .auth()
  .loginByAppRole("approle", System.env.VAULT_ROLE_ID, System.env.VAULT_SECRET_ID)
  .getAuthClientToken()

final Vault vault = new Vault(
  new VaultConfig()
    .address(System.env.VAULT_ADDR)
    .engineVersion(1)

      - shell: |
          #!/usr/local/bin/runbld --redirect-stderr
          set -euo pipefail
          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export data=$(vault read -format=json secret/elasticsearch-ci/azure_thirdparty_test_creds)
          export azure_storage_account=$(echo $data | jq -r .data.account_id)

          #!/usr/local/bin/runbld --redirect-stderr
          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export eql_test_credentials_file="$(pwd)/x-pack/plugin/eql/qa/correctness/credentials.gcs.json"
          vault read -field=credentials.gcs.json secret/elasticsearch-ci/eql_test_credentials > ${eql_test_credentials_file}

# in compliance with, at your election, the Elastic License 2.0 or the Server
# Side Public License, v 1.
#

# forcing to use TLS1.2 to avoid failure in vault
# see https://github.com/hashicorp/vault/issues/8750#issuecomment-631236121
systemProp.jdk.tls.client.protocols=TLSv1.2

# java homes resolved by environment variables

    display-name: "elastic / elasticsearch # %BRANCH% - intake"
    description: "Testing of the Elasticsearch %BRANCH% branch on every push.\n"
    project-type: multijob
    node: master
    vault: []
    triggers:
      # We use this trigger instead of the provided "github" webhook trigger because it's more robust.

      - shell: |
          #!/usr/local/bin/runbld --redirect-stderr
          set -euo pipefail
          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export data=$(vault read -format=json secret/elasticsearch-ci/azure_thirdparty_sas_test_creds)
          export azure_storage_account=$(echo $data | jq -r .data.account_id)

```
MINIO_ROOT_USER_FILE=/vault/secrets/my_access_key
MINIO_ROOT_PASSWORD_FILE=/vault/secrets/my_secret_key
```

### Retrieving Container ID