- shell: |
          #!/usr/local/bin/runbld --redirect-stderr
          set -euo pipefail
          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export data=$(vault read -format=json secret/elasticsearch-ci/azure_thirdparty_sas_test_creds)

      - shell: |
          #!/usr/local/bin/runbld --redirect-stderr
          set -euo pipefail

          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export data=$(vault read -format=json aws-test/creds/elasticsearch-ci-s3)
          export amazon_s3_access_key=$(echo $data | jq -r .data.access_key)

            RUNTIME_JAVA_HOME=$HOME/.java/$ES_RUNTIME_JAVA
      - shell: |
          #!/usr/local/bin/runbld --redirect-stderr
          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export eql_test_credentials_file="$(pwd)/x-pack/plugin/eql/qa/correctness/credentials.gcs.json"

          set -euo pipefail
          export google_storage_service_account=$(pwd)/gcs_service_account.json

          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          vault read -field=private_key_data gcp-elastic-ci-prod/key/elasticsearch-ci-thirdparty-gcs | base64 --decode > $google_storage_service_account

      - shell: |
          #!/usr/local/bin/runbld --redirect-stderr
          set -euo pipefail
          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export data=$(vault read -format=json secret/elasticsearch-ci/azure_thirdparty_test_creds)

---

##### GLOBAL METADATA

- meta:
    cluster: elasticsearch-ci

##### JOB DEFAULTS

- job:
    vault:
      url: https://secrets.elastic.co:8200
      role_id: 1ba1ac3e-aee4-d040-d9a3-6ae23bd2b3db
    node: "general-purpose"
    concurrent: true
    logrotate:
      daysToKeep: 30
      numToKeep: 500
      artifactDaysToKeep: 7
    parameters:
      - string:
          name: branch_specifier

            RUNTIME_JAVA_HOME=$HOME/.java/$ES_RUNTIME_JAVA
      - shell: |
          #!/usr/local/bin/runbld --redirect-stderr
          set +x
          VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=$VAULT_ROLE_ID secret_id=$VAULT_SECRET_ID)
          export VAULT_TOKEN
          export eql_test_credentials_file="$(pwd)/x-pack/plugin/eql/qa/correctness/credentials.gcs.json"

	}

	resourceID := "idmp-"
	roleID := env.Get(EnvIdentityPluginRoleID, kv.Get(RoleID))
	if roleID == "" {
		// We use a hash of the plugin URL so that the ARN remains
		// constant across restarts.
		h := sha1.New()
		h.Write([]byte(pluginURL))
		bs := h.Sum(nil)
		resourceID += base64.RawURLEncoding.EncodeToString(bs)
	} else {
		// Check that the roleID is restricted to URL safe characters

        assertEquals("ROLE_SUPER_ULTRA_MEGA_ADMIN_WITH_VERY_LONG_NAME_FOR_TESTING_PURPOSES", secured.value()[0]);
    }

    // Test with many roles
    @Secured({ "ROLE_1", "ROLE_2", "ROLE_3", "ROLE_4", "ROLE_5", "ROLE_6", "ROLE_7", "ROLE_8", "ROLE_9", "ROLE_10" })
    static class ManyRolesClass {
    }

    @Test
    public void test_manyRoles() {
        Secured secured = ManyRolesClass.class.getAnnotation(Secured.class);

opes","value":""},{"key":"vendor","value":""},{"key":"keycloak_realm","value":""},{"key":"keycloak_admin_url","value":""}]},"identity_plugin":{"_":[{"key":"url","value":""},{"key":"auth_token","value":""},{"key":"role_policy","value":""},{"key":"role_id","value":""}]},"identity_tls":{"_":[{"key":"skip_verify","value":"off"}]},"ilm":{"_":[{"key":"transition_workers","value":"100"},{"key":"expiration_workers","value":"100"}]},"lambda_webhook":{"_":[{"key":"enable","value":"off"},{"key":"endpoint",...