--- title: How to Use GitHub Actions to Deploy to Kubernetes... description: A step-by-step guide shows how to deploy to Kubernetes from GitHub Actions using Teleport's Machine & Workload Identity instead of long-lived shared secrets.... canonical: https://daily.dev/posts/how-to-use-github-actions-to-deploy-to-kubernetes-without-shared-secre-hu780mrgz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Use GitHub Actions to Deploy to Kubernetes Without Shared Secre | daily.dev og:description: A step-by-step guide shows how to deploy to Kubernetes from GitHub Actions using Teleport's Machine & Workload Identity instead of long-lived shared secrets.... og:url: https://daily.dev/posts/how-to-use-github-actions-to-deploy-to-kubernetes-without-shared-secre-hu780mrgz og:image: https://api.daily.dev/og/posts/hu780mrGz.png og:image:alt: How to Use GitHub Actions to Deploy to Kubernetes Without Shared Secre og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Use GitHub Actions to Deploy to Kubernetes Without Shared Secre **[Teleport](https://daily.dev/sources/teleport)** · 17 min read · 0 upvotes · 0 comments ## Summary A step-by-step guide shows how to deploy to Kubernetes from GitHub Actions using Teleport's Machine & Workload Identity instead of long-lived shared secrets. It covers configuring Kubernetes RBAC, creating a Teleport role, setting up a GitHub join token and bot, and wiring a GitHub Actions workflow with teleport-actions/setup and auth-k8s to obtain short-lived, verifiable credentials. It also explains how GitHub's signed OIDC tokens are validated, how audit logging traces deployments back to specific CI runs, and notes that the same secretless pattern now extends to database connections and internal APIs via newer teleport-actions tunnels. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I deploy to Kubernetes from GitHub Actions without storing long-lived kubeconfig secrets? Use short-lived, signed identities instead of static credentials: configure Kubernetes RBAC with a Role and RoleBinding scoped to a CI group, create a Teleport role and join token that trusts GitHub Actions OIDC tokens for a specific repository and branch, then use the teleport-actions/setup and teleport-actions/auth-k8s GitHub Actions to authenticate and generate a short-lived kubectl config during the workflow run. _daily.dev surfaces practical write-ups like this for teams hardening their CI/CD-to-Kubernetes pipelines._ ### What are the security risks of storing Kubernetes deploy credentials as GitHub Actions secrets? Long-lived shared secrets stored in a CI/CD system can be exfiltrated through compromised developer laptops, supply chain attacks on CI tooling (such as the 2021 CodeCov incident that stole environment variables from thousands of organizations), or leaked logging systems, giving attackers high-privilege access to create, read, update, and delete cluster resources for as long as the secret remains valid. _Developers weighing CI/CD secret exposure can track supply chain security practices on daily.dev._ ### What information does a GitHub Actions OIDC token include that can be used for authentication and auditing? A GitHub Actions ID token is a signed JWT containing claims about the specific run, including the repository, branch (ref), workflow name, triggering actor, run ID, and immutable numeric identifiers like actor_id, repository_id, and repository_owner_id. These numeric IDs remain stable even if a repository or account is renamed, making them more reliable for indexing in a SIEM than the human-readable names. _daily.dev helps engineers building audit-ready CI pipelines keep up with identity and OIDC token practices._ ## Similar posts on daily.dev - [Push images to Quay without a password](https://daily.dev/posts/push-images-to-quay-without-a-password-eh1jx9vlp) · Red Hat Developer · 0 upvotes · 0 comments - [How to Use Atlantis with GitHub Actions for Terraform](https://daily.dev/posts/how-to-use-atlantis-with-github-actions-for-terraform-dild0uulj) · Spacelift · 2 upvotes · 0 comments - [I Need My CI/CD Pipeline to Access Cosmos DB Without Using a Secret](https://daily.dev/posts/i-need-my-ci-cd-pipeline-to-access-cosmos-db-without-using-a-secret-a6ied0fmf) · DevBlogs · 0 upvotes · 0 comments - [Connect GitHub Actions to AWS with OIDC \(No Access Keys\)](https://daily.dev/posts/connect-github-actions-to-aws-with-oidc-no-access-keys--d4kysoafb) · AWS Fundamentals · 0 upvotes · 0 comments - [CD with the Terraform and GitHub Actions](https://daily.dev/posts/cd-with-the-terraform-and-github-actions-y4geqjcda) · Auth0 · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/how-to-use-github-actions-to-deploy-to-kubernetes-without-shared-secre-hu780mrgz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Use GitHub Actions to Deploy to Kubernetes Without Shared Secre","url":"https://daily.dev/posts/how-to-use-github-actions-to-deploy-to-kubernetes-without-shared-secre-hu780mrgz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-use-github-actions-to-deploy-to-kubernetes-without-shared-secre-hu780mrgz"},"datePublished":"2026-08-23T12:19:17.685Z","dateModified":"2026-08-23T12:31:38.871Z","description":"A step-by-step guide shows how to deploy to Kubernetes from GitHub Actions using Teleport's Machine & Workload Identity instead of long-lived shared secrets....","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-use-github-actions-to-deploy-to-kubernetes-without-shared-secre-hu780mrgz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,cicd,github-actions","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How to Use GitHub Actions to Deploy to Kubernetes Without Shared Secre"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-use-github-actions-to-deploy-to-kubernetes-without-shared-secre-hu780mrgz#faq","mainEntity":[{"@type":"Question","name":"How can I deploy to Kubernetes from GitHub Actions without storing long-lived kubeconfig secrets?","acceptedAnswer":{"@type":"Answer","text":"Use short-lived, signed identities instead of static credentials: configure Kubernetes RBAC with a Role and RoleBinding scoped to a CI group, create a Teleport role and join token that trusts GitHub Actions OIDC tokens for a specific repository and branch, then use the teleport-actions/setup and teleport-actions/auth-k8s GitHub Actions to authenticate and generate a short-lived kubectl config during the workflow run. daily.dev surfaces practical write-ups like this for teams hardening their CI/CD-to-Kubernetes pipelines."}},{"@type":"Question","name":"What are the security risks of storing Kubernetes deploy credentials as GitHub Actions secrets?","acceptedAnswer":{"@type":"Answer","text":"Long-lived shared secrets stored in a CI/CD system can be exfiltrated through compromised developer laptops, supply chain attacks on CI tooling (such as the 2021 CodeCov incident that stole environment variables from thousands of organizations), or leaked logging systems, giving attackers high-privilege access to create, read, update, and delete cluster resources for as long as the secret remains valid. Developers weighing CI/CD secret exposure can track supply chain security practices on daily.dev."}},{"@type":"Question","name":"What information does a GitHub Actions OIDC token include that can be used for authentication and auditing?","acceptedAnswer":{"@type":"Answer","text":"A GitHub Actions ID token is a signed JWT containing claims about the specific run, including the repository, branch (ref), workflow name, triggering actor, run ID, and immutable numeric identifiers like actor_id, repository_id, and repository_owner_id. These numeric IDs remain stable even if a repository or account is renamed, making them more reliable for indexing in a SIEM than the human-readable names. daily.dev helps engineers building audit-ready CI pipelines keep up with identity and OIDC token practices."}}]} ```