AppRole is the correct choice for the on-premises CI/CD targets because it is designed for machine and application authentication. AWS auth is appropriate for AWS workloads because Vault can validate AWS identity metadata, but it does not naturally authenticate vSphere-based on-premises workloads. GitHub auth is mainly user/team oriented and tied to GitHub identity, not a generic CI/CD machine identity pattern. Userpass requires a username and password and is generally unsuitable for automated pipelines because it encourages static credential handling. AppRole uses a RoleID and SecretID model, allowing controlled authentication for services, automation, and pipelines that do not have a native cloud identity provider. HashiCorp’s AppRole documentation describes it as an auth method for machines and apps.

================