GitLab Secrets Manager Now Supports ESO and Terraform
A single source of truth for secrets across your software delivery chain.
1An End to Fragmented Secret Management
GitLab Secrets Manager eliminates the need to maintain separate secret stores for CI/CD, Kubernetes, and Terraform. Powered by OpenBao, the system provides a single source of truth for secrets across your software delivery chain. You can now use the same secret store for Kubernetes workloads, Terraform runs, and GitLab CI/CD jobs. This feature, introduced in Version 19.0, simplifies synchronizing access models and correlating audit trails.
2Integration with Kubernetes
The External Secrets Operator (ESO) synchronizes secrets from GitLab Secrets Manager to Kubernetes. A workload in your cluster holds a short-lived JSON Web Token (JWT) that ESO uses to authenticate with OpenBao. A SecretStore tells ESO where to fetch secrets from and how to authenticate. GitLab Secrets Manager offers a Vault-compatible KV v2 API and is configured using the Vault provider. The namespace field maps to your GitLab hierarchy (organization, group, project) and scopes which secrets this store can access.
3Secure Solution for Terraform
Terraform state and .tfvars files are common sources of credential leaks due to secrets being accidentally written to disk or checked into version control. GitLab Secrets Manager enables Terraform to read a GitLab secret as a data source, authenticating with a minted JWT during planning or application. Credentials can be referenced directly in Terraform without storing anything in .tfvars files or CI/CD variables. This approach ensures secrets are managed securely.
4Command Line Access
The OpenBao or Vault CLI can read secrets from GitLab Secrets Manager just like it reads from Vault. A minted JWT can be exchanged for an OpenBao token, which is then exported. This token can be used to read the secret value. This feature provides significant convenience for teams scripting against Vault-compatible tools. Command line access offers flexibility in managing your workflows.
5Using the Secrets Manager API
For automation that doesn't fit GitLab CI/CD, Kubernetes, or Terraform, the Secrets Manager API allows any external system to fetch secrets from the Secrets Manager. This avoids hardcoding credentials or maintaining separate var files. The API can request a JWT token using a Service Account, which is then exchanged for a short-lived OpenBao token. This token can be used to read the secret value.
6Security and Auditing
GitLab Secrets Manager offers a multi-layered approach to enhance the security of your secrets. Minted JWTs improve security due to their short lifespan. SecretStore and ExternalSecret definitions control where secrets are fetched from and where they are placed. ESO creates and owns the target secret, allowing rotated values to propagate without redeployment. This ensures security and auditing in secret management.
7Integration Benefits
GitLab Secrets Manager simplifies your workflows by offering integrations with various tools. Kubernetes, Terraform, and OpenBao integrations allow you to manage secrets from a central location. API support enables you to meet custom automation needs. These integrations reduce complexity in secret management and increase efficiency. GitLab Secrets Manager is designed to enhance security and efficiency in your software delivery chain.
8Future Potential
The centralized secret management provided by GitLab Secrets Manager is a significant step toward enhancing security in software development and deployment processes. Support for ESO and Terraform allows users to improve security while maintaining their existing tools. API support offers flexibility to meet future automation needs. GitLab's solution aims to enhance the security of software delivery chains by adopting best practices in secret management.
Original article: GitLab — GitLab Secrets Manager Artık ESO ve Terraform Desteği Sunuyor