GitLab Secrets Manager: Govern Secrets Like Your Code
Centralize credential management within GitLab to eliminate fragmented vaults and over-scoped CI/CD variables.
1Unified Credential Governance
GitLab Secrets Manager, now generally available in version 19.5, integrates credential storage directly into the GitLab platform. Built on OpenBao, it allows teams to manage build-time and runtime secrets using existing project permissions. This eliminates the need for standalone vaults, reducing the complexity of maintaining separate integration points for infrastructure and pipelines.
2Granular Job-Level Scoping
Security teams can now restrict credential access to specific jobs based on project, branch, and environment context. By using the secrets keyword in .gitlab-ci.yml, developers ensure that sensitive values are injected only into authorized tasks. This prevents agents from accessing credentials that exceed their required scope, significantly hardening the CI/CD supply chain.
3Enhanced Runtime Security
The system writes secret values to temporary files within jobs, exposing only the path to minimize exposure in crash dumps or telemetry. Values are masked in logs and discarded immediately upon job completion. Furthermore, OpenBao encrypts all stored data at rest using AES-256-GCM, ensuring that the secrets database contains only ciphertext.
4Simplified Incident Response
In the event of a compromised dependency, responders can identify exactly which jobs accessed specific credentials. Because every read operation is logged with pipeline and job IDs, teams can trace leaks back to specific commits or users. This audit trail allows for targeted revocation and rotation without disrupting unrelated pipeline operations.
5Namespace-Based Access Control
Secrets Manager leverages the existing GitLab membership model to govern access, removing the need for a secondary permission system. Projects inherit secrets from parent groups, and owners manage read, write, or delete permissions via standard roles. When a user is removed from a project, their access to associated secrets is automatically terminated.
6Cross-Platform Secret Integration
The manager supports diverse runtime tools, including Kubernetes via the External Secrets Operator, Terraform, and OpenTofu. By using a Vault-compatible API, existing scripts can point directly to the manager. This centralization ensures that Kubernetes clusters and infrastructure-as-code tools share the same audit trail and security policies as the CI/CD pipelines.
7Supply Chain Control Framework
This tool fits into the broader GitLab Security Standard by supporting the Authorize and Respond stages. It complements existing features like Secret Push Protection and the Dependency Firewall to create a governed software factory. These controls ensure that only verified packages enter pipelines and only authorized identities access sensitive production credentials.
8Implementation and Licensing
Available for Premium and Ultimate tiers, the service is billed through GitLab Credits based on storage and read operations. Administrators can enable the feature on self-managed instances, while GitLab.com users can initiate a 30-day trial. Teams are encouraged to use the secret audit tool to identify variables suitable for migration.
Original article: GitLab — GitLab Secrets Manager: Govern Secrets Like Your Code