Vault Integration Feature License Tier
This issue is to discuss the proposed license tier for the feature of secrets management in GitLab CI/CD
See Epic &816
Ultimate/Gold
Proposal: Put secrets management into Rational:
- We currently support
Environment Variables
in all tiers. This can act as a "low grade" secrets management. The values are injected into the CI build at the time of run. This keeps the values out of the source code, and project permissions control who can see/change these values. Unless they are purposely exposed in the CI job (i.e.echo $MY_SECRET
) - Our current Pricing Model declares
Risk, Compliance, Security, and Governance
management as outcomesUltimate
. With the expected buyer at the Executive level. - Secrets Management is about separation of duties and ensuring that you only have access at the lowest level and for the least amount of time required to get the job done. This is the definition of Risk and Compliance Management.
- Systems like Hashicorp Vault are designed to "reduce secret sprawl" and "centrally manages and enforces access to secrets". This would be Governance of those secrets.
Comments and Feedback Welcome
/cc @brendan