Skip to content

Vault Integration Feature License Tier

This issue is to discuss the proposed license tier for the feature of secrets management in GitLab CI/CD

See Epic &816

Proposal: Put secrets management into Ultimate/Gold

Rational:

  1. We currently support Environment Variables in all tiers. This can act as a "low grade" secrets management. The values are injected into the CI build at the time of run. This keeps the values out of the source code, and project permissions control who can see/change these values. Unless they are purposely exposed in the CI job (i.e. echo $MY_SECRET)
  2. Our current Pricing Model declares Risk, Compliance, Security, and Governance management as outcomes Ultimate. With the expected buyer at the Executive level.
  3. Secrets Management is about separation of duties and ensuring that you only have access at the lowest level and for the least amount of time required to get the job done. This is the definition of Risk and Compliance Management.
  4. Systems like Hashicorp Vault are designed to "reduce secret sprawl" and "centrally manages and enforces access to secrets". This would be Governance of those secrets.

Comments and Feedback Welcome

/cc @brendan