Credentials are injected to clone a private GitLab repo from a GitLab Workspace

Problem Description

The objective of this is to utilize Kubernetes Secret resources to securely handle and enable access to sensitive information necessary for an application. Developer secrets will be encrypted and managed within a Workspace, and then injected into the Workspace as environment variables.

User Story

As a developer, I want to be able to securely manage and provide access to sensitive information required by my application and prevent it from being exposed in my application's configuration files. I want to use credential injection to ensure that sensitive information is securely managed and accessed only by authorized users or processes. This approach will help me maintain the security and integrity of my application and the data it processes.

Exit Criteria

A PoC with secrets managed by Kubernetes for a Workspace.

Possible Solutions

  • Use Kubernetes Secret resources to store and manage sensitive data securely. The secrets can then be mounted into the application's deployment YAML, preventing the sensitive data from being exposed in the YAML itself. The application can securely access the secrets at runtime, and the traffic between the workspace and the Kubernetes API server is encrypted, ensuring that sensitive information is not exposed while in transit.
  • There are some new features in k8s that could help with this - https://kubernetes.io/docs/tasks/administer-cluster/kms-provider/

Not In Scope

  • When we say "securely managed and accessed only by authorized users or processes," do we mean the processes running inside the workspace? If so, how can we determine which processes are authorized?
  • Kubernetes secrets are not encrypted, they are only encoded, so we need to find a way to create encrypted secrets in Kubernetes that can be mounted as environment variables. We can explore using new features in Kubernetes, such as KMS providers, to help with this.
  • We also need to consider how to store these secrets in an encrypted manner in Postgres.
  • Finally, we need to consider the issue of allowing Kubernetes administrators to view user secrets, as this could compromise security.
Edited by David O'Regan