Skip to content

Problem with configuring OIDC setup for private installation of Gitlab and public S3 bucket

Gitlab instance info

Gitlab instance: private

Gitlab version: v17.9.2-ee

Configuration implemented

We are trying to configure OpenID Connect in AWS to retrieve temporary credentials on non-public Gitlab instance.

We followed documentation to create public S3 bucket with OpenID configuration and public keys.

Verified S3 setup using validator oauth2.dev image

Changed Giltab Helm Chart deployment configuration adding ciIdTokens parameter to point to S3 bucket public url: https://a-tst-s3-gitlab-devsecops-oidc.s3.eu-central-1.amazonaws.com

Issue

We are having issues trying to retrieve temporary credentials from AWS. image

Also while looking into Gitlab Helm Chart documentation we could not find any information regarding ciIdTokens parameter. Is it even implemented?

Which version of Gitlab supports OpenID Connect configuration with public S3 bucket?

Verification steps

helm template ~/repos/gitlab \      
    -s charts/gitlab/charts/webservice/templates/configmap.yml \
    --set global.appConfig.ciIdTokens.issuerUrl="foobar.example.com" \
    --set certmanager-issuer.email=test@example.com \
    | yq '.data."gitlab.yml.erb"' | yq '.production.ci_id_tokens'

Should return issuer_url: foobar.example.com instead of issue_url: null.

See #551649 (comment 2672104897)

Edited by Fabien Catteau