Move Secrets Manager settings into the new Secure settings section

Why are we doing this work

Following the discussion in &22395 (note_3462628144), a new Secure settings section was introduced to house feature opt-ins (Dependency Firewall and Secrets Manager) in one logical place, matching the Secrets Manager opt-in/trial experience.

MR !243158 (merged) ("Add dependency firewall setting pt2") added the new Secure settings section, but it currently only contains the Dependency Firewall toggle. As noted by @ahuss7 in note_3494700250, moving the Secrets Manager settings into this section was deferred to follow-up work. This issue tracks that follow-up.

Two things to note:

  • !243158 (merged) only added the Secure section for group settings. The Secrets Manager also needs a Secure section for project settings, which does not exist yet.
  • Today the Secure section is gated behind the availability of the Dependency Firewall toggle (see note_3494700250). This gating needs revisiting once the section also hosts the Secrets Manager settings.

Acceptance Criteria

This only applies to SaaS; self-managed has its own settings in the instance-level.

With the redesign from https://gitlab.com/gitlab-org/gitlab/-/work_items/614103, we want to:

  • Move TLG settings for secrets manager from the General tab to a new Secure tab; all other levels (subgroups, projects) remain under General.
  • If the TLG starts a trial or provisions from the secrets manager page, we show a link that says Manage permissions settings. Make sure this is updated with the new link to the Secure settings
  • Show a "New" badge in the navigation menu
  • Update gating logic for the secrets manager. The settings is only visible once the TLG Owner enables the add-on or starts a trial from the secrets manager page. This cascades down; the subgroups and projects under the TLG can't view the secrets manager until the the trial/add-on is enabled.

Relevant links

Implementation plan

  • Add a new Secure settings section for project settings (the group-level section already exists from !243158 (merged)).
  • Move the existing Secrets Manager settings into the Secure section at both the group and project levels.
  • Revisit the Secure section's display/gating logic so it renders correctly when the Secrets Manager settings are present (not only when the Dependency Firewall toggle is available).
  • Ensure existing entry points/links to the Secrets Manager settings still resolve to the new location.

Verification steps

Enable the Secrets Manager

  1. Upload a Premium license (or above).
  2. Set up openbao and enable the secrets manager on your gdk.
  3. Enable the secrets_manager and group_secrets_manager feature flags.
  4. Go to your settings (Settings > General) and expand Visibility, project features, permissions for projects, or Permissions and group features for groups. Enable the secrets manager for your project/group with the settings toggle.
  5. Go to /path-to-project-or-group/secrets to view the secrets manager.

Feature verification

  1. Navigate to a group's settings and confirm the Secrets Manager settings now appear under the Secure section.
  2. Navigate to a project's settings and confirm a Secure section exists and contains the Secrets Manager settings.
  3. Confirm the Secrets Manager settings remain fully functional in their new location (enabling/disabling, permissions, etc.).
  4. Confirm the Secure section renders appropriately based on Secrets Manager availability (independent of the Dependency Firewall toggle).
Edited by 🤖 GitLab Bot 🤖