Skip to content

WIP: Vault integration for CI pipelines

Marius Bobin requested to merge poc-gitlab-vault-integration-118624 into master

What does this MR do?

related issue: #118624 (closed)

  • Install Vault by downloading the binary or brew install vault
  • Start Vault in dev env with vault server -dev
  • Create a new project and go to Settings -> Integrations -> Vault and fill the URL and token with the values from the previous step
  • Create a Vault secret with vault kv put secret/password hello=world test=data
  • Create a .gitlab-ci file using the following examples:
job_1:
  script:
    - printenv
  secrets:
    vault:
      - key: "secret/password"
# sends 
# VAULT_SECRET_PASSWORD_HELLO=world
# VAULT_SECRET_PASSWORD_test=data

job_2:
  script:
    - printenv | grep VAULT
  secrets:
    vault:
      - key: "secret/password"
        expose_as: "VAULT_PASSWORD"
        field: hello
      - key: "secret/password"
        expose_as: "VAULT_PASSWORD_TST"
        field: test
# sends
# VAULT_PASSWORD=world
# VAULT_PASSWORD_TST=data
# it fetches "secret/password" for each entry, needs optimization 

job_3:
  script:
    - printenv | grep VAULT
  secrets:
    vault:
      - key: "aws/creds/my-role"
        prefix: "MY_VAULT"

# sends
# MY_VAULT_AWS_CREDS_MY_ROLE_SECRET_KEY=secret
# MY_VAULT_AWS_CREDS_MY_ROLE_ACCESS_KEY=key

job_3:
  script:
    - printenv | grep VAULT
  secrets:
    vault:
      - key: "aws/creds/my-role"
        prefix: ""
# sends
# SECRET_KEY=secret
# ACCESS_KEY=key

Configuring Vault for AWS

It's not possible to use field for AWS credentials with the current implementation.

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Marius Bobin

Merge request reports