Use dedicated signing key for CI_JOB_JWT

Merged Krasimir Angelov requested to merge 214607-ci-jwt-signing-key/jwks into master

What does this MR do?

In !28063 (merged) we implemented new CI variable (CI_JOB_JWT) that is JWT signed with the instance's OpenID Connect signing key. While this is fine, during security review it was recommended we switch to using dedidcated signing key for these tokens - !28063 (comment 325521818).

This MR replaces openid_connect_signing_key with the new ci_jwt_signing_key when generating CI_JOB_JWT.

This also implements /-/jwks endpoint instead of delegating to the doorkeeper-openid_connect gem. Response will still include openid_connect_signing_key for seamless rollout.

Related to #214607 (closed).

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by 🤖 GitLab Bot 🤖