Use dedicated signing key for CI_JOB_JWT
What does this MR do?
In !28063 (merged) we implemented new CI variable (CI_JOB_JWT) that is JWT signed with the instance's OpenID Connect signing key. While this is fine, during security review it was recommended we switch to using dedidcated signing key for these tokens - !28063 (comment 325521818).
This MR replaces openid_connect_signing_key with the new ci_jwt_signing_key when generating CI_JOB_JWT.
This also implements /-/jwks endpoint instead of delegating to the doorkeeper-openid_connect gem. Response will still include openid_connect_signing_key for seamless rollout.
Related to #214607 (closed).
Screenshots
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team