Use dedicated signing key for CI_JOB_JWT (take 2)
What does this MR do?
In !28063 (merged) we implemented new CI variable (CI_JOB_JWT) that is JWT signed with the instance's OpenID Connect signing key. While this is fine, during security review it was recommended we switch to using dedidcated signing key for these tokens - !28063 (comment 325521818).
This is the second attempt to replace openid_connect_signing_key with the new ci_jwt_signing_key when generating CI_JOB_JWT. The first MR (!34249 (merged)) had to be reverted due to gitlab-com/gl-infra/production#2284 (closed).
Instead of trying to generate and save the key on the fly when missing (and fail if there is no write access) in this MR we just skip generating CI_JOB_JWT if there is no key available - !38762 (diffs). There was already error handling for when the key is not valid RSA key. This also helps with not having to mock the key for every test that calls Ci::Build#variables but does not care for the JWT.
For GitLab.com the key was configured for all environments by @skarbek with https://gitlab.com/gitlab-com/gl-infra/infrastructure/-/issues/10573#note_363148693.
The use of the new key is behind a ci_jwt_signing_key feature flag and disabled by default - !38762 (diffs).
The MR also implements /-/jwks endpoint instead of delegating to the doorkeeper-openid_connect gem. Response will still include openid_connect_signing_key for seamless rollout.
Related to #214607 (closed).
Screenshots
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec -
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team
Closes #214607 (closed)