## Why are we doing this work We need to add an admin settings toggle for self-managed instances that allows administrators to enroll in the Secrets Manager Open Beta. The toggle state will be queryable and modified via GraphQL mutation and when enabled will allow for Secrets Manager feature availability instance wide. The setting itself will be hidden behind the open beta feature flags, to be determined in https://gitlab.com/gitlab-org/gitlab/-/work_items/597896. It's likely we'll use different feature flags for instances and TLG. ## Relevant links Refer to https://gitlab.com/gitlab-org/gitlab/-/work_items/597481+ for the designs. Refer to https://gitlab.com/gitlab-org/gitlab/-/work_items/597896+ for the feature flag. ## Implementation plan 1. **GraphQL** - Add `get_instance_secret_manager_open_beta_enrollment.query.graphql`, `enroll_instance_secret_manager_open_beta.mutation.graphql`, and `unenroll_instance_secret_manager_open_beta.mutation.graphql` under `ee/app/assets/javascripts/ci/secrets/graphql/` (names to confirm once [#598522](https://gitlab.com/gitlab-org/gitlab/-/work_items/598522) is merged). 2. **Vue component** - Create `ee/app/assets/javascripts/admin/application_settings/secrets_manager/secrets_manager_open_beta_toggle.vue` with a `GlToggle` that queries enrollment state on mount and calls enroll/unenroll mutations on change. Show toast on success, inline error on failure. 3. **Mount script** - Create `index.js` alongside the component to mount it on a `#js-secrets-manager-open-beta-settings` DOM element with Apollo. 4. **Admin settings view** - Add a new Haml partial and a `SettingsBlockComponent` entry in `ee/app/views/admin/application_settings/security_and_compliance.html.haml`, gated behind the open beta feature flag from [#597896](https://gitlab.com/gitlab-org/gitlab/-/work_items/597896). 5. **Tests** - Jest unit tests covering: initial toggle state from query, enroll/unenroll on change, error handling, and feature-flag-gated rendering. ## Verification steps 1. Upload a Premium license (or above). 2. [Set up openbao and enable the secrets manager](https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/howto/openbao.md) on your gdk. 3. Enable the Open Beta feature flag (to be provided in https://gitlab.com/gitlab-org/gitlab/-/work_items/597896). 4. Go to your project settings (Settings > General) and expand **Visibility, project features, permissions**. Verify that the secrets manager toggle does not exist yet in the settings. 5. Go to the Admin settings and enable the secrets manager open beta toggle. 6. Go back to the permissions settings of your project and verify that the secrets manager toggle is now available.