GitLab Secrets Manager adds ESO, Terraform, API support

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Today, you might maintain separate secret stores for CI/CD, Kubernetes, and Terraform. However, that leaves multiple tools to manage, access models to keep in sync, and audit trails to correlate when something goes wrong.GitLab Secrets Manager now supports External Secrets Operator (ESO) and Terraform, extending secure secret retrieval beyond CI/CD pipelines. Powered by OpenBao, GitLab Secrets Manager provides a single source of truth for secrets across your software delivery chain. You can now use the same secret store for:Kubernetes workloads via ESOTerraform or OpenTofu RunsOpenBao or Vault CLICI/CD Jobs in GitLab (as of Version 19.0)Any external automation through the Secrets Manager APIKubernetes: External Secrets OperatorESO syncs secrets from GitLab Secrets Manager using the Vault provider. A workload in your cluster holds a short-lived JSON Web Token (JWT) that ESO uses to authenticate with OpenBao and writes the secret into a Kubernetes Secret.A SecretStore tells ESO where to fetch secrets from and how to authenticate. GitLab Secrets Manager exposes a Vault-compatible KV v2 API and you configure it using the Vault provider. The namespace field maps to your GitLab hierarchy (organization, group, project) and scopes which secrets this store can reach. Authentication uses a GitLab-minted JWT held in a Kubernetes secret, referenced by secretRef.apiVersion: external-secrets.io/v1 kind: SecretStore metadata: name: gitlab-secrets-manager namespace: my-app spec: provider: vault: server: https://secrets.gitlab.com # provider.vault.server path: secrets/kv # …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://about.gitlab.com/blog/gitlab-secrets-manager-add-eso-terraform-api-support/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.