The Splunk schema extension repository
splunk / vault-plugin-secrets-gitlab Goto Github PK
View Code? Open in Web Editor NEWVault Plugin for Gitlab Project Access Token
License: Apache License 2.0
Vault Plugin for Gitlab Project Access Token
License: Apache License 2.0
14.7 added support for group level access token https://about.gitlab.com/releases/2022/01/22/gitlab-14-7-released/#group-access-tokens
we want to support this in this plugin.
depending on xanzy/go-gitlab#1347
it currently only runs unit test. we need to run acceptance test in CI
self-hosted gitlab and isolated vault instance in docker
continuing from #16, instead of scripts, create CLIs to facilitate
I've tested at instance level where an admin token is used. This allows to create project access token for any projects.
For SaaS or limited use, this secret mount should work for
We'll need to test and document that situation where group maintainer token is used. it should be able to create project access token for projects under the group. it shouldn't be able to create project access token for a project outside of the group where the token configured in plugin doesn't have access to.
Hi, I'm testing this plugin which would be very useful for an instance-scoped external CI pipeline. But when I tried the examples in the README this error appears:
vault write gitlab/token id=1 name=ci-token scopes=api,write_repository
Error writing data to gitlab/token: Error making API request.
URL: PUT https://<vault host>/v1/gitlab/token
Code: 400. Errors:
* Failed to create a token - POST https://<gitlab host>/api/v4/projects/1/access_tokens: 400 {error: expires_at is missing}
Apparently Gitlab is changing the policy wrt expires_at
, and now it's being required.
https://gitlab.com/gitlab-org/terraform-provider-gitlab/-/issues/4133
Could you please include this in the requests?
creating instruction how to setup project with CI_JOB_JWT with secure manner
Implement revoke token functionality. Currently, generated tokens are either expired or manually revoked. No-longer-needed token should also be revoked programmatically.
AC:
generic path revoke which accepts below to revoke
{
"id": ,
"token_id": ,
}
we'll want a control that a only generated token can be revoked by the requested entity. plane /revoke endpoint may not be sufficient for it.
For self-hosted GitLab, admin can lift API rate limit per origin of user.
For SaaS GitLab, there's a limit documented here. it's 2000 rpm for authenticated access. This shouldn't be a problem for even large usages. But in case this plugin user surpasses the rate limit, premium/ultimate customers should be able to request for the lift.
We need to document it
token TTL implementation is not great. this is because GitLab doesn't implement custom token expiry in minutes/hours. token always expire at midnight UTC.
dependabot takes care of updating dependencies.
We should have a security scanning integrated in CI
gitlab natively supports vault in ci yaml.
https://docs.gitlab.com/ee/ci/yaml/#secretsvault
https://docs.gitlab.com/ee/ci/secrets/
check detailed implementation of it and feasibility of using this secrets backend instead of kv
document if it's possible or not
https://docs.gitlab.com/ee/api/resource_access_tokens.html#create-a-project-access-token
when you create a project access token, it now supports setting access level
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.