'Storing secrets and credentials securely in GitLab

I am wondering if it's possible to store credentials like passwords, tokens and keys safely in my GitLab project.

Currently there are a bunch of Java files with some passwords stored in it for testing purposes. However, I don't want to push this information on my repo due to security reasons. I tried using environment variables in the project, but they only seem to work for the .gitlab-ci.yml file.

My question is does anyone use a vault like Hashicorps or Blackbox to encrypt sensitive information?

Thanks

Solution 1:^[1]

You can check out GitLab 12.9 (March 2020) which comes with:

HashiCorp Vault GitLab CI/CD Managed Application

GitLab wants to make it easy for users to have modern secrets management. We are now offering users the ability to install Vault within a Kubernetes cluster as part of the GitLab CI managed application process.

This will support the secure management of keys, tokens, and other secrets at the project level in a Helm chart installation.

See documentation and issue.

Solution 2:^[2]

If you are not using environment variables in GitLab, then you are asking if it is possible to store secrets in GitLab. I have not done this myself, but I found this post about it:

https://embeddedartistry.com/blog/2018/03/15/safely-storing-secrets-in-git/

The author suggests three ways of storing secrets in git:

The author was using BlackBox, but was going to migrate to git-crypt. From a quick look at it, git-crypt looks like something that I could use myself.

Solution 3:^[3]

FWIW GitLab doesn't mask the secrets from Hashicorp Vault native integration.

However, this integration can still be used to a benefit: it's easier to store, rotate and version control the secrets in the Vault and sync them into GitLab's project/group/instance secrets via i.e. TerraForm.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source
Solution 1
Solution 2	MrBerta
Solution 3	Denis Pisarev

'Storing secrets and credentials securely in GitLab

Solution 1:[1]

HashiCorp Vault GitLab CI/CD Managed Application

Use HashiCorp Vault secrets in CI jobs

Solution 2:[2]

Solution 3:[3]

Sources

Related Questions

Solution 1:^[1]

Solution 2:^[2]

Solution 3:^[3]