Add support for Akeyless
Note to approvers - please do NOT merge until Product @jocelynjane
has approved. Thanks!
What does this MR do and why?
Support authenticating and fetching from akeyless. Added all the supported fields in the .gitlab-ci.yml file for authenticating and fetching secrets from akeyless.
The secret manager is added as akeyless
keyword on secrets
. An example of a yaml would be as follows:
job:
id_tokens:
AKEYLESS_JWT:
aud: 'https://gitlab.com'
secrets:
DATABASE_PASSWORD:
token: $AKEYLESS_JWT
akeyless:
name: 'my-project-secret'
In addition to the above config, the user needs to provide the following variables:
- Akeyless access id
AKEYLESS_ACCESS_ID
Given the above yaml and CI variables, the job payload to Runner should contain the following json:
{
"secrets": {
"DATABASE_PASSWORD": {
"akeyless": {
"name": "my-project-secret",
"data_key": "",
"cert_user_name": "",
"public_key_data": "",
"csr_data": "",
"server": {
"access_id": "akeyless access id",
"access_key": "",
"akeyless_api_url": "https://api.akeyless.io",
"akeyless_access_type": "jwt",
"akeyless_token": "",
"uid_token": "",
"gcp_audience": "",
"azure_object_id": "",
"k8s_service_account_token": "",
"k8s_auth_config_name": "",
"gateway_ca_certificate": "",
"jwt": "$AKEYLESS_JWT"
}
}
}
}
}
With this configuration, the job would have the secret retrieved from Akeyless stored in the build variable DATABASE_PASSWORD
.
The runner implementation to handle this payload is done in gitlab-runner!4704 (closed)
What's the best way to test this MR?
- Log in to Akeyless https://console.akeyless.io/
- Create a new static secret: https://docs.akeyless.io/docs/static-secrets
- Create authenticate method of type OAuth2.0/JWT: https://docs.akeyless.io/docs/oauth20jwt
- Create a Role to the auth method you created to be able to access the secret: https://docs.akeyless.io/docs/rbac
- Set up a GDK environment with this gitlab changes and gitlab-runner gitlab-runner!4704 (closed)
- Use the YAML example I wrote in the description and update the name and the AKEYLESS_ACCESS_ID variable in the CI/CD.
- Run the pipeline and see that you got the secret in the build variable
DATABASE_PASSWORD
.
What are the relevant issue numbers?
Related to #443305 (closed)