diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-08-19 12:08:42 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-08-19 12:08:42 +0300 |
commit | b76ae638462ab0f673e5915986070518dd3f9ad3 (patch) | |
tree | bdab0533383b52873be0ec0eb4d3c66598ff8b91 /doc/ci/secrets | |
parent | 434373eabe7b4be9593d18a585fb763f1e5f1a6f (diff) |
Add latest changes from gitlab-org/gitlab@14-2-stable-eev14.2.0-rc42
Diffstat (limited to 'doc/ci/secrets')
-rw-r--r-- | doc/ci/secrets/index.md | 34 |
1 files changed, 31 insertions, 3 deletions
diff --git a/doc/ci/secrets/index.md b/doc/ci/secrets/index.md index 7fbc3448d4e..d3c34a6922e 100644 --- a/doc/ci/secrets/index.md +++ b/doc/ci/secrets/index.md @@ -5,7 +5,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w type: concepts, howto --- -# Using external secrets in CI +# Using external secrets in CI **(FREE)** > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/218746) in GitLab 13.4 and GitLab Runner 13.4. > - `file` setting [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/250695) in GitLab 14.1 and GitLab Runner 14.1. @@ -91,8 +91,7 @@ To configure your Vault server: - `VAULT_AUTH_PATH` - (Optional) The path where the authentication method is mounted, default is `jwt`. NOTE: - Support for [providing these values in the user interface](https://gitlab.com/gitlab-org/gitlab/-/issues/218677) - is planned but not yet implemented. + Support for providing these values in the user interface [is tracked in this issue](https://gitlab.com/gitlab-org/gitlab/-/issues/218677). ## Use Vault secrets in a CI job **(PREMIUM)** @@ -181,3 +180,32 @@ You can also specify some attributes for the resulting Vault tokens, such as tim IP address range, and number of uses. The full list of options is available in [Vault's documentation on creating roles](https://www.vaultproject.io/api/auth/jwt#create-role) for the JSON web token method. + +## Using a self-signed Vault server + +When the Vault server is using a self-signed certificate, you will see the following error in the job logs: + +```plaintext +ERROR: Job failed (system failure): resolving secrets: initializing Vault service: preparing authenticated client: checking Vault server health: Get https://vault.example.com:8000/v1/sys/health?drsecondarycode=299&performancestandbycode=299&sealedcode=299&standbycode=299&uninitcode=299: x509: certificate signed by unknown authority +``` + +You have two options to solve this error: + +- Add the self-signed certificate to the GitLab Runner server's CA store. + If you deployed GitLab Runner using the [Helm chart](https://docs.gitlab.com/runner/install/kubernetes.html), you will have to create your own GitLab Runner image. +- Use the `VAULT_CACERT` environment variable to configure GitLab Runner to trust the certificate: + - If you are using systemd to manage GitLab Runner, see [how to add an environment variable for GitLab Runner](https://docs.gitlab.com/runner/configuration/init.html#setting-custom-environment-variables). + - If you deployed GitLab Runner using the [Helm chart](https://docs.gitlab.com/runner/install/kubernetes.html): + 1. [Provide a custom certificate for accessing GitLab](https://docs.gitlab.com/runner/install/kubernetes.html#providing-a-custom-certificate-for-accessing-gitlab), and make sure to add the certificate for the Vault server instead of the certificate for GitLab. If your GitLab instance is also using a self-signed certificate, you should be able to add both in the same `Secret`. + 1. Add the following lines in your `values.yaml` file: + + ```yaml + ## Replace both the <SECRET_NAME> and the <VAULT_CERTIFICATE> + ## with the actual values you used to create the secret + + certsSecretName: <SECRET_NAME> + + envVars: + - name: VAULT_CACERT + value: "/home/gitlab-runner/.gitlab-runner/certs/<VAULT_CERTIFICATE>" + ``` |