GitLab Community Edition JWT Integration with Hashicorp Vault

This document describes how to configure Hashicorp Vault to authenticate with GitLab Community Edition using JWT.

Prerequisites

• Hashicorp Vault
• GitLab Community Edition

Vault Configuration

Enable JWT Auth Method

First, enable the JWT auth method in Vault:

vault auth enable jwt -path jwt_gitlab

Configure JWT Auth Method

Next, configure the JWT auth method to use GitLab's OIDC discovery URL:

vault write auth/jwt_gitlab/config \
  oidc_discovery_url="https://git.styrion.net" \
  bound_issuer="https://git.styrion.net" \
  default_role="gitlab-reader"

Create a Role

Create a role that defines the policies for authenticated users:

vault write auth/jwt_gitlab/role/gitlab-reader - <<EOF
{
  "role_type": "jwt",
  "policies": ["gitlab"],
  "token_explicit_max_ttl": 600,
  "user_claim": "user_email",
  "bound_audiences": "https://vault.iteas.cloud",
  "bound_claims_type": "glob",
  "bound_claims": {
    "project_path": "iteas/*"
  },
  "token_no_default_policy": true
}
EOF

Create a Policy

Create a policy that defines the policies for authenticated users:

Create gitlab.hcl:

path "secret/data/gitlab/*" {
  capabilities = ["read"]
}

Apply policy:

vault policy write gitlab gitlab.hcl

GitLab CI/CD Example Configuration

In your .gitlab-ci.yml, you can use the following snippet to authenticate with Vault:

stages:
  - testtoken

variables:
  VAULT_ADDR: "https://vault.iteas.cloud"

build-job:
  stage: testtoken
  id_tokens:
    VAULT_ID_TOKEN:
      aud: https://vault.iteas.cloud
  script:
    - echo "ID Token content..."
    - echo $VAULT_ID_TOKEN | cut -d. -f2 | base64 -d || true
    - echo "Authenticating with Vault..."
    - vault write auth/jwt_gitlab/login jwt=$VAULT_ID_TOKEN
    - export VAULT_TOKEN=$(vault write -field=token auth/jwt_gitlab/login jwt=$VAULT_ID_TOKEN)
    - vault kv get secret/gitlab/test
  tags:
    - 'build-docker01'
  image: hashicorp/vault:1.21

Conclusion

This setup allows you to securely authenticate and authorize GitLab CI/CD jobs with Hashicorp Vault using JWT.