[{"data":1,"prerenderedAt":1890},["ShallowReactive",2],{"/blog/gitlab-secrets-manager-add-eso-terraform-api-support":3,"navigation-en-us":1097,"banner-en-us":1525,"footer-en-us":1535,"blog-post-authors-en-us-Erick Bajao|Joe Randazzo":1780,"blog-related-posts-en-us-gitlab-secrets-manager-add-eso-terraform-api-support":1806,"blog-promotions-en-us":1828,"next-steps-en-us":1880},{"id":4,"title":5,"authors":6,"body":9,"category":1079,"date":1080,"description":1081,"extension":1082,"externalUrl":1083,"faq":1083,"featured":191,"heroImage":1084,"meta":1085,"navigation":191,"path":1086,"seo":1087,"slug":1090,"stem":1091,"tags":1092,"template":1095,"updatedDate":1083,"__hash__":1096},"blogPosts/en-us/blog/gitlab-secrets-manager-add-eso-terraform-api-support.md","GitLab Secrets Manager adds ESO, Terraform, API support",[7,8],"Erick Bajao","Joe Randazzo",{"type":10,"value":11,"toc":1072},"minimark",[12,16,26,50,55,58,65,74,85,94,97,103,112,116,126,437,445,449,452,577,581,588,1034,1038,1046,1055,1068],[13,14,15],"p",{},"Today, you might maintain separate secret stores for CI/CD, Kubernetes, and Terraform. However, that leaves multiple tools to manage, access models to keep in sync, and audit trails to correlate when something goes wrong.",[13,17,18,19,25],{},"GitLab Secrets Manager now supports External Secrets Operator (ESO) and Terraform, extending ",[20,21,24],"a",{"href":22,"rel":23},"https://docs.gitlab.com/ci/secrets/secrets_manager/non_cicd_access/",[],"secure secret retrieval beyond CI/CD pipelines",". Powered by OpenBao, GitLab Secrets Manager provides a single source of truth for secrets across your software delivery chain. You can now use the same secret store for:",[27,28,29,33,36,39,42],"ul",{},[30,31,32],"li",{},"Kubernetes workloads via ESO",[30,34,35],{},"Terraform or OpenTofu Runs",[30,37,38],{},"OpenBao or Vault CLI",[30,40,41],{},"CI/CD Jobs in GitLab (as of Version 19.0)",[30,43,44,45],{},"Any external automation through the ",[20,46,49],{"href":47,"rel":48},"https://docs.gitlab.com/api/secrets_manager/",[],"Secrets Manager API",[51,52,54],"h3",{"id":53},"kubernetes-external-secrets-operator","Kubernetes: External Secrets Operator",[13,56,57],{},"ESO syncs secrets from GitLab Secrets Manager using the Vault provider. A workload in your cluster holds a short-lived JSON Web Token (JWT) that ESO uses to authenticate with OpenBao and writes the secret into a Kubernetes Secret.",[13,59,60],{},[61,62],"img",{"alt":63,"src":64},"External Secrets Operator","https://res.cloudinary.com/about-gitlab-com/image/upload/v1785953823/ojlr4rv1r34oflo4fynv.png",[13,66,67,68,73],{},"A ",[20,69,72],{"href":70,"rel":71},"https://external-secrets.io/latest/api/secretstore/",[],"SecretStore"," tells ESO where to fetch secrets from and how to authenticate. GitLab Secrets Manager exposes a Vault-compatible KV v2 API and you configure it using the Vault provider. The namespace field maps to your GitLab hierarchy (organization, group, project) and scopes which secrets this store can reach. Authentication uses a GitLab-minted JWT held in a Kubernetes secret, referenced by secretRef.",[75,76,81],"pre",{"className":77,"code":79,"language":80},[78],"language-text","apiVersion: external-secrets.io/v1\nkind: SecretStore\nmetadata:\n  name: gitlab-secrets-manager\n  namespace: my-app\nspec:\n  provider:\n    vault:\n      server: https://secrets.gitlab.com      # provider.vault.server\n      path: secrets/kv                        # provider.vault.path\n      version: v2\n      namespace: org_5/group_42/project_99    # provider.vault.namespace\n      auth:\n        jwt:\n          path: api_jwt/cel                   # provider.vault.auth.jwt.path\n          role: all_api                       # provider.vault.auth.jwt.role\n          secretRef:\n            name: gitlab-access-token         # Kubernetes secret holding the minted token\n            key: token\n","text",[82,83,79],"code",{"__ignoreMap":84},"",[13,86,87,88,93],{},"An ",[20,89,92],{"href":90,"rel":91},"https://external-secrets.io/latest/api/externalsecret/",[],"ExternalSecret"," defines which secrets to pull and where to put them. It references the SecretStore you created above, then maps remote secrets into a Kubernetes secret that your workloads can mount or reference as environment variables.",[13,95,96],{},"ESO creates and owns the target secret (synced-secret), re-fetching from GitLab every refreshInterval so rotated values propagate without a redeploy. Each entry under data maps one remote secret to one key in the target: remoteRef.key is the path in GitLab Secrets Manager, property selects a field within that secret, and secretKey is the key it lands under in Kubernetes.",[75,98,101],{"className":99,"code":100,"language":80},[78],"apiVersion: external-secrets.io/v1\nkind: ExternalSecret\nmetadata:\n  name: my-secret\n  namespace: my-app\nspec:\n  refreshInterval: 45m\n  secretStoreRef:\n    name: gitlab-secrets-manager\n    kind: SecretStore\n  target:\n    name: synced-secret\n  data:\n    - secretKey: value\n      remoteRef:\n        key: explicit/\u003Csecret_name>           # \u003Csecrets_path>/\u003Csecret_name>\n        property: value\n",[82,102,100],{"__ignoreMap":84},[13,104,105,106,111],{},"Check out the ",[20,107,110],{"href":108,"rel":109},"https://gitlab.com/guided-explorations/secrets-management/gitlab-secrets-manager-with-eso-and-k3s",[],"tutorial"," with GitLab Secrets Manager and ESO.",[51,113,115],{"id":114},"infrastructure-as-code-terraform-and-opentofu","Infrastructure as code: Terraform and OpenTofu",[13,117,118,119,122,123,125],{},"Terraform state and ",[82,120,121],{},".tfvars"," files are a common source of leaked credentials because secrets end up written to disk or checked into version control by accident. Terraform can avoid that by reading a GitLab secret as a data source, authenticating with a minted JWT at plan or apply time. Reference credentials using Terraform directly where nothing gets stored in ",[82,124,121],{}," files or CI/CD variables.",[75,127,131],{"className":128,"code":129,"language":130,"meta":84,"style":84},"language-shell shiki shiki-themes github-light","data \"external\" \"gitlab_secrets_token\" {\n  program = [\"bash\", \"${path.module}/scripts/mint_token.sh\"]\n\n  query = {\n    project_id = var.gitlab_project_id\n  }\n}\n\nprovider \"vault\" {\n  address   = data.external.gitlab_secrets_token.result.server\n  namespace = data.external.gitlab_secrets_token.result.namespace\n\n  auth_login_jwt {\n    mount = data.external.gitlab_secrets_token.result.auth_path\n    role  = data.external.gitlab_secrets_token.result.role\n    jwt   = data.external.gitlab_secrets_token.result.jwt\n  }\n}\n\ndata \"vault_kv_secret_v2\" \"my_secret\" {\n  mount = data.external.gitlab_secrets_token.result.mount\n  name  = \"${data.external.gitlab_secrets_token.result.secrets_path}/\u003Csecret_name>\"\n}\n\noutput \"secret_value\" {\n  value     = data.vault_kv_secret_v2.my_secret.data[\"value\"]\n  sensitive = true\n}\n","shell",[82,132,133,152,186,193,203,214,220,226,231,242,254,265,270,278,289,301,312,317,322,327,340,351,387,392,397,408,420,432],{"__ignoreMap":84},[134,135,138,142,146,149],"span",{"class":136,"line":137},"line",1,[134,139,141],{"class":140},"s7eDp","data",[134,143,145],{"class":144},"sYBdl"," \"external\"",[134,147,148],{"class":144}," \"gitlab_secrets_token\"",[134,150,151],{"class":144}," {\n",[134,153,155,158,161,165,168,171,174,177,180,183],{"class":136,"line":154},2,[134,156,157],{"class":140},"  program",[134,159,160],{"class":144}," =",[134,162,164],{"class":163},"sgsFI"," [",[134,166,167],{"class":144},"\"bash\"",[134,169,170],{"class":163},", ",[134,172,173],{"class":144},"\"${",[134,175,176],{"class":163},"path",[134,178,179],{"class":144},".",[134,181,182],{"class":163},"module",[134,184,185],{"class":144},"}/scripts/mint_token.sh\"]\n",[134,187,189],{"class":136,"line":188},3,[134,190,192],{"emptyLinePlaceholder":191},true,"\n",[134,194,196,199,201],{"class":136,"line":195},4,[134,197,198],{"class":140},"  query",[134,200,160],{"class":144},[134,202,151],{"class":144},[134,204,206,209,211],{"class":136,"line":205},5,[134,207,208],{"class":140},"    project_id",[134,210,160],{"class":144},[134,212,213],{"class":144}," var.gitlab_project_id\n",[134,215,217],{"class":136,"line":216},6,[134,218,219],{"class":163},"  }\n",[134,221,223],{"class":136,"line":222},7,[134,224,225],{"class":163},"}\n",[134,227,229],{"class":136,"line":228},8,[134,230,192],{"emptyLinePlaceholder":191},[134,232,234,237,240],{"class":136,"line":233},9,[134,235,236],{"class":140},"provider",[134,238,239],{"class":144}," \"vault\"",[134,241,151],{"class":144},[134,243,245,248,251],{"class":136,"line":244},10,[134,246,247],{"class":140},"  address",[134,249,250],{"class":144},"   =",[134,252,253],{"class":144}," data.external.gitlab_secrets_token.result.server\n",[134,255,257,260,262],{"class":136,"line":256},11,[134,258,259],{"class":140},"  namespace",[134,261,160],{"class":144},[134,263,264],{"class":144}," data.external.gitlab_secrets_token.result.namespace\n",[134,266,268],{"class":136,"line":267},12,[134,269,192],{"emptyLinePlaceholder":191},[134,271,273,276],{"class":136,"line":272},13,[134,274,275],{"class":140},"  auth_login_jwt",[134,277,151],{"class":144},[134,279,281,284,286],{"class":136,"line":280},14,[134,282,283],{"class":140},"    mount",[134,285,160],{"class":144},[134,287,288],{"class":144}," data.external.gitlab_secrets_token.result.auth_path\n",[134,290,292,295,298],{"class":136,"line":291},15,[134,293,294],{"class":140},"    role",[134,296,297],{"class":144},"  =",[134,299,300],{"class":144}," data.external.gitlab_secrets_token.result.role\n",[134,302,304,307,309],{"class":136,"line":303},16,[134,305,306],{"class":140},"    jwt",[134,308,250],{"class":144},[134,310,311],{"class":144}," data.external.gitlab_secrets_token.result.jwt\n",[134,313,315],{"class":136,"line":314},17,[134,316,219],{"class":163},[134,318,320],{"class":136,"line":319},18,[134,321,225],{"class":163},[134,323,325],{"class":136,"line":324},19,[134,326,192],{"emptyLinePlaceholder":191},[134,328,330,332,335,338],{"class":136,"line":329},20,[134,331,141],{"class":140},[134,333,334],{"class":144}," \"vault_kv_secret_v2\"",[134,336,337],{"class":144}," \"my_secret\"",[134,339,151],{"class":144},[134,341,343,346,348],{"class":136,"line":342},21,[134,344,345],{"class":140},"  mount",[134,347,160],{"class":144},[134,349,350],{"class":144}," data.external.gitlab_secrets_token.result.mount\n",[134,352,354,357,359,362,364,366,369,371,374,376,379,381,384],{"class":136,"line":353},22,[134,355,356],{"class":140},"  name",[134,358,297],{"class":144},[134,360,361],{"class":144}," \"${",[134,363,141],{"class":163},[134,365,179],{"class":144},[134,367,368],{"class":163},"external",[134,370,179],{"class":144},[134,372,373],{"class":163},"gitlab_secrets_token",[134,375,179],{"class":144},[134,377,378],{"class":163},"result",[134,380,179],{"class":144},[134,382,383],{"class":163},"secrets_path",[134,385,386],{"class":144},"}/\u003Csecret_name>\"\n",[134,388,390],{"class":136,"line":389},23,[134,391,225],{"class":163},[134,393,395],{"class":136,"line":394},24,[134,396,192],{"emptyLinePlaceholder":191},[134,398,400,403,406],{"class":136,"line":399},25,[134,401,402],{"class":140},"output",[134,404,405],{"class":144}," \"secret_value\"",[134,407,151],{"class":144},[134,409,411,414,417],{"class":136,"line":410},26,[134,412,413],{"class":140},"  value",[134,415,416],{"class":144},"     =",[134,418,419],{"class":144}," data.vault_kv_secret_v2.my_secret.data[\"value\"]\n",[134,421,423,426,428],{"class":136,"line":422},27,[134,424,425],{"class":140},"  sensitive",[134,427,160],{"class":144},[134,429,431],{"class":430},"sYu0t"," true\n",[134,433,435],{"class":136,"line":434},28,[134,436,225],{"class":163},[13,438,439,440,179],{},"Learn more about how to ",[20,441,444],{"href":442,"rel":443},"https://docs.gitlab.com/ci/secrets/secrets_manager/non_cicd_access/#use-with-terraform",[],"read secrets in Terraform",[51,446,448],{"id":447},"command-line-openbao-or-vault-cli","Command line: OpenBao or Vault CLI",[13,450,451],{},"Not every workflow goes through the API directly. If your team already scripts against Vault-compatible tooling, the OpenBao or Vault CLI reads secrets from GitLab Secrets Manager the same way it reads from Vault.",[75,453,455],{"className":128,"code":454,"language":130,"meta":84,"style":84},"export VAULT_ADDR=\"\u003Cserver>\"\nexport VAULT_NAMESPACE=\"\u003Cnamespace>\"\n\n# Exchange the minted JWT for an OpenBao token, then export it.\nvault write \"auth/\u003Cauth_jwt_path>/login\" role=\u003Crole> jwt=\u003Ctoken>\nexport VAULT_TOKEN=\"\u003Cclient_token>\"\n\n# Read the secret value.\nvault kv get -mount=\u003Cpath> \"\u003Csecrets_path>/\u003Csecret_name>\"\n",[82,456,457,472,484,488,494,534,546,550,555],{"__ignoreMap":84},[134,458,459,463,466,469],{"class":136,"line":137},[134,460,462],{"class":461},"sD7c4","export",[134,464,465],{"class":163}," VAULT_ADDR",[134,467,468],{"class":461},"=",[134,470,471],{"class":144},"\"\u003Cserver>\"\n",[134,473,474,476,479,481],{"class":136,"line":154},[134,475,462],{"class":461},[134,477,478],{"class":163}," VAULT_NAMESPACE",[134,480,468],{"class":461},[134,482,483],{"class":144},"\"\u003Cnamespace>\"\n",[134,485,486],{"class":136,"line":188},[134,487,192],{"emptyLinePlaceholder":191},[134,489,490],{"class":136,"line":195},[134,491,493],{"class":492},"sAwPA","# Exchange the minted JWT for an OpenBao token, then export it.\n",[134,495,496,499,502,505,508,511,514,517,520,523,525,528,531],{"class":136,"line":205},[134,497,498],{"class":140},"vault",[134,500,501],{"class":144}," write",[134,503,504],{"class":144}," \"auth/\u003Cauth_jwt_path>/login\"",[134,506,507],{"class":144}," role=",[134,509,510],{"class":461},"\u003C",[134,512,513],{"class":144},"rol",[134,515,516],{"class":163},"e",[134,518,519],{"class":461},">",[134,521,522],{"class":144}," jwt=",[134,524,510],{"class":461},[134,526,527],{"class":144},"toke",[134,529,530],{"class":163},"n",[134,532,533],{"class":461},">\n",[134,535,536,538,541,543],{"class":136,"line":216},[134,537,462],{"class":461},[134,539,540],{"class":163}," VAULT_TOKEN",[134,542,468],{"class":461},[134,544,545],{"class":144},"\"\u003Cclient_token>\"\n",[134,547,548],{"class":136,"line":222},[134,549,192],{"emptyLinePlaceholder":191},[134,551,552],{"class":136,"line":228},[134,553,554],{"class":492},"# Read the secret value.\n",[134,556,557,559,562,565,568,570,572,574],{"class":136,"line":233},[134,558,498],{"class":140},[134,560,561],{"class":144}," kv",[134,563,564],{"class":144}," get",[134,566,567],{"class":430}," -mount=",[134,569,510],{"class":461},[134,571,176],{"class":430},[134,573,519],{"class":461},[134,575,576],{"class":144}," \"\u003Csecrets_path>/\u003Csecret_name>\"\n",[51,578,580],{"id":579},"when-to-use-the-secrets-manager-api","When to use the Secrets Manager API",[13,582,583,584,587],{},"For automation that doesn't fit GitLab CI/CD, Kubernetes, or Terraform, the ",[20,585,49],{"href":47,"rel":586},[]," lets any external system fetch secrets from the Secrets Manager, instead of hardcoding credentials or maintaining separate var files.",[75,589,591],{"className":128,"code":590,"language":130,"meta":84,"style":84},"# Request JWT token using Service Account\nRESPONSE=$(curl --silent --request POST \\\n  --header \"PRIVATE-TOKEN: \u003Cyour_access_token>\" \\\n  --url \"https://gitlab.example.com/api/v4/projects/\u003Cproject_id>/secrets_manager/access_token\")\n\nSERVER=$(echo \"$RESPONSE\" | jq --raw-output .provider.vault.server)\nNAMESPACE=$(echo \"$RESPONSE\" | jq --raw-output .provider.vault.namespace)\nMOUNT=$(echo \"$RESPONSE\" | jq --raw-output .provider.vault.path)\nSECRETS_PATH=$(echo \"$RESPONSE\" | jq --raw-output .provider.vault.secrets_path)\nAUTH_PATH=$(echo \"$RESPONSE\" | jq --raw-output .provider.vault.auth.jwt.path)\nROLE=$(echo \"$RESPONSE\" | jq --raw-output .provider.vault.auth.jwt.role)\nJWT=$(echo \"$RESPONSE\" | jq --raw-output .provider.vault.auth.jwt.token)\n\n# Exchange the JWT for a short-lived OpenBao token.\nVAULT_TOKEN=$(curl --silent --request POST \\\n  --header \"X-Vault-Namespace: $NAMESPACE\" \\\n  --data \"{\\\"role\\\":\\\"$ROLE\\\",\\\"jwt\\\":\\\"$JWT\\\"}\" \\\n  \"$SERVER/v1/auth/$AUTH_PATH/login\" | jq --raw-output .auth.client_token)\n\n# Read the secret value.\ncurl --silent \\\n  --header \"X-Vault-Token: $VAULT_TOKEN\" \\\n  --header \"X-Vault-Namespace: $NAMESPACE\" \\\n  \"$SERVER/v1/$MOUNT/data/$SECRETS_PATH/\u003Csecret_name>\"\n",[82,592,593,598,623,633,644,648,683,711,739,767,795,823,851,855,860,879,893,943,971,975,979,987,1001,1013],{"__ignoreMap":84},[134,594,595],{"class":136,"line":137},[134,596,597],{"class":492},"# Request JWT token using Service Account\n",[134,599,600,603,605,608,611,614,617,620],{"class":136,"line":154},[134,601,602],{"class":163},"RESPONSE",[134,604,468],{"class":461},[134,606,607],{"class":163},"$(",[134,609,610],{"class":140},"curl",[134,612,613],{"class":430}," --silent",[134,615,616],{"class":430}," --request",[134,618,619],{"class":144}," POST",[134,621,622],{"class":430}," \\\n",[134,624,625,628,631],{"class":136,"line":188},[134,626,627],{"class":430},"  --header",[134,629,630],{"class":144}," \"PRIVATE-TOKEN: \u003Cyour_access_token>\"",[134,632,622],{"class":430},[134,634,635,638,641],{"class":136,"line":195},[134,636,637],{"class":430},"  --url",[134,639,640],{"class":144}," \"https://gitlab.example.com/api/v4/projects/\u003Cproject_id>/secrets_manager/access_token\"",[134,642,643],{"class":163},")\n",[134,645,646],{"class":136,"line":205},[134,647,192],{"emptyLinePlaceholder":191},[134,649,650,653,655,657,660,663,666,669,672,675,678,681],{"class":136,"line":216},[134,651,652],{"class":163},"SERVER",[134,654,468],{"class":461},[134,656,607],{"class":163},[134,658,659],{"class":430},"echo",[134,661,662],{"class":144}," \"",[134,664,665],{"class":163},"$RESPONSE",[134,667,668],{"class":144},"\"",[134,670,671],{"class":461}," |",[134,673,674],{"class":140}," jq",[134,676,677],{"class":430}," --raw-output",[134,679,680],{"class":144}," .provider.vault.server",[134,682,643],{"class":163},[134,684,685,688,690,692,694,696,698,700,702,704,706,709],{"class":136,"line":222},[134,686,687],{"class":163},"NAMESPACE",[134,689,468],{"class":461},[134,691,607],{"class":163},[134,693,659],{"class":430},[134,695,662],{"class":144},[134,697,665],{"class":163},[134,699,668],{"class":144},[134,701,671],{"class":461},[134,703,674],{"class":140},[134,705,677],{"class":430},[134,707,708],{"class":144}," .provider.vault.namespace",[134,710,643],{"class":163},[134,712,713,716,718,720,722,724,726,728,730,732,734,737],{"class":136,"line":228},[134,714,715],{"class":163},"MOUNT",[134,717,468],{"class":461},[134,719,607],{"class":163},[134,721,659],{"class":430},[134,723,662],{"class":144},[134,725,665],{"class":163},[134,727,668],{"class":144},[134,729,671],{"class":461},[134,731,674],{"class":140},[134,733,677],{"class":430},[134,735,736],{"class":144}," .provider.vault.path",[134,738,643],{"class":163},[134,740,741,744,746,748,750,752,754,756,758,760,762,765],{"class":136,"line":233},[134,742,743],{"class":163},"SECRETS_PATH",[134,745,468],{"class":461},[134,747,607],{"class":163},[134,749,659],{"class":430},[134,751,662],{"class":144},[134,753,665],{"class":163},[134,755,668],{"class":144},[134,757,671],{"class":461},[134,759,674],{"class":140},[134,761,677],{"class":430},[134,763,764],{"class":144}," .provider.vault.secrets_path",[134,766,643],{"class":163},[134,768,769,772,774,776,778,780,782,784,786,788,790,793],{"class":136,"line":244},[134,770,771],{"class":163},"AUTH_PATH",[134,773,468],{"class":461},[134,775,607],{"class":163},[134,777,659],{"class":430},[134,779,662],{"class":144},[134,781,665],{"class":163},[134,783,668],{"class":144},[134,785,671],{"class":461},[134,787,674],{"class":140},[134,789,677],{"class":430},[134,791,792],{"class":144}," .provider.vault.auth.jwt.path",[134,794,643],{"class":163},[134,796,797,800,802,804,806,808,810,812,814,816,818,821],{"class":136,"line":256},[134,798,799],{"class":163},"ROLE",[134,801,468],{"class":461},[134,803,607],{"class":163},[134,805,659],{"class":430},[134,807,662],{"class":144},[134,809,665],{"class":163},[134,811,668],{"class":144},[134,813,671],{"class":461},[134,815,674],{"class":140},[134,817,677],{"class":430},[134,819,820],{"class":144}," .provider.vault.auth.jwt.role",[134,822,643],{"class":163},[134,824,825,828,830,832,834,836,838,840,842,844,846,849],{"class":136,"line":267},[134,826,827],{"class":163},"JWT",[134,829,468],{"class":461},[134,831,607],{"class":163},[134,833,659],{"class":430},[134,835,662],{"class":144},[134,837,665],{"class":163},[134,839,668],{"class":144},[134,841,671],{"class":461},[134,843,674],{"class":140},[134,845,677],{"class":430},[134,847,848],{"class":144}," .provider.vault.auth.jwt.token",[134,850,643],{"class":163},[134,852,853],{"class":136,"line":272},[134,854,192],{"emptyLinePlaceholder":191},[134,856,857],{"class":136,"line":280},[134,858,859],{"class":492},"# Exchange the JWT for a short-lived OpenBao token.\n",[134,861,862,865,867,869,871,873,875,877],{"class":136,"line":291},[134,863,864],{"class":163},"VAULT_TOKEN",[134,866,468],{"class":461},[134,868,607],{"class":163},[134,870,610],{"class":140},[134,872,613],{"class":430},[134,874,616],{"class":430},[134,876,619],{"class":144},[134,878,622],{"class":430},[134,880,881,883,886,889,891],{"class":136,"line":303},[134,882,627],{"class":430},[134,884,885],{"class":144}," \"X-Vault-Namespace: ",[134,887,888],{"class":163},"$NAMESPACE",[134,890,668],{"class":144},[134,892,622],{"class":430},[134,894,895,898,901,904,907,909,912,914,917,919,922,924,927,929,931,933,936,938,941],{"class":136,"line":314},[134,896,897],{"class":430},"  --data",[134,899,900],{"class":144}," \"{",[134,902,903],{"class":430},"\\\"",[134,905,906],{"class":144},"role",[134,908,903],{"class":430},[134,910,911],{"class":144},":",[134,913,903],{"class":430},[134,915,916],{"class":163},"$ROLE",[134,918,903],{"class":430},[134,920,921],{"class":144},",",[134,923,903],{"class":430},[134,925,926],{"class":144},"jwt",[134,928,903],{"class":430},[134,930,911],{"class":144},[134,932,903],{"class":430},[134,934,935],{"class":163},"$JWT",[134,937,903],{"class":430},[134,939,940],{"class":144},"}\"",[134,942,622],{"class":430},[134,944,945,948,951,954,957,960,962,964,966,969],{"class":136,"line":319},[134,946,947],{"class":144},"  \"",[134,949,950],{"class":163},"$SERVER",[134,952,953],{"class":144},"/v1/auth/",[134,955,956],{"class":163},"$AUTH_PATH",[134,958,959],{"class":144},"/login\"",[134,961,671],{"class":461},[134,963,674],{"class":140},[134,965,677],{"class":430},[134,967,968],{"class":144}," .auth.client_token",[134,970,643],{"class":163},[134,972,973],{"class":136,"line":324},[134,974,192],{"emptyLinePlaceholder":191},[134,976,977],{"class":136,"line":329},[134,978,554],{"class":492},[134,980,981,983,985],{"class":136,"line":342},[134,982,610],{"class":140},[134,984,613],{"class":430},[134,986,622],{"class":430},[134,988,989,991,994,997,999],{"class":136,"line":353},[134,990,627],{"class":430},[134,992,993],{"class":144}," \"X-Vault-Token: ",[134,995,996],{"class":163},"$VAULT_TOKEN",[134,998,668],{"class":144},[134,1000,622],{"class":430},[134,1002,1003,1005,1007,1009,1011],{"class":136,"line":389},[134,1004,627],{"class":430},[134,1006,885],{"class":144},[134,1008,888],{"class":163},[134,1010,668],{"class":144},[134,1012,622],{"class":430},[134,1014,1015,1017,1019,1022,1025,1028,1031],{"class":136,"line":394},[134,1016,947],{"class":144},[134,1018,950],{"class":163},[134,1020,1021],{"class":144},"/v1/",[134,1023,1024],{"class":163},"$MOUNT",[134,1026,1027],{"class":144},"/data/",[134,1029,1030],{"class":163},"$SECRETS_PATH",[134,1032,1033],{"class":144},"/\u003Csecret_name>\"\n",[51,1035,1037],{"id":1036},"get-started","Get started",[13,1039,1040,1045],{},[20,1041,1044],{"href":1042,"rel":1043},"https://about.gitlab.com/blog/secrets-manager-in-public-beta/",[],"GitLab Secrets Manager is in public beta"," for Premium and Ultimate customers. Secret access using ESO, Terraform, or the API are currently available on GitLab.com and GitLab Self-Managed, with GitLab Dedicated coming soon.",[13,1047,1048,1049,1054],{},"Secrets Manager is free during the beta period. When generally available, it will be a paid feature billed through ",[20,1050,1053],{"href":1051,"rel":1052},"https://docs.gitlab.com/subscriptions/gitlab_credits/",[],"GitLab Credits",". You'll need to opt in before anything is charged, and we'll give you advance notice.",[13,1056,1057,1061,1062,1067],{},[20,1058,1060],{"href":22,"rel":1059},[],"Read the documentation"," to get started. If you find a gap or have a request, ",[20,1063,1066],{"href":1064,"rel":1065},"https://gitlab.com/gitlab-org/gitlab/-/work_items/598100",[],"comment in this issue"," — we're gathering feedback ahead of general availability.",[1069,1070,1071],"style",{},"html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}",{"title":84,"searchDepth":154,"depth":154,"links":1073},[1074,1075,1076,1077,1078],{"id":53,"depth":188,"text":54},{"id":114,"depth":188,"text":115},{"id":447,"depth":188,"text":448},{"id":579,"depth":188,"text":580},{"id":1036,"depth":188,"text":1037},"security","2026-08-06","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","md",null,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png",{},"/en-us/blog/gitlab-secrets-manager-add-eso-terraform-api-support",{"config":1088,"title":5,"description":1081},{"noIndex":1089},false,"gitlab-secrets-manager-add-eso-terraform-api-support","en-us/blog/gitlab-secrets-manager-add-eso-terraform-api-support",[1079,1093,1094],"features","product","BlogPost","bJjxdJxJr2jHr595u_nGEEddhv4q_mr3VJgJxSYuFlg",{"logo":1098,"freeTrial":1103,"sales":1108,"login":1113,"items":1118,"search":1445,"minimal":1476,"duo":1495,"switchNav":1504,"pricingDeployment":1515},{"config":1099},{"href":1100,"dataGaName":1101,"dataGaLocation":1102},"/","gitlab logo","header",{"text":1104,"config":1105},"Get free trial",{"href":1106,"dataGaName":1107,"dataGaLocation":1102},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":1109,"config":1110},"Request a demo",{"href":1111,"dataGaName":1112,"dataGaLocation":1102},"/sales/?contact-topic=request-demo","sales",{"text":1114,"config":1115},"Sign in",{"href":1116,"dataGaName":1117,"dataGaLocation":1102},"https://gitlab.com/users/sign_in/","sign in",[1119,1148,1248,1253,1367,1423],{"text":1120,"config":1121,"menu":1123},"Platform",{"dataNavLevelOne":1122},"platform",{"type":1124,"columns":1125},"cards",[1126,1132,1140],{"title":1120,"description":1127,"link":1128},"The intelligent orchestration platform for DevSecOps",{"text":1129,"config":1130},"Explore our Platform",{"href":1131,"dataGaName":1122,"dataGaLocation":1102},"/platform/",{"title":1133,"description":1134,"link":1135},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":1136,"config":1137},"Meet GitLab Duo",{"href":1138,"dataGaName":1139,"dataGaLocation":1102},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1141,"description":1142,"link":1143},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":1144,"config":1145},"Learn more",{"href":1146,"dataGaName":1147,"dataGaLocation":1102},"/why-gitlab/","why gitlab",{"text":1149,"left":191,"config":1150,"menu":1152},"Product",{"dataNavLevelOne":1151},"solutions",{"type":1153,"link":1154,"columns":1158,"feature":1227},"lists",{"text":1155,"config":1156},"View all Solutions",{"href":1157,"dataGaName":1151,"dataGaLocation":1102},"/solutions/",[1159,1183,1206],{"title":1160,"description":1161,"link":1162,"items":1167},"Automation","CI/CD and automation to accelerate deployment",{"config":1163},{"icon":1164,"href":1165,"dataGaName":1166,"dataGaLocation":1102},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[1168,1172,1175,1179],{"text":1169,"config":1170},"CI/CD",{"href":1171,"dataGaLocation":1102,"dataGaName":1169},"/solutions/continuous-integration/",{"text":1133,"config":1173},{"href":1138,"dataGaLocation":1102,"dataGaName":1174},"gitlab duo agent platform - product menu",{"text":1176,"config":1177},"Source Code Management",{"href":1178,"dataGaLocation":1102,"dataGaName":1176},"/solutions/source-code-management/",{"text":1180,"config":1181},"Automated Software Delivery",{"href":1165,"dataGaLocation":1102,"dataGaName":1182},"Automated software delivery",{"title":1184,"description":1185,"link":1186,"items":1191},"Security","Deliver code faster without compromising security",{"config":1187},{"href":1188,"dataGaName":1189,"dataGaLocation":1102,"icon":1190},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1192,1196,1201],{"text":1193,"config":1194},"Application Security Testing",{"href":1188,"dataGaName":1195,"dataGaLocation":1102},"Application security testing",{"text":1197,"config":1198},"Software Supply Chain Security",{"href":1199,"dataGaLocation":1102,"dataGaName":1200},"/solutions/supply-chain/","Software supply chain security",{"text":1202,"config":1203},"Software Compliance",{"href":1204,"dataGaName":1205,"dataGaLocation":1102},"/solutions/software-compliance/","software compliance",{"title":1207,"link":1208,"items":1213},"Measurement",{"config":1209},{"icon":1210,"href":1211,"dataGaName":1212,"dataGaLocation":1102},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[1214,1218,1222],{"text":1215,"config":1216},"Visibility & Measurement",{"href":1211,"dataGaLocation":1102,"dataGaName":1217},"Visibility and Measurement",{"text":1219,"config":1220},"Value Stream Management",{"href":1221,"dataGaLocation":1102,"dataGaName":1219},"/solutions/value-stream-management/",{"text":1223,"config":1224},"Analytics & Insights",{"href":1225,"dataGaLocation":1102,"dataGaName":1226},"/solutions/analytics-and-insights/","Analytics and insights",{"title":1228,"type":1153,"items":1229},"GitLab for",[1230,1236,1242],{"text":1231,"config":1232},"Enterprise",{"icon":1233,"href":1234,"dataGaLocation":1102,"dataGaName":1235},"Building","/enterprise/","enterprise",{"text":1237,"config":1238},"Small Business",{"icon":1239,"href":1240,"dataGaLocation":1102,"dataGaName":1241},"Work","/small-business/","small business",{"text":1243,"config":1244},"Public Sector",{"icon":1245,"href":1246,"dataGaLocation":1102,"dataGaName":1247},"Organization","/solutions/public-sector/","public sector",{"text":1249,"config":1250},"Pricing",{"href":1251,"dataGaName":1252,"dataGaLocation":1102,"dataNavLevelOne":1252},"/pricing/","pricing",{"text":1254,"config":1255,"menu":1257},"Resources",{"dataNavLevelOne":1256},"resources",{"type":1153,"link":1258,"columns":1262,"feature":1356},{"text":1259,"config":1260},"View all resources",{"href":1261,"dataGaName":1256,"dataGaLocation":1102},"/resources/",[1263,1296,1323],{"title":1264,"items":1265},"Getting started",[1266,1271,1276,1281,1286,1291],{"text":1267,"config":1268},"Install",{"href":1269,"dataGaName":1270,"dataGaLocation":1102},"/install/","install",{"text":1272,"config":1273},"Quick start guides",{"href":1274,"dataGaName":1275,"dataGaLocation":1102},"/get-started/","quick setup checklists",{"text":1277,"config":1278},"Learn",{"href":1279,"dataGaLocation":1102,"dataGaName":1280},"https://university.gitlab.com/","learn",{"text":1282,"config":1283},"Product documentation",{"href":1284,"dataGaName":1285,"dataGaLocation":1102},"https://docs.gitlab.com/","product documentation",{"text":1287,"config":1288},"Best practice videos",{"href":1289,"dataGaName":1290,"dataGaLocation":1102},"/getting-started-videos/","best practice videos",{"text":1292,"config":1293},"Integrations",{"href":1294,"dataGaName":1295,"dataGaLocation":1102},"/integrations/","integrations",{"title":1297,"items":1298},"Discover",[1299,1304,1309,1314,1318],{"text":1300,"config":1301},"Customer success stories",{"href":1302,"dataGaName":1303,"dataGaLocation":1102},"/customers/","customer success stories",{"text":1305,"config":1306},"Blog",{"href":1307,"dataGaName":1308,"dataGaLocation":1102},"/blog/","blog",{"text":1310,"config":1311},"Demo Hub",{"href":1312,"dataGaName":1313,"dataGaLocation":1102},"/demo-hub/","demo hub",{"text":1315,"config":1316},"The Source",{"href":1317,"dataGaName":1308,"dataGaLocation":1102},"/the-source/",{"text":1319,"config":1320},"Remote",{"href":1321,"dataGaName":1322,"dataGaLocation":1102},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1324,"items":1325},"Connect",[1326,1331,1336,1341,1346,1351],{"text":1327,"config":1328},"GitLab Services",{"href":1329,"dataGaName":1330,"dataGaLocation":1102},"/services/","services",{"text":1332,"config":1333},"Contribute",{"href":1334,"dataGaName":1335,"dataGaLocation":1102},"https://contributors.gitlab.com","contribute",{"text":1337,"config":1338},"Community",{"href":1339,"dataGaName":1340,"dataGaLocation":1102},"/community/","community",{"text":1342,"config":1343},"Forum",{"href":1344,"dataGaName":1345,"dataGaLocation":1102},"https://forum.gitlab.com/","forum",{"text":1347,"config":1348},"Events",{"href":1349,"dataGaName":1350,"dataGaLocation":1102},"/events/","events",{"text":1352,"config":1353},"Partners",{"href":1354,"dataGaName":1355,"dataGaLocation":1102},"/partners/","partners",{"config":1357,"title":1360,"text":1361,"link":1362},{"background":1358,"textColor":1359},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1363,"config":1364},"Read the latest",{"href":1365,"dataGaName":1366,"dataGaLocation":1102},"/whats-new/","whats new",{"text":1368,"config":1369,"menu":1371},"Company",{"dataNavLevelOne":1370},"company",{"type":1153,"columns":1372},[1373],{"items":1374},[1375,1380,1386,1388,1393,1398,1403,1408,1413,1418],{"text":1376,"config":1377},"About",{"href":1378,"dataGaName":1379,"dataGaLocation":1102},"/company/","about",{"text":1381,"config":1382,"footerGa":1385},"Jobs",{"href":1383,"dataGaName":1384,"dataGaLocation":1102},"/jobs/","jobs",{"dataGaName":1384},{"text":1347,"config":1387},{"href":1349,"dataGaName":1350,"dataGaLocation":1102},{"text":1389,"config":1390},"Leadership",{"href":1391,"dataGaName":1392,"dataGaLocation":1102},"/company/team/e-group/","leadership",{"text":1394,"config":1395},"Handbook",{"href":1396,"dataGaName":1397,"dataGaLocation":1102},"https://handbook.gitlab.com/","handbook",{"text":1399,"config":1400},"Investor relations",{"href":1401,"dataGaName":1402,"dataGaLocation":1102},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1404,"config":1405},"Trust Center",{"href":1406,"dataGaName":1407,"dataGaLocation":1102},"/security/","trust center",{"text":1409,"config":1410},"AI Transparency Center",{"href":1411,"dataGaName":1412,"dataGaLocation":1102},"/ai-transparency-center/","ai transparency center",{"text":1414,"config":1415},"Newsletter",{"href":1416,"dataGaName":1417,"dataGaLocation":1102},"/company/contact/#contact-forms","newsletter",{"text":1419,"config":1420},"Press",{"href":1421,"dataGaName":1422,"dataGaLocation":1102},"/press/","press",{"text":1424,"config":1425,"menu":1426},"Contact us",{"dataNavLevelOne":1370},{"type":1153,"columns":1427},[1428],{"items":1429},[1430,1435,1440],{"text":1431,"config":1432},"Talk to sales",{"href":1433,"dataGaName":1434,"dataGaLocation":1102},"/sales/","talk to sales",{"text":1436,"config":1437},"Support portal",{"href":1438,"dataGaName":1439,"dataGaLocation":1102},"https://support.gitlab.com/hc/en-us","support portal",{"text":1441,"config":1442},"Customer portal",{"href":1443,"dataGaName":1444,"dataGaLocation":1102},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1446,"login":1447,"suggestions":1454},"Close",{"text":1448,"link":1449},"To search repositories and projects, login to",{"text":1450,"config":1451},"gitlab.com",{"href":1116,"dataGaName":1452,"dataGaLocation":1453},"search login","search",{"text":1455,"default":1456},"Suggestions",[1457,1459,1463,1465,1469,1473],{"text":1133,"config":1458},{"href":1138,"dataGaName":1133,"dataGaLocation":1453},{"text":1460,"config":1461},"Code Suggestions (AI)",{"href":1462,"dataGaName":1460,"dataGaLocation":1453},"/solutions/code-suggestions/",{"text":1169,"config":1464},{"href":1171,"dataGaName":1169,"dataGaLocation":1453},{"text":1466,"config":1467},"GitLab on AWS",{"href":1468,"dataGaName":1466,"dataGaLocation":1453},"/partners/technology-partners/aws/",{"text":1470,"config":1471},"GitLab on Google Cloud",{"href":1472,"dataGaName":1470,"dataGaLocation":1453},"/partners/technology-partners/google-cloud-platform/",{"text":1474,"config":1475},"Why GitLab?",{"href":1146,"dataGaName":1474,"dataGaLocation":1453},{"freeTrial":1477,"mobileIcon":1482,"desktopIcon":1487,"secondaryButton":1490},{"text":1478,"config":1479},"Start free trial",{"href":1480,"dataGaName":1107,"dataGaLocation":1481},"https://gitlab.com/-/trials/new/","nav",{"altText":1483,"config":1484},"Gitlab Icon",{"src":1485,"dataGaName":1486,"dataGaLocation":1481},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1483,"config":1488},{"src":1489,"dataGaName":1486,"dataGaLocation":1481},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1491,"config":1492},"Get Started",{"href":1493,"dataGaName":1494,"dataGaLocation":1481},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1496,"mobileIcon":1500,"desktopIcon":1502},{"text":1497,"config":1498},"Learn more about GitLab Duo",{"href":1138,"dataGaName":1499,"dataGaLocation":1481},"gitlab duo",{"altText":1483,"config":1501},{"src":1485,"dataGaName":1486,"dataGaLocation":1481},{"altText":1483,"config":1503},{"src":1489,"dataGaName":1486,"dataGaLocation":1481},{"button":1505,"mobileIcon":1510,"desktopIcon":1512},{"text":1506,"config":1507},"/switch",{"href":1508,"dataGaName":1509,"dataGaLocation":1481},"#contact","switch",{"altText":1483,"config":1511},{"src":1485,"dataGaName":1486,"dataGaLocation":1481},{"altText":1483,"config":1513},{"src":1514,"dataGaName":1486,"dataGaLocation":1481},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1516,"mobileIcon":1521,"desktopIcon":1523},{"text":1517,"config":1518},"Back to pricing",{"href":1251,"dataGaName":1519,"dataGaLocation":1481,"icon":1520},"back to pricing","GoBack",{"altText":1483,"config":1522},{"src":1485,"dataGaName":1486,"dataGaLocation":1481},{"altText":1483,"config":1524},{"src":1489,"dataGaName":1486,"dataGaLocation":1481},{"title":1526,"titleMobile":1527,"button":1528,"config":1533},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":1144,"config":1529},{"href":1530,"dataGaName":1531,"dataGaLocation":1532},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1534,"disabled":1089},"release",{"data":1536},{"text":1537,"source":1538,"edit":1544,"contribute":1549,"config":1554,"items":1559,"minimal":1769},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1539,"config":1540},"View page source",{"href":1541,"dataGaName":1542,"dataGaLocation":1543},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1545,"config":1546},"Edit this page",{"href":1547,"dataGaName":1548,"dataGaLocation":1543},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1550,"config":1551},"Please contribute",{"href":1552,"dataGaName":1553,"dataGaLocation":1543},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1555,"facebook":1556,"youtube":1557,"linkedin":1558},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1560,1607,1661,1705,1737],{"title":1249,"links":1561,"subMenu":1576},[1562,1566,1571],{"text":1563,"config":1564},"View plans",{"href":1251,"dataGaName":1565,"dataGaLocation":1543},"view plans",{"text":1567,"config":1568},"Why Premium?",{"href":1569,"dataGaName":1570,"dataGaLocation":1543},"/pricing/premium/","why premium",{"text":1572,"config":1573},"Why Ultimate?",{"href":1574,"dataGaName":1575,"dataGaLocation":1543},"/pricing/ultimate/","why ultimate",[1577],{"title":1578,"links":1579},"Contact Us",[1580,1583,1585,1587,1592,1597,1602],{"text":1581,"config":1582},"Contact sales",{"href":1433,"dataGaName":1112,"dataGaLocation":1543},{"text":1436,"config":1584},{"href":1438,"dataGaName":1439,"dataGaLocation":1543},{"text":1441,"config":1586},{"href":1443,"dataGaName":1444,"dataGaLocation":1543},{"text":1588,"config":1589},"Status",{"href":1590,"dataGaName":1591,"dataGaLocation":1543},"https://status.gitlab.com/","status",{"text":1593,"config":1594},"Terms of use",{"href":1595,"dataGaName":1596,"dataGaLocation":1543},"/terms/","terms of use",{"text":1598,"config":1599},"Privacy statement",{"href":1600,"dataGaName":1601,"dataGaLocation":1543},"/privacy/","privacy statement",{"text":1603,"config":1604},"Cookie preferences",{"dataGaName":1605,"dataGaLocation":1543,"id":1606,"isOneTrustButton":191},"cookie preferences","ot-sdk-btn",{"title":1149,"links":1608,"subMenu":1617},[1609,1613],{"text":1610,"config":1611},"DevSecOps platform",{"href":1131,"dataGaName":1612,"dataGaLocation":1543},"devsecops platform",{"text":1614,"config":1615},"AI-Assisted Development",{"href":1138,"dataGaName":1616,"dataGaLocation":1543},"ai-assisted development",[1618],{"title":1619,"links":1620},"Topics",[1621,1626,1631,1636,1641,1646,1651,1656],{"text":1622,"config":1623},"CICD",{"href":1624,"dataGaName":1625,"dataGaLocation":1543},"/topics/ci-cd/","cicd",{"text":1627,"config":1628},"GitOps",{"href":1629,"dataGaName":1630,"dataGaLocation":1543},"/topics/gitops/","gitops",{"text":1632,"config":1633},"DevOps",{"href":1634,"dataGaName":1635,"dataGaLocation":1543},"/topics/devops/","devops",{"text":1637,"config":1638},"Version Control",{"href":1639,"dataGaName":1640,"dataGaLocation":1543},"/topics/version-control/","version control",{"text":1642,"config":1643},"DevSecOps",{"href":1644,"dataGaName":1645,"dataGaLocation":1543},"/topics/devsecops/","devsecops",{"text":1647,"config":1648},"Cloud Native",{"href":1649,"dataGaName":1650,"dataGaLocation":1543},"/topics/cloud-native/","cloud native",{"text":1652,"config":1653},"AI for Coding",{"href":1654,"dataGaName":1655,"dataGaLocation":1543},"/topics/devops/ai-for-coding/","ai for coding",{"text":1657,"config":1658},"Agentic AI",{"href":1659,"dataGaName":1660,"dataGaLocation":1543},"/topics/agentic-ai/","agentic ai",{"title":1662,"links":1663},"Solutions",[1664,1666,1668,1673,1677,1680,1684,1687,1689,1692,1695,1700],{"text":1193,"config":1665},{"href":1188,"dataGaName":1193,"dataGaLocation":1543},{"text":1182,"config":1667},{"href":1165,"dataGaName":1166,"dataGaLocation":1543},{"text":1669,"config":1670},"Agile development",{"href":1671,"dataGaName":1672,"dataGaLocation":1543},"/solutions/agile-delivery/","agile delivery",{"text":1674,"config":1675},"SCM",{"href":1178,"dataGaName":1676,"dataGaLocation":1543},"source code management",{"text":1622,"config":1678},{"href":1171,"dataGaName":1679,"dataGaLocation":1543},"continuous integration & delivery",{"text":1681,"config":1682},"Value stream management",{"href":1221,"dataGaName":1683,"dataGaLocation":1543},"value stream management",{"text":1627,"config":1685},{"href":1686,"dataGaName":1630,"dataGaLocation":1543},"/solutions/gitops/",{"text":1231,"config":1688},{"href":1234,"dataGaName":1235,"dataGaLocation":1543},{"text":1690,"config":1691},"Small business",{"href":1240,"dataGaName":1241,"dataGaLocation":1543},{"text":1693,"config":1694},"Public sector",{"href":1246,"dataGaName":1247,"dataGaLocation":1543},{"text":1696,"config":1697},"Education",{"href":1698,"dataGaName":1699,"dataGaLocation":1543},"/solutions/education/","education",{"text":1701,"config":1702},"Financial services",{"href":1703,"dataGaName":1704,"dataGaLocation":1543},"/solutions/finance/","financial services",{"title":1254,"links":1706},[1707,1709,1711,1713,1716,1718,1721,1723,1725,1727,1729,1731,1733,1735],{"text":1267,"config":1708},{"href":1269,"dataGaName":1270,"dataGaLocation":1543},{"text":1272,"config":1710},{"href":1274,"dataGaName":1275,"dataGaLocation":1543},{"text":1277,"config":1712},{"href":1279,"dataGaName":1280,"dataGaLocation":1543},{"text":1282,"config":1714},{"href":1284,"dataGaName":1715,"dataGaLocation":1543},"docs",{"text":1305,"config":1717},{"href":1307,"dataGaName":1308,"dataGaLocation":1543},{"text":1719,"config":1720},"What's new",{"href":1365,"dataGaName":1366,"dataGaLocation":1543},{"text":1300,"config":1722},{"href":1302,"dataGaName":1303,"dataGaLocation":1543},{"text":1319,"config":1724},{"href":1321,"dataGaName":1322,"dataGaLocation":1543},{"text":1327,"config":1726},{"href":1329,"dataGaName":1330,"dataGaLocation":1543},{"text":1332,"config":1728},{"href":1334,"dataGaName":1335,"dataGaLocation":1543},{"text":1337,"config":1730},{"href":1339,"dataGaName":1340,"dataGaLocation":1543},{"text":1342,"config":1732},{"href":1344,"dataGaName":1345,"dataGaLocation":1543},{"text":1347,"config":1734},{"href":1349,"dataGaName":1350,"dataGaLocation":1543},{"text":1352,"config":1736},{"href":1354,"dataGaName":1355,"dataGaLocation":1543},{"title":1368,"links":1738},[1739,1741,1743,1745,1747,1749,1753,1758,1760,1762,1764],{"text":1376,"config":1740},{"href":1378,"dataGaName":1370,"dataGaLocation":1543},{"text":1381,"config":1742},{"href":1383,"dataGaName":1384,"dataGaLocation":1543},{"text":1389,"config":1744},{"href":1391,"dataGaName":1392,"dataGaLocation":1543},{"text":1394,"config":1746},{"href":1396,"dataGaName":1397,"dataGaLocation":1543},{"text":1399,"config":1748},{"href":1401,"dataGaName":1402,"dataGaLocation":1543},{"text":1750,"config":1751},"Sustainability",{"href":1752,"dataGaName":1750,"dataGaLocation":1543},"/sustainability/",{"text":1754,"config":1755},"Diversity, inclusion and belonging (DIB)",{"href":1756,"dataGaName":1757,"dataGaLocation":1543},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1404,"config":1759},{"href":1406,"dataGaName":1407,"dataGaLocation":1543},{"text":1414,"config":1761},{"href":1416,"dataGaName":1417,"dataGaLocation":1543},{"text":1419,"config":1763},{"href":1421,"dataGaName":1422,"dataGaLocation":1543},{"text":1765,"config":1766},"Modern Slavery Transparency Statement",{"href":1767,"dataGaName":1768,"dataGaLocation":1543},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1770},[1771,1774,1777],{"text":1772,"config":1773},"Terms",{"href":1595,"dataGaName":1596,"dataGaLocation":1543},{"text":1775,"config":1776},"Cookies",{"dataGaName":1605,"dataGaLocation":1543,"id":1606,"isOneTrustButton":191},{"text":1778,"config":1779},"Privacy",{"href":1600,"dataGaName":1601,"dataGaLocation":1543},[1781,1794],{"id":1782,"title":7,"body":1083,"config":1783,"content":1785,"description":1083,"extension":1788,"meta":1789,"navigation":191,"path":1790,"seo":1791,"stem":1792,"__hash__":1793},"blogAuthors/en-us/blog/authors/erick-bajao.yml",{"template":1784},"BlogAuthor",{"name":7,"config":1786},{"headshot":1787},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1785949710/hopuhfq9uc0g2e4vfnsz.png","yml",{},"/en-us/blog/authors/erick-bajao",{},"en-us/blog/authors/erick-bajao","Fn6zEYOUr3cr397JsUCaPhmDvXhsxhKZCy3Dqzpx-SM",{"id":1795,"title":8,"body":1083,"config":1796,"content":1797,"description":1083,"extension":1788,"meta":1801,"navigation":191,"path":1802,"seo":1803,"stem":1804,"__hash__":1805},"blogAuthors/en-us/blog/authors/joe-randazzo.yml",{"template":1784},{"name":8,"config":1798},{"headshot":1799,"ctfId":1800},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749664711/Blog/Author%20Headshots/randazzo.jpg","5DxpEbIVcwN2ukwiEMsHlH",{},"/en-us/blog/authors/joe-randazzo",{},"en-us/blog/authors/joe-randazzo","Kg6ZOiBKQgjjlIpsfIAWHsug3iGMaAK1trTdXg4BaFI",[1807,1815,1823],{"title":1808,"description":1809,"heroImage":1810,"category":1079,"date":1811,"authors":1812,"slug":1814,"externalUrl":1083},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1813],"Alisa Ho","claude-security-and-gitlab",{"title":1816,"description":1817,"heroImage":1818,"category":1079,"date":1819,"authors":1820,"slug":1822,"externalUrl":1083},"GitLab Duo Security Review spots logic flaws scanners miss","Use AI-driven security reasoning to detect authorization gaps, business-logic errors, and race conditions while code is still under review.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1783980535/t3gez0gpayfndrhncunf.png","2026-07-16",[1821],"Mark Settle","gitlab-duo-security-review-flow",{"title":1824,"description":1825,"heroImage":1818,"category":1079,"date":1819,"authors":1826,"slug":1827,"externalUrl":1083},"When a version bump breaks your build, GitLab fixes it","Automatically upgrade dependencies, adapt code for breaking changes, and route changes for approval — only GitLab does it natively, with full context.",[1821],"dependency-scanning-auto-remediation",{"promotions":1829},[1830,1844,1855,1866],{"id":1831,"categories":1832,"header":1834,"text":1835,"button":1836,"image":1841},"ai-modernization",[1833],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1837,"config":1838},"Get your AI maturity score",{"href":1839,"dataGaName":1840,"dataGaLocation":1308},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1842},{"src":1843},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1845,"categories":1846,"header":1847,"text":1835,"button":1848,"image":1852},"devops-modernization",[1094,1645],"Are you just managing tools or shipping innovation?",{"text":1849,"config":1850},"Get your DevOps maturity score",{"href":1851,"dataGaName":1840,"dataGaLocation":1308},"/assessments/devops-modernization-assessment/",{"config":1853},{"src":1854},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1856,"categories":1857,"header":1858,"text":1835,"button":1859,"image":1863},"security-modernization",[1079],"Are you trading speed for security?",{"text":1860,"config":1861},"Get your security maturity score",{"href":1862,"dataGaName":1840,"dataGaLocation":1308},"/assessments/security-modernization-assessment/",{"config":1864},{"src":1865},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1867,"paths":1868,"header":1871,"text":1872,"button":1873,"image":1878},"github-azure-migration",[1869,1870],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1874,"config":1875},"See how GitLab compares to GitHub",{"href":1876,"dataGaName":1877,"dataGaLocation":1308},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1879},{"src":1854},{"header":1881,"blurb":1882,"button":1883,"secondaryButton":1888},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1884,"config":1885},"Get your free trial",{"href":1886,"dataGaName":1107,"dataGaLocation":1887},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1581,"config":1889},{"href":1433,"dataGaName":1112,"dataGaLocation":1887},1786054085268]