Application secrets

This page is a development guide for application secrets.

Secret entries

Entry Description
secret_key_base The base key to be used for generating a various secrets
otp_key_base The base key for One Time Passwords, described in User management
db_key_base The base key to encrypt the data for attr_encrypted columns
openid_connect_signing_key The singing key for OpenID Connect

Where the secrets are stored

Installation type Location
Omnibus /etc/gitlab/gitlab-secrets.json
Cloud Native GitLab Charts Kubernets Secrets
Source <path-to-gitlab-rails>/config/secrets.yml (Automatically generated by 01_secret_token.rb)

Warning: Before you add a new secret to application secrets

Before you add a new secret to config/initializers/01_secret_token.rb, make sure you also update Omnibus GitLab or updates will fail. Omnibus is responsible for writing the secrets.yml file. If Omnibus doesn’t know about a secret, Rails will attempt to write to the file, but this will fail because Rails doesn’t have write access. The same rules apply to Cloud Native GitLab charts, you must update the charts at first. In case you need the secret to have same value on each node (which is usually the case) you need to make sure it’s configured for all environments prior to changing this file.


Further iteration

We might deprecate/remove this automatic secret generation ‘01_secret_token.rb’ in the future. Please see this issue for more information.