GitLab Secrets Manager: Govern secrets like your code

GitLab Secrets Manager is generally available in GitLab 19.5 for Premium and Ultimate users on GitLab.com and GitLab Self-Managed, offering an OpenBao-based way to manage build-time and runtime credentials through GitLab’s existing permissions and audit controls. It aims to reduce risks associated with broadly accessible CI/CD variables and separate vault permission models by injecting secrets only into authorized jobs based on project, branch, protected-branch status, and environment scope. Secrets are encrypted at rest, accessed through short-lived job-bound tokens, written to temporary files rather than exposed directly in configuration, masked in logs, and removed when jobs finish. The service supports incident response through revocation, rotation reminders, and audit events linked to specific pipelines, jobs, commits, users, and merge requests without recording secret values. It also lets groups share governed credentials across projects and provides integrations for Kubernetes through External Secrets Operator, Terraform and OpenTofu, Vault-compatible tools, and other runtime applications. GitLab positions the service as part of its broader supply-chain security platform alongside dependency controls, artifact governance, secret detection, and agent security features, while continuing support for external secret-management integrations. The paid add-on is billed per stored secret and read operations, with trials available on GitLab.com and administrative setup required for self-managed deployments.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.