Mismatch between path used by GitLab and Plugin

[adestis-jm]

Hi there!

Thanks for the great work on the plugin.

I have sadly found a singular issue:

when creating a gitlab CI/CD job like this:

job_using_vault:
  id_tokens:
    VAULT_ID_TOKEN:
      aud: https://vault.example.com
  secrets:
    DATABASE_PASSWORD:
      vault: production/db/password@ops
      token: $VAULT_ID_TOKEN

Gitlab looks up the the secret production/db/password for the secret engine ops:
Making the full path ops/data/production/db/password.

However, the path for tokens in this plugins provider are:
gitlab/token/[...]

Is there any reason for this mismatch? am i missing a config parameter to change this?

[ilijamt]

The plugin is to only issue tokens for Gitlab, you cannot use it as a key vault store. In the snippet you sent I see you are trying to access data from KV and not for the token generation.

Or am I misunderstanding something?

[adestis-jm]

Mildly, but I expect there was some misunderstanding on my part too.

Here's the Scenario:

We're trying to automate some of the GitLab Access Tokens through vault,
including the Access Tokens used by GitLab itself - for example a token is needed for the Semantic Release Plugin.

Other Tokens are used for Triggering Pipelines in other projects, updating config files etc.

So going through the docs the hope was to use the GitLab integration allowing it to access Vault (which should theoretically work with any secrets engine including KV) to get (and that way automatically provision the token)

I can see now that that wasn't and object of this Plugin - and I cannot change GitLab to use any path but the /data/* ones nor can i add an alias for the /token/* on this one AFAIK.

For now, I employed a simple step using curl to create and make the Tokens, which works just fine but seems like a workaround over the approach described above.

[alexeiser]

If you switch your config to use KVv1 or Generic option then it won't insert the /data/ element in the path. Thats only used with KVv2 which is the default config. https://docs.gitlab.com/ci/secrets/hashicorp_vault/#use-a-different-secrets-engine shows how to configure it to use generic - and then what your describing should work out of the box.