Chapter 1. Adding secrets to GitLab CI for secure integration with external tools Prerequisites Before you configure GitLab CI, ensure you have the following: Admin access to your GitLab repository and CI/CD settings. Container registry credentials for pulling container images from Quay.io, JFrog Artifactory, or Sonatype Nexus. Authentication details for specific GitLab CI tasks: For ACS security tasks : ROX Central server endpoint ROX API token For SBOM and artifact signing tasks : Cosign signing key password Private key and public key Trustification URL Client ID and secret Supported CycloneDX version Note The credentials and other details are already Base64-encoded, so you do not need to encode them again. You can find these credentials in your private.env file, which you created during RHTAP installation. 1.1. Option 1: Using GitLab UI Procedure Log in to GitLab and open your source repository. Expand the Setting menu and select CI/CD . In the Variables section, select Expand , and then select Add variable . Enter the following details: Under Flags , select Mask variable to hide sensitive values. In the Key field, enter MY_GITLAB_TOKEN . In the Value field, enter the token associated with your GitLab account. Repeat steps 3-4 to add the required variables: Variable Description Provide image registry credentials for only one image registry. QUAY_IO_CREDS_USR Username for accessing Quay.io repository. QUAY_IO_CREDS_PSW Password for accessing Quay.io repository. ARTIFACTORY_IO_CREDS_USR Username for accessing JFrog Artifactory repository. ARTIFACTORY_IO_CREDS_PSW Password for accessing JFrog Artifactory repository. NEXUS_IO_CREDS_USR Username for accessing Sonatype Nexus repository. NEXUS_IO_CREDS_PSW Password for accessing Sonatype Nexus repository. Set these variables if Gitlab CI runners do not run on the same cluster as the RHTAP instance. REKOR_HOST URL of your Rekor server. TUF_MIRROR URL of your TUF service. GitOps configuration for GitLab GITOPS_AUTH_PASSWORD The token the system uses to update the GitOps repository for newly built images. GITOPS_AUTH_USERNAME (optional) The parameter required for GitLab to work with Jenkins. You also need to uncomment a line with this parameter in a Jenkinsfile: GITOPS_AUTH_USERNAME = credentials('GITOPS_AUTH_USERNAME'). By default, this line is commented out. Variable required for ACS tasks. ROX_CENTRAL_ENDPOINT Endpoint for the ROX Central server. ROX_API_TOKEN API token for accessing the ROX server. Variables required for SBOM tasks. COSIGN_SECRET_PASSWORD Password for Cosign signing key. COSIGN_SECRET_KEY Private key for Cosign. COSIGN_PUBLIC_KEY Public key for Cosign. TRUSTIFICATION_BOMBASTIC_API_URL URL for Trustification Bombastic API used in SBOM generation. TRUSTIFICATION_OIDC_ISSUER_URL OIDC issuer URL used for authentication when interacting with the Trustification Bombastic API. TRUSTIFICATION_OIDC_CLIENT_ID Client ID for authenticating to the Trustification Bombastic API using OIDC. TRUSTIFICATION_OIDC_CLIENT_SECRET Client secret used alongside the client ID to authenticate to the Trustification Bombastic API. TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION Specifies the CycloneDX SBOM version that is supported and generated by the system. Select Add variable . Rerun the last pipeline run to verify the secrets are applied correctly. Alternatively, switch to you application's source repository in GitLab, make a minor change, and commit it to trigger a new pipeline run. 1.2. Option 2: Using CLI Procedure Create a project with two files in your preferred text editor, such as Visual Studio Code: env_vars.sh glab-set-vars Update the env_vars.sh file with the following environment variables: # env_vars.sh # GitLab credentials export MY_GITLAB_TOKEN="your_gitlab_token_here" export MY_GITLAB_USER="your_gitlab_username_here" export GITOPS_AUTH_PASSWORD="your_OpenShift_GitOps_password_here" export GITOPS_AUTH_USERNAME="your_OpenShift_GitOps_username_here" // Provide the credentials for the image registry you use. # Quay.io credentials export QUAY_IO_CREDS_USR="your_quay_username_here" export QUAY_IO_CREDS_PSW="your_quay_password_here" # JFrog Artifactory credenditals export ARTIFACTORY_IO_CREDS_USR="your_artifactory_username_here" export ARTIFACTORY_IO_CREDS_PSW="your_artifactory_password_here" # Sonatype Nexus credentials export NEXUS_IO_CREDS_USR="your_nexus_username_here" export NEXUS_IO_CREDS_PSW="your_nexus_password_here" # Rekor and TUF routes export REKOR_HOST="your rekor server url here" export TUF_MIRROR="your tuf service url here" // Variables required for ACS tasks # ROX variables export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here" export ROX_API_TOKEN="your_rox_api_token_here" // Set these variables if Gitlab CI runners do not run on the same cluster as the {ProductShortName} instance. export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here" export ROX_API_TOKEN="your_rox_api_token_here" // Variables required for SBOM tasks. # Cosign secrets export COSIGN_SECRET_PASSWORD="your_cosign_secret_password_here" export COSIGN_SECRET_KEY="your_cosign_secret_key_here" export COSIGN_PUBLIC_KEY="your_cosign_public_key_here" # Trustification credentials export TRUSTIFICATION_BOMBASTIC_API_URL="your__BOMBASTIC_API_URL_here" export TRUSTIFICATION_OIDC_ISSUER_URL="your_OIDC_ISSUER_URL_here" export TRUSTIFICATION_OIDC_CLIENT_ID="your_OIDC_CLIENT_ID_here" export TRUSTIFICATION_OIDC_CLIENT_SECRET="your_OIDC_CLIENT_SECRET_here" export TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION="your_SUPPORTED_CYCLONEDX_VERSION_here" Update the glab-set-vars file with the following information: #!/bin/bash SCRIPTDIR="USD(cd "USD(dirname "USD{BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)" if [ USD# -ne 1 ]; then echo "Missing param, provide gitlab repo name" echo "Note: This script uses MY_GITLAB_TOKEN and MY_GITLAB_USER env vars" exit fi REPO=USD1 HEADER="PRIVATE-TOKEN: USDMY_GITLAB_TOKEN" URL=https://gitlab.com/api/v4/projects # Look up the project ID so we can use it below PID=USD(curl -s -L --header "USDHEADER" "USDURL/USDMY_GITLAB_USER%2FUSDREPO" | jq ".id") function setVars() { NAME=USD1 VALUE=USD2 MASKED=USD{3:-true} echo "setting USDNAME in https://gitlab.com/USDMY_GITLAB_USER/USDREPO" # Delete first because if the secret already exists then its value # won't be changed by the POST below curl -s --request DELETE --header "USDHEADER" "USDURL/USDPID/variables/USDNAME" # Set the new key/value curl -s --request POST --header "USDHEADER" "USDURL/USDPID/variables" \ --form "key=USDNAME" --form "value=USDVALUE" --form "masked=USDMASKED" | jq } setVars ROX_CENTRAL_ENDPOINT USDROX_CENTRAL_ENDPOINT setVars ROX_API_TOKEN USDROX_API_TOKEN setVars GITOPS_AUTH_PASSWORD USDMY_GITLAB_TOKEN setVars GITOPS_AUTH_USERNAME USDMY_GITLAB_USER setVars QUAY_IO_CREDS_USR USDQUAY_IO_CREDS_USR setVars QUAY_IO_CREDS_PSW USDQUAY_IO_CREDS_PSW setVars COSIGN_SECRET_PASSWORD USDCOSIGN_SECRET_PASSWORD setVars COSIGN_SECRET_KEY USDCOSIGN_SECRET_KEY setVars COSIGN_PUBLIC_KEY USDCOSIGN_PUBLIC_KEY setVars TRUSTIFICATION_BOMBASTIC_API_URL "USDTRUSTIFICATION_BOMBASTIC_API_URL" setVars TRUSTIFICATION_OIDC_ISSUER_URL "USDTRUSTIFICATION_OIDC_ISSUER_URL" setVars TRUSTIFICATION_OIDC_CLIENT_ID "USDTRUSTIFICATION_OIDC_CLIENT_ID" setVars TRUSTIFICATION_OIDC_CLIENT_SECRET "USDTRUSTIFICATION_OIDC_CLIENT_SECRET" setVars TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION "USDTRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION" setVars ARTIFACTORY_IO_CREDS_USR USDARTIFACTORY_IO_CREDS_USR setVars ARTIFACTORY_IO_CREDS_PSW USDARTIFACTORY_IO_CREDS_PSW setVars NEXUS_IO_CREDS_USR USDNEXUS_IO_CREDS_USR setVars NEXUS_IO_CREDS_PSW USDNEXUS_IO_CREDS_PSW setVars REKOR_HOST USDREKOR_HOST setVars TUF_MIRROR USDTUF_MIRROR (Optional) Modify the glab-set-vars file to disable variables that are not required. For example, to disable setVars ROX_API_TOKEN USDROX_API_TOKEN , add false to it. ROX_API_TOKEN USDROX_API_TOKEN false Load the environment variables into your current shell session: source env_vars.sh Make the glab-set-vars script executable, and run it with your repository name to set the variables in your GitLab repository. chmod +x glab-set-vars ./glab-set-vars your_repository_name Rerun the last pipeline run to verify the secrets are applied correctly. Alternatively, switch to you application's source repository in GitLab, make a minor change, and commit it to trigger a new pipeline run. Revised on 2025-02-12 15:08:44 UTC

Commands:
env_vars.sh GitLab credentials export MY_GITLAB_TOKEN="your_gitlab_token_here" export MY_GITLAB_USER="your_gitlab_username_here" export GITOPS_AUTH_PASSWORD="your_OpenShift_GitOps_password_here" export GITOPS_AUTH_USERNAME="your_OpenShift_GitOps_username_here" // Provide the credentials for the image registry you use. Quay.io credentials export QUAY_IO_CREDS_USR="your_quay_username_here" export QUAY_IO_CREDS_PSW="your_quay_password_here" JFrog Artifactory credenditals export ARTIFACTORY_IO_CREDS_USR="your_artifactory_username_here" export ARTIFACTORY_IO_CREDS_PSW="your_artifactory_password_here" Sonatype Nexus credentials export NEXUS_IO_CREDS_USR="your_nexus_username_here" export NEXUS_IO_CREDS_PSW="your_nexus_password_here" Rekor and TUF routes export REKOR_HOST="your rekor server url here" export TUF_MIRROR="your tuf service url here" // Variables required for ACS tasks ROX variables export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here" export ROX_API_TOKEN="your_rox_api_token_here" // Set these variables if Gitlab CI runners do not run on the same cluster as the {ProductShortName} instance. export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here" export ROX_API_TOKEN="your_rox_api_token_here" // Variables required for SBOM tasks. Cosign secrets export COSIGN_SECRET_PASSWORD="your_cosign_secret_password_here" export COSIGN_SECRET_KEY="your_cosign_secret_key_here" export COSIGN_PUBLIC_KEY="your_cosign_public_key_here" Trustification credentials export TRUSTIFICATION_BOMBASTIC_API_URL="your__BOMBASTIC_API_URL_here" export TRUSTIFICATION_OIDC_ISSUER_URL="your_OIDC_ISSUER_URL_here" export TRUSTIFICATION_OIDC_CLIENT_ID="your_OIDC_CLIENT_ID_here" export TRUSTIFICATION_OIDC_CLIENT_SECRET="your_OIDC_CLIENT_SECRET_here" export TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION="your_SUPPORTED_CYCLONEDX_VERSION_here"
#!/bin/bash SCRIPTDIR="USD(cd "USD(dirname "USD{BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)" if [ USD# -ne 1 ]; then echo "Missing param, provide gitlab repo name" echo "Note: This script uses MY_GITLAB_TOKEN and MY_GITLAB_USER env vars" exit fi REPO=USD1 HEADER="PRIVATE-TOKEN: USDMY_GITLAB_TOKEN" URL=https://gitlab.com/api/v4/projects Look up the project ID so we can use it below PID=USD(curl -s -L --header "USDHEADER" "USDURL/USDMY_GITLAB_USER%2FUSDREPO" | jq ".id") function setVars() { NAME=USD1 VALUE=USD2 MASKED=USD{3:-true} echo "setting USDNAME in https://gitlab.com/USDMY_GITLAB_USER/USDREPO" # Delete first because if the secret already exists then its value # won't be changed by the POST below curl -s --request DELETE --header "USDHEADER" "USDURL/USDPID/variables/USDNAME" # Set the new key/value curl -s --request POST --header "USDHEADER" "USDURL/USDPID/variables" --form "key=USDNAME" --form "value=USDVALUE" --form "masked=USDMASKED" | jq } setVars ROX_CENTRAL_ENDPOINT USDROX_CENTRAL_ENDPOINT setVars ROX_API_TOKEN USDROX_API_TOKEN setVars GITOPS_AUTH_PASSWORD USDMY_GITLAB_TOKEN setVars GITOPS_AUTH_USERNAME USDMY_GITLAB_USER setVars QUAY_IO_CREDS_USR USDQUAY_IO_CREDS_USR setVars QUAY_IO_CREDS_PSW USDQUAY_IO_CREDS_PSW setVars COSIGN_SECRET_PASSWORD USDCOSIGN_SECRET_PASSWORD setVars COSIGN_SECRET_KEY USDCOSIGN_SECRET_KEY setVars COSIGN_PUBLIC_KEY USDCOSIGN_PUBLIC_KEY setVars TRUSTIFICATION_BOMBASTIC_API_URL "USDTRUSTIFICATION_BOMBASTIC_API_URL" setVars TRUSTIFICATION_OIDC_ISSUER_URL "USDTRUSTIFICATION_OIDC_ISSUER_URL" setVars TRUSTIFICATION_OIDC_CLIENT_ID "USDTRUSTIFICATION_OIDC_CLIENT_ID" setVars TRUSTIFICATION_OIDC_CLIENT_SECRET "USDTRUSTIFICATION_OIDC_CLIENT_SECRET" setVars TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION "USDTRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION" setVars ARTIFACTORY_IO_CREDS_USR USDARTIFACTORY_IO_CREDS_USR setVars ARTIFACTORY_IO_CREDS_PSW USDARTIFACTORY_IO_CREDS_PSW setVars NEXUS_IO_CREDS_USR USDNEXUS_IO_CREDS_USR setVars NEXUS_IO_CREDS_PSW USDNEXUS_IO_CREDS_PSW setVars REKOR_HOST USDREKOR_HOST setVars TUF_MIRROR USDTUF_MIRROR
ROX_API_TOKEN USDROX_API_TOKEN false
source env_vars.sh
chmod +x glab-set-vars ./glab-set-vars your_repository_name