GitLab Secrets Manager adds ESO, Terraform, API support
Aug 6, 2026Erick Bajao
Summary
This post details the integration of GitLab Secrets Manager with External Secrets Operator (ESO) for Kubernetes, enabling secrets to be synced from GitLab to Kubernetes Secrets using a Vault provider and JWT authentication. It also describes how Terraform/OpenTofu can read secrets directly from GitLab Secrets Manager using a Vault provider and minted JWTs, avoiding storage in `.tfvars` or CI/CD variables. Additionally, it covers using the OpenBao/Vault CLI and the Secrets Manager API for external automation.
More from the GitLab Secrets Manager trail
- Manage CI/CD credentials with GitLab Secrets Manager
- A leaked personal access token shouldn't expose every project its owner can reach. Fine-grained PATs scope each token’s permissions to the job.
- Solving complex challenges with GitLab Duo Workflow
- How to scan a full commit history to detect sensitive secrets
- Best practices to keep secrets out of GitLab repositories