Skip to content
masterclass Buddy
Start learning

DevOps · Service

GitLab CI

Use GitLab job JWTs with Vault's JWT auth method to retrieve secrets without storing credentials in GitLab. Restrict Vault roles with claims such as project, ref, environment, and pipeline source.

Last updated

Syntax

vault write auth/jwt/config jwks_url="https://gitlab.example.com/-/jwks" bound_issuer="https://gitlab.example.com"

In-depth API docs are only for subscribers: parameters, examples, common mistakes and interview practice.

Subscribe
  • JWT/OIDC auth method
  • id_tokens
  • secrets:vault
  • JWKS
  • bound_claims
  • project_path
  • namespace_path
  • ref

Source: Secure GitLab CI/CD secrets with HashiCorp Vault | Well-Architected Framework | HashiCorp Developer. Checked 2026-11-03.