Getting the Yandex Lockbox secret value on the GitLab side

Workload identity federations allow you to configure a link between external systems and Yandex Cloud via the OpenID Connect (OIDC) protocol. This allows external systems to perform actions on Yandex Cloud resources on behalf of service accounts without using authorized keys. This is a more secure method that minimizes the risk of credential leakage and the possibility of unauthorized access.

This tutorial shows you as an example how to get the Yandex Lockbox secret value from the GitLab side under a Yandex Cloud service account. Similarly, you can perform any action via the Yandex Cloud CLI, API, or Terraform.

To get the Yandex Lockbox secret value under a GitLab account:

1. Create a GitLab project.
2. Get your cloud ready.
3. Configure a GitLab CI/CD script.

If you no longer need the resources you created, delete them.

Create a GitLab projectCreate a GitLab project

Create a new GitLab project or use an existing one where you have permissions to view and run GitLab CI/CD pipelines.

Get your cloud readyGet your cloud ready

Sign up in Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or register a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can navigate to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The infrastructure support cost includes a fee for storing a secret and requests to it (see Yandex Lockbox pricing).

Create a workload identity federationCreate a workload identity federation

Create a custom secretCreate a custom secret

Create a service accountCreate a service account

1. Create a service account:

   Management console

   1. In the management console, select the folder where you want to create a service account.
   2. In the list of services, select Identity and Access Management.
   3. Click Create service account.
   4. Enter a name for the service account, e.g., sa-lockbox.
   5. Click Create.

2. Assign the lockbox.payloadViewer role for the folder to the service account:

   Management console

   1. On the management console home page, select a folder.
   2. Navigate to the Access bindings tab.
   3. Find the sa-lockbox account in the list and click .
   4. Click Edit roles.
   5. In the dialog that opens, click Add role and select the lockbox.payloadViewer role.

Link the service account to the federationLink the service account to the federation

Configure a GitLab CI/CD scriptConfigure a GitLab CI/CD script

1. Clone your repository if you have not done so already:

   git clone <repository_URL>
   

2. In a local copy of your repository, create a file named .gitlab-ci.yml in the root directory.

3. Insert the following code into the .gitlab-ci.yml file that will get the value of the Yandex Lockbox secret:

   stages:
   - check_token
   
   check_token:
     stage: check_token
     image: 
       name: ubuntu
     id_tokens:
       GITLAB_OIDC_TOKEN:
         aud: https://gitlab.com/<group_name>/<gitlab_project_name>
     script:
      - apt update && apt install curl jq -y
      # Exchanging the workflow task token for an IAM token of a service account in Yandex Cloud
      - SA_ID="<service_account_ID>"
      - >-
       IAM_TOKEN="$(curl -s
       -H "Content-Type: application/x-www-form-urlencoded" 
       -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&requested_token_type=urn:ietf:params:oauth:token-type:access_token&audience=${SA_ID}&subject_token=${GITLAB_OIDC_TOKEN}&subject_token_type=urn:ietf:params:oauth:token-type:id_token" 
       -X POST https://auth.yandex.cloud/oauth/token | jq -r '.access_token')"
      # Requesting the secret via the API using an IAM token in Yandex Cloud
      - SECRET_ID="<secret_ID>"
      - >-
       SECRET_DATA=$(curl -sH "Authorization: Bearer ${IAM_TOKEN}" https://payload.lockbox.api.cloud.yandex.net/lockbox/v1/secrets/$SECRET_ID/payload)
      - echo ${SECRET_DATA}
     tags:
       - app-test
   

   Where:

   • aud: Token recipient specified when creating the workload identity federation.
   • SA_ID: Service account ID.
   • SECRET_ID: Custom secret ID.

4. Save the file and submit the changes to the remote repository:

   git add . && git commit -m "Added .gitlab-ci.yml" && git push
   

   Once you submit the code to the repository, the workflow will begin.

5. In GitLab left-hand menu, navigate to Build → Pipelines.

6. Make sure the build's status is Passed. This means that the build was successful.

7. In the GitLab left-hand menu, go to Build → Jobs.

8. Click the last completed task to see the result of executing the script in the log:

   { "entries": [ { "key": "secret", "textValue": "67cH2£?pO********" } ], "versionId": "e6q8isknpcp7********" }
   

Delete the resources you createdDelete the resources you created

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:

• Yandex Lockbox secret
• Service account

See alsoSee also

• Secure storage of GitLab CI passwords as Yandex Lockbox secrets
• Getting Yandex Lockbox secret value on the GitHub side