Getting the Lockbox secret value on the GitLab side

Workload Identity Federations allow you to configure a link between external systems and Yandex Cloud via the OpenID Connect (OIDC) protocol. This allows external systems to perform actions on Yandex Cloud resources on behalf of service accounts without generating static credentials, such as authorized keys or IAM tokens. This is a more secure method that minimizes the risk of credential leakage and the possibility of unauthorized access.

This tutorial shows you as an example how to get the Yandex Lockbox secret value from the GitLab side under a Yandex Cloud service account. Similarly, you can perform any action via the Yandex Cloud CLI, API, or Terraform.

To get the Yandex Lockbox secret value under a GitLab account:

1. Create a GitLab project
2. Prepare your cloud.
3. Configure a GitLab CI/CD script.

If you no longer need the resources you created, delete them.

Create a GitLab projectCreate a GitLab project

Create a new GitLab project or use an existing one where you have permissions to view and run GitLab CI/CD pipelines.

Prepare your cloudPrepare your cloud

Sign up for Yandex Cloud and create a billing account:

1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The infrastructure support cost includes a fee for storing a secret and requests to it (see Yandex Lockbox pricing).

Create a workload identity federationCreate a workload identity federation

Create a custom secretCreate a custom secret

Create a service accountCreate a service account

1. Create a service account:

   Management console

   1. In the management console, select the folder where you want to create a service account.
   2. In the list of services, select Identity and Access Management.
   3. Click Create service account.
   4. Enter a name for the service account, e.g., sa-lockbox.
   5. Click Create.

2. Assign the lockbox.payloadViewer role for the folder to the service account:

   Management console

   1. On the management console home page, select a folder.
   2. Go to the Access bindings tab.
   3. Find the sa-lockbox account in the list and click .
   4. Click Edit roles.
   5. Click Add role in the dialog that opens and select the lockbox.payloadViewer role.

Link the service account to the federationLink the service account to the federation

Configure a GitLab CI/CD scriptConfigure a GitLab CI/CD script

1. Clone your repository if you have not done so already:

   git clone <repository_URL>
   

2. In a local copy of your repository, create a file named .gitlab-ci.yml in the root directory.

3. Insert the following code into the .gitlab-ci.yml file that will get the value of the Yandex Lockbox secret:

   stages:
   - check_token
   
   check_token:
     stage: check_token
     image: 
       name: ubuntu
     id_tokens:
       GITLAB_OIDC_TOKEN:
         aud: https://gitlab.com/<group_name>/<gitlab_project_name>
     script:
      - apt update && apt install curl jq -y
      # Exchanging the workflow task token for an IAM token of a service account in Yandex Cloud
      - SA_ID="<service_account_ID>"      
      - >-
       IAM_TOKEN="$(curl -s
       -H "Content-Type: application/x-www-form-urlencoded" 
       -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&requested_token_type=urn:ietf:params:oauth:token-type:access_token&audience=${SA_ID}&subject_token=${GITLAB_OIDC_TOKEN}&subject_token_type=urn:ietf:params:oauth:token-type:id_token" 
       -X POST https://auth.yandex.cloud/oauth/token | jq -r '.access_token')"
      # Requesting secret value via the API using an IAM token in Yandex Cloud
      - SECRET_ID="<secret_ID>"
      - >-
       SECRET_DATA=$(curl -sH "Authorization: Bearer ${IAM_TOKEN}" https://payload.lockbox.api.cloud.yandex.net/lockbox/v1/secrets/$SECRET_ID/payload)
      - echo ${SECRET_DATA}
     tags:
       - app-test
   

   Where:

   • aud: Token recipient specified when creating the workload identity federation.
   • SA_ID: Service account ID.
   • SECRET_ID: Custom secret ID.

4. Save the file and submit the changes to the remote repository:

   git add . && git commit -m "Added .gitlab-ci.yml" && git push
   

   Once you submit the code to the repository, the workflow will begin.

5. In GitLab left-hand menu, navigate to Build → Pipelines.

6. Make sure the build's status is Passed. This means that the build was successful.

7. In the GitLab left-hand menu, go to Build → Jobs.

8. Click the last completed task to see the result of executing the script in the log:

   { "entries": [ { "key": "secret", "textValue": "67cH2£?pO********" } ], "versionId": "e6q8isknpcp7********" }
   

Delete the resources you createdDelete the resources you created

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:

• Yandex Lockbox secret
• Service account

See alsoSee also

• Secure storage of GitLab CI passwords as Yandex Lockbox secrets
• Getting the Lockbox secret value on the GitHub side