GitLab Secrets Manager now supports External Secrets Operator (ESO) and Terraform, extending secure secret retrieval beyond CI/CD pipelines. Powered by OpenBao, GitLab Secrets Manager provides a single source of truth for secrets across your software delivery chain. GitLab Secrets Manager exposes a Vault-compatible KV v2 API and you configure it using the Vault provider. vault kv get -mount= < path > "<secrets_path>/<secret_name>"When to use the Secrets Manager APIFor automation that doesn't fit GitLab CI/CD, Kubernetes, or Terraform, the Secrets Manager API lets any external system fetch secrets from the Secrets Manager, instead of hardcoding credentials or maintaining separate var files. Copy # Request JWT token using Service Account RESPONSE = $( curl --silent --request POST \ --header "PRIVATE-TOKEN: <your_access_token>" \ --url "https://gitlab.example.com/api/v4/projects/<project_id>/secrets_manager/access_token" ) SERVER = $( echo " $RESPONSE " | jq --raw-output .provider.vault.server ) NAMESPACE = $( echo " $RESPONSE " | jq --raw-output .provider.vault.namespace ) MOUNT = $( echo " $RESPONSE " | jq --raw-output .provider.vault.path ) SECRETS_PATH = $( echo " $RESPONSE " | jq --raw-output .provider.vault.secrets_path ) AUTH_PATH = $( echo " $RESPONSE " | jq --raw-output .provider.vault.auth.jwt.path ) ROLE = $( echo " $RESPONSE " | jq --raw-output .provider.vault.auth.jwt.role ) JWT = $( echo " $RESPONSE " | jq --raw-output .provider.vault.auth.jwt.token ) # Exchange the JWT for a short-lived OpenBao token.