Secure CI/CD Using JSON Web Token (JWT)
summary
Shows how to stop embedding secrets in CI by using JWT with OIDC so GitLab CI jobs can exchange a short-lived ID token for cloud or Vault credentials; demonstrates both native GitLab–HashiCorp Vault integration and a JWT-based CLI flow that requests an access token and then pulls secrets. Claims include pipeline/project IDs and branch so policies enforce claim-based fine-grain access. Setup requires one-time OIDC trust and policy work and relies on 5-minute expiry tokens to limit leak risk.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:21What's a secret?
- 2:09Common use case
- 2:50Secrets Management challenge arises
- 4:06Challenges-Secret sprawl
- 5:02Software is all about speed
- 7:13Secrets as environment variables
- 23:31Recap
related talks
08mLightning Talk: Don't Wait, Secure your DevOps Processes Using Open Standar...
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
25mSecure Your Terraform Deploys in GitLab-CI with HashiCorp Vault
18mCodify Your JWT-OIDC Vault Auth Method with Terraform
17mOIDC and CICD: Why Your CI Pipeline Is Your Greatest Security Threat
20mSecuring OIDC Federation in CI/CD Workflows
38mUsing OIDC With HashiCorp Vault and GitHub Actions
25mBetter Together: JWT and Vault in Modern Apps