Document Auto DevOps secret variables

Cross link from GitLab CI variable doc too

2 files changed, 45 insertions, 0 deletions

diff --git a/doc/ci/variables/README.md b/doc/ci/variables/README.md
index bbb63161acc..180eb2789d1 100644
--- a/doc/ci/variables/README.md
+++ b/doc/ci/variables/README.md
@@ -249,6 +249,18 @@ the project services that you are using to learn which variables they define.
 An example project service that defines deployment variables is the
 [Kubernetes integration](../../user/project/clusters/index.md#deployment-variables).
 
+## Auto DevOps application variables
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/issues/49056) in GitLab 11.7.
+
+You can configure Auto DevOps to pass CI variables to the running
+application by prefixing the key of the variable with `K8S_SECRET_`.
+
+These [prefixed
+variables](../../topics/autodevops/index.md#application-secret-variables) will
+then be available as environment variables on the running application
+container.
+
 ## Debug tracing
 
 > Introduced in GitLab Runner 1.7.
diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md
index b41f401e14c..2738e5d2005 100644
--- a/doc/topics/autodevops/index.md
+++ b/doc/topics/autodevops/index.md
@@ -528,6 +528,39 @@ can be used for permanent access to the registry.
 Note: **Note**
 When the GitLab Deploy Token has been manually revoked, it won't be automatically created.
 
+#### Application secret variables
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/issues/49056) in GitLab 11.7.
+
+Most applications would need to define secret variables that is
+accessible by the deployed application. GitLab CI variables are usually
+not available to the deployed application container. Starting in GitLab
+11.7, Auto DevOps will now detect variables where the key starts with
+`K8S_SECRET_` and make these prefixed variables available to the
+deployed application.
+
+To configure your application variables:
+
+1. Go to your project's **Settings > CI/CD**, then expand the section
+   called **Variables**
+
+2. Create a CI Variable, ensuring the key is prefixed with
+   `K8S_SECRET_`. For example, you can create a variable with key
+`K8S_SECRET_RAILS_MASTER_KEY`.
+
+Auto DevOps jobs for your project will now make the prefixed variables
+available as environment variables to the deployed applications. The
+environment variable key will have the prefix removed. Following the
+above example, deployed applications will now be able to use
+`RAILS_MASTER_KEY` as an environment variable.
+
+How this works: Auto DevOps first finds all prefixed CI variables. The
+prefix is then removed. A Kubernetes secret called
+`$CI_ENVIRONMENT_SLUG-secret` will be created in the `$KUBE_NAMESPACE`
+namespace containing the variables. This secret is then used when
+deploying your application to be loaded as environment variables in the
+container running the application.
+
 ### Auto Monitoring
 
 NOTE: **Note:**