diff options
Diffstat (limited to 'doc/development/application_secrets.md')
| -rw-r--r-- | doc/development/application_secrets.md | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/doc/development/application_secrets.md b/doc/development/application_secrets.md index abc5ff7b985..92b18f5ad78 100644 --- a/doc/development/application_secrets.md +++ b/doc/development/application_secrets.md @@ -1,7 +1,7 @@ --- stage: none group: unassigned -info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#designated-technical-writers +info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments --- # Application secrets @@ -16,20 +16,21 @@ This page is a development guide for application secrets. | `otp_key_base` | The base key for One Time Passwords, described in [User management](../raketasks/user_management.md#rotate-two-factor-authentication-encryption-key) | |`db_key_base` | The base key to encrypt the data for `attr_encrypted` columns | |`openid_connect_signing_key` | The singing key for OpenID Connect | +| `encrypted_settings_key_base` | The base key to encrypt settings files with | ## Where the secrets are stored |Installation type |Location | |--- |--- | |Omnibus |[`/etc/gitlab/gitlab-secrets.json`](https://docs.gitlab.com/omnibus/settings/backups.html#backup-and-restore-omnibus-gitlab-configuration) | -|Cloud Native GitLab Charts |[Kubernets Secrets](https://gitlab.com/gitlab-org/charts/gitlab/-/blob/f65c3d37fc8cf09a7987544680413552fb666aac/doc/installation/secrets.md#gitlab-rails-secret)| +|Cloud Native GitLab Charts |[Kubernetes Secrets](https://gitlab.com/gitlab-org/charts/gitlab/-/blob/f65c3d37fc8cf09a7987544680413552fb666aac/doc/installation/secrets.md#gitlab-rails-secret)| |Source |`<path-to-gitlab-rails>/config/secrets.yml` (Automatically generated by [01_secret_token.rb](https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/01_secret_token.rb)) | ## Warning: Before you add a new secret to application secrets Before you add a new secret to [`config/initializers/01_secret_token.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/01_secret_token.rb), -make sure you also update Omnibus GitLab or updates will fail. Omnibus is responsible for writing the `secrets.yml` file. -If Omnibus doesn't know about a secret, Rails will attempt to write to the file, but this will fail because Rails doesn't have write access. +make sure you also update Omnibus GitLab or updates fail. Omnibus is responsible for writing the `secrets.yml` file. +If Omnibus doesn't know about a secret, Rails attempts to write to the file, but this fails because Rails doesn't have write access. The same rules apply to Cloud Native GitLab charts, you must update the charts at first. In case you need the secret to have same value on each node (which is usually the case) you need to make sure it's configured for all GitLab.com environments prior to changing this file. @@ -43,5 +44,5 @@ GitLab.com environments prior to changing this file. ## Further iteration -We might deprecate/remove this automatic secret generation '01_secret_token.rb' in the future. -Please see [this issue](https://gitlab.com/gitlab-org/gitlab/-/issues/222690) for more information. +We may either deprecate or remove this automatic secret generation `01_secret_token.rb` in the future. +Please see [issue 222690](https://gitlab.com/gitlab-org/gitlab/-/issues/222690) for more information. |