search

defenseunicorns / uds-package-gitlab

🏭 UDS GitLab Zarf Package
Apache License 2.0
5 stars 3 forks source link

[ADR] Select a credential rotation solution for GitLab #53

Open Racer159 opened 4 months ago

Racer159 commented 4 months ago

Is your feature request related to a problem? Please describe.

As Ashton I want to be able to rotate GitLab credentials safely so that I can meet IA requirements and build a more secure system.

Describe the solution you'd like

We should determine a way to automate the rotation of credentials for GitLab so that we can reduce the cognitive load in doing these rotations. This should include:

These should be written in a simple ADR to capture why the final solution was chosen and a follow on implementation issue should be created.

Additional context

This is needed to meet IA requirements and we should do this in as automated a way as possible likely using Zarf, UDS CLI or Pepr.

naveensrinivasan commented 4 months ago

It's important to note that the approach will vary depending on whether you are using a SaaS or non-SaaS solution.

For example, SaaS solutions offer an option called "IAM Roles for Service Accounts (IRSA)," which can help reduce the attack vector without the need to manage tokens. These tokens are short-lived and obtained through STS.

Therefore, when creating an ADR, we should focus on a SaaS solution. Thoughts?

zachariahmiller commented 4 months ago

We are already using irsa (pod identity webhook) with RKE2 for the saas environment, but not for all things due to some issues with for example rds and how connection pooling works with irsa. Agree it will differ between saas and non-saae.

Racer159 commented 3 months ago

blocked on https://github.com/defenseunicorns/uds-software-factory/issues/45