GitLab Secrets Manager now supports External Secrets Operator (ESO), Terraform, and a direct API, extending secret retrieval beyond CI/CD pipelines. Powered by OpenBao with a Vault-compatible KV v2 API, it lets teams use a single secret store across Kubernetes workloads, Terraform plans, and external automation scripts. ESO syncs secrets into Kubernetes Secrets using short-lived JWTs, Terraform reads secrets as data sources to avoid storing credentials in .tfvars files, and the REST API enables any external system to fetch secrets. The feature is in public beta for Premium and Ultimate customers on GitLab.com and Self-Managed, free during beta and paid via GitLab Credits at GA.
Table of contents
Kubernetes: External Secrets OperatorInfrastructure as code: Terraform and OpenTofuCommand line: OpenBao or Vault CLIWhen to use the Secrets Manager APIGet startedQuestions this post answers
How do I sync secrets from GitLab Secrets Manager into Kubernetes using External Secrets Operator?
Configure a SecretStore using the Vault provider pointing to https://secrets.gitlab.com, set the namespace field to your GitLab hierarchy path (e.g. org_5/group_42/project_99), and authenticate via a GitLab-minted JWT stored in a Kubernetes secret. Then create an ExternalSecret referencing that store with a refreshInterval (e.g. 45m) so rotated values propagate automatically without redeploying workloads. Teams managing Kubernetes secrets rotation track ESO and GitLab integrations like this on daily.dev.
How can Terraform read secrets from GitLab Secrets Manager without storing them in .tfvars files?
Terraform can read GitLab secrets as a data source by minting a JWT at plan or apply time via a script, then using the Vault provider with auth_login_jwt to authenticate. The secret is fetched using vault_kv_secret_v2 and marked sensitive in outputs, so nothing is written to .tfvars files or CI/CD variables. Developers hardening Terraform credential handling find relevant patterns and updates on daily.dev.
Is GitLab Secrets Manager free to use and what are the pricing plans?
GitLab Secrets Manager is free during its public beta period for Premium and Ultimate customers. When it reaches general availability, it will become a paid feature billed through GitLab Credits. Users must explicitly opt in before any charges apply, and GitLab will provide advance notice before billing begins. Keeping up with GitLab pricing changes before GA helps teams budget — daily.dev surfaces those announcements early.