<p>I try to integrate vault and <em>gitlab</em>.</p>
<p><em>Vault</em> side is ok , and I try to locate vault in our <em>gitlab-ci.yaml</em> but I confused something.</p>
<p>Where is the location of <em>vault</em> in <em>yaml</em> ?</p>
<p>We use <em>gitlab ee</em> (community).</p>
<p>Our <em>yaml</em>:</p>
<pre><code>.kaniko-build:
  stage: build
  before_script:
    - mkdir -p /kaniko/.docker
    - |
      cat &lt;&lt;EOF &gt; /kaniko/.docker/config.json
        {
          &quot;auths&quot;:{
            &quot;${CI_REGISTRY}&quot;:{
              &quot;auth&quot;:&quot;$(printf &quot;%s:%s&quot; &quot;${CI_REGISTRY_USER}&quot; &quot;${CI_REGISTRY_PASSWORD}&quot; | base64 | tr -d '\n')&quot;
            },
            &quot;https://index.docker.io/v1/&quot;:{
              &quot;auth&quot;:&quot;$(printf &quot;%s:%s&quot; &quot;${DOCKERHUB_USERNAME}&quot; &quot;${DOCKERHUB_PASSWORD}&quot; | base64 | tr -d '\n')&quot;
            }
          }
        }
      EOF
    - cat /kaniko/.docker/config.json
  script:
    - &gt;-
      /kaniko/executor
      --context &quot;${CI_PROJECT_DIR}&quot;
      --dockerfile &quot;${DOCKERFILE_PATH}&quot;
      --destination &quot;${CI_REGISTRY_IMAGE}:${CI_PIPELINE_IID}&quot;
      --destination &quot;${CI_REGISTRY_IMAGE}:latest&quot;
      --cache
    - echo $(date) $(date)
  image:     
    name: gcr.io/kaniko-project/executor:v1.8.0-debug
    entrypoint: [&quot;&quot;]

test-build:
  extends: .kaniko-build
  when: manual
  variables:
    DOCKERFILE_PATH: &quot;devops/test/Dockerfile&quot;
  
  rules:
    - if: $CI_COMMIT_BRANCH
      exists:
        - devops/test/Dockerfile
  interruptible: true
</code></pre>

<p>If you've not already done so, you first need to configure vault for jwt authentication.</p>
<pre><code>vault auth enable -path=jwt/gitlab jwt
</code></pre>
<p>Then configure the new jwt auth with a token validation endpoint that references your gitlab instance.</p>
<pre><code>vault write auth/jwt/config \
jwks_url=&quot;https://gitlab.example.com/-/jwks&quot; \
bound_issuer=&quot;gitlab.example.com&quot;
</code></pre>
<p>Now in your gitlab-ci.yml, login to vault.</p>
<pre><code>- export VAULT_ADDR=&quot;https://gitlab.example.com&quot;
- export VAULT_TOKEN=&quot;$(vault write -field=token auth/jwt/gitlab/login role=SOME_ROLE_NAME jwt=$CI_JOB_JWT)&quot;
</code></pre>
<p>Next in your gitlab-ci.yml, retrieve the secret.</p>
<pre><code>- export EXAMPLE_SECRET=&quot;$(vault kv get -field=EXAMPLE_SECRET_KEY kv-v2/example/secret/path)&quot;
</code></pre>
<p>This is all covered in more detail in the official GitLab docs <a href="https://docs.gitlab.com/ee/ci/examples/authenticating-with-hashicorp-vault/" rel="nofollow noreferrer">here</a></p>
