Secrets Management
Secrets Management tests how credentials are stored, injected, masked, and detected in GitLab. The exam focuses on CI/CD variables, external secret managers, OIDC, and secret detection rather than generic password advice.
CI/CD variables
Variables can be defined at instance, group, project, pipeline, or job level. More specific definitions generally override broader ones. Two attributes matter most: protected variables are only exposed to pipelines on protected branches or tags; masked variables have their values filtered from job logs. Masking has constraints: values must meet length and character rules and cannot contain newlines, so a masked variable can still leak if a job transforms it before printing. Environment scope limits a variable to a deployment environment.
External secrets and OIDC
Instead of storing a long-lived credential in GitLab, a job can request an OIDC ID token and exchange it with a secret manager. The job declares id_tokens with an audience, then uses secrets to fetch a value from HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. The secret is injected as a variable for that job. This reduces stored credentials but still requires correct trust configuration in the external provider.
Secret detection
Secret Detection scans commits and repository history for tokens and keys. Push protection can block a push containing a detected secret before it lands, depending on configuration. Detection is not remediation: a finding means the credential should be revoked and rotated.
Worked example
A job needs a database password from Vault. It defines an ID token with the Vault audience, grants the Vault role trust to that audience and project, and maps DATABASE_PASSWORD under secrets to the Vault path. The password is not stored in GitLab. If the job echoes it, masking may filter the literal value, but any transformation could bypass masking.
Traps
Masked does not mean encrypted or hidden from the job. Protected variables are unavailable on unprotected feature branches, which often explains a failed pipeline. Secret Detection does not rotate credentials. External secrets require network access and provider-side trust; the GitLab side alone is not enough.