1---
2stage: none
3group: unassigned
4info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
5---
6
7# Application secrets
8
9This page is a development guide for application secrets.
10
11## Secret entries
12
13|Entry                             |Description                                                        |
14|---                               |---                                                                |
15|`secret_key_base`                 | The base key to be used for generating a various secrets          |
16| `otp_key_base`                   | The base key for One Time Passwords, described in [User management](../raketasks/user_management.md#rotate-two-factor-authentication-encryption-key)              |
17|`db_key_base`                     | The base key to encrypt the data for `attr_encrypted` columns     |
18|`openid_connect_signing_key`      | The signing key for OpenID Connect                                |
19| `encrypted_settings_key_base`    | The base key to encrypt settings files with                       |
20
21## Where the secrets are stored
22
23|Installation type                  |Location                                                          |
24|---                                |---                                                               |
25|Omnibus                            |[`/etc/gitlab/gitlab-secrets.json`](https://docs.gitlab.com/omnibus/settings/backups.html#backup-and-restore-omnibus-gitlab-configuration)                                 |
26|Cloud Native GitLab Charts         |[Kubernetes Secrets](https://gitlab.com/gitlab-org/charts/gitlab/-/blob/f65c3d37fc8cf09a7987544680413552fb666aac/doc/installation/secrets.md#gitlab-rails-secret)|
27|Source                             |`<path-to-gitlab-rails>/config/secrets.yml` (Automatically generated by [01_secret_token.rb](https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/01_secret_token.rb))                       |
28
29## Warning: Before you add a new secret to application secrets
30
31Before you add a new secret to [`config/initializers/01_secret_token.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/01_secret_token.rb),
32make sure you also update Omnibus GitLab or updates fail. Omnibus is responsible for writing the `secrets.yml` file.
33If Omnibus doesn't know about a secret, Rails attempts to write to the file, but this fails because Rails doesn't have write access.
34The same rules apply to Cloud Native GitLab charts, you must update the charts at first.
35In case you need the secret to have same value on each node (which is usually the case) you need to make sure it's configured for all
36GitLab.com environments prior to changing this file.
37
38**Examples**
39
40- [Change for source installation](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/27581)
41- [Change for omnibus installation](https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/3267)
42- [Change for omnibus installation](https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/4158)
43- [Change for Cloud Native installation](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/1318)
44
45## Further iteration
46
47We may either deprecate or remove this automatic secret generation `01_secret_token.rb` in the future.
48Please see [issue 222690](https://gitlab.com/gitlab-org/gitlab/-/issues/222690) for more information.
49