How to create a Managed GitLab Account Credential Provider

The Manage GitLab Account Credential Provider uses the GitLab Service Account Credential Provider Integration to allow you to manage the credential lifecycle of your GitLab service accounts.

Prerequisites

You must have the following to create a Managed GitLab Account Credential Provider:

• A completed GitLab Service Account Credential Provider Integration

Create a Managed GitLab Account Credential Provider

To create a Managed GitLab Account Credential Provider, follow these steps:

1. Log into your Aembit Tenant, and go to Credential Providers in the left sidebar.

2. (Optional) In the top right corner, select the Resource Set that you want this Credential Provider to reside.

3. Click + New, which displays the Credential Provider pop out menu.

4. Enter a Name and optional Description.

5. Under Credential Type, select Managed GitLab Account, revealing more fields.

6. Fill out the remaining fields:

   1. Select GitLab Integration: Select a GitLab Service Account integration you've already configured.

      note

      If the Select GitLab Integration dropdown menu is empty, you either:

      • May not have any GitLab Service Account integrations configured yet. See GitLab Service Account to create one.

      • May need to change Resource Sets.

   2. Service Account Username: Enter a username you want to use for the Aembit service account in GitLab.

      Leave this field blank for Aembit to automatically create a username in the following format: Aembit_<Credential_Provider_Name>_managed_service_account

   3. GitLab Group IDs or Paths: Enter the group ID or group path. If entering more than one, separate them with commas (for example: parent-group/subgroup,34,56).

   4. GitLab Project IDs or Paths: Enter the project ID or project path. If entering more than one, separate them with commas (my-project.345678,my-other-project).

   5. Access Level: Enter the GitLab Access Level you want your GitLab service account to have.

   6. Scope: Enter the GitLab Personal Access Token (PAT) Scopes you want the GitLab service account to have. When entering more than one, separate them with spaces (for example: api read_user k8s_proxy).

   7. Lifetime: Enter the number of days you want credentials to remain active.

   The form should look similar to the following screenshot:

   

7. Click Save.

   Aembit displays the new Credential Provider in the list of Credential Providers.

Verify the Credential Provider

In your Aembit Tenant

To verify that you successfully created the Managed GitLab Account Credential Provider and it's communicating with GitLab:

1. In your Aembit Tenant, go to Credential Providers.

2. (Optional) In the top right corner, select the Resource Set that your Credential Provider resides.

3. Select your newly created Credential Provider.

   Scroll down to see all the details provided by GitLab for this Service Account.

   You should see something similar to the following screenshot:

   

(Optional) In the GitLab Admin area

To verify that the Managed GitLab Account Credential Provider successfully creates service account in GitLab:

1. Log into your administrator GitLab account associated with your GitLab Service Account integration.

2. Go to Admin area -> Overview -> Users.

3. Select the service account formatted like this: Aembit_<credential_provider_name>_managed_service_account.

4. On the Account tab, verify that the Username and ID match the values shown in the Credential Provider in the Aembit UI.

   Similar to the following screenshot:

   

5. On the Groups and projects tab, verify that the groups, projects, and access levels match what you entered in the Managed GitLab Account form. GitLab displays these in a table showing Groups with their associated Projects and Access Levels.

   Similar to the following screenshot: