Kubernetes registry credentials that expire on their own
A GitLab deploy token in an imagePullSecret is a long-lived credential sitting in a namespace, and it does not have to be.
← All tags
vault
What a GitLab token can be depends on which GitLab you ask
Access levels arrive in GitLab releases, so validating them without knowing the version gets you a plausible error at the wrong time.
Configuring the thing that makes tokens needs a token
The GitLab secrets engine needs a GitLab token to start, which makes provisioning it from terraform more awkward than it looks.
A Vault secrets engine for GitLab tokens
GitLab tokens live in CI variables for a year at a time, and nobody remembers which ones are still there.