---
credentials:
mcp_bearer:
description: "Bearer an MCP client must present to this role's adapter instance. Distinct from the credential the adapter presents upstream: holding a token the
application accepts says nothing about who called the adapter."
algorithm: alphanumeric
validation: "^[A-Za-z0-9]{32,}$"
length: 48
secret_key_base:
description: Rails secret key base used to verify signed cookies and tokens
algorithm: random_hex
validation: "^[a-f0-9]{128}$"
otp_key_base:
description: Key base encrypting two-factor authentication secrets
algorithm: random_hex
validation: "^[a-f0-9]{128}$"
db_key_base:
description: "Key base encrypting CI/CD variable values, terraform state, Pages TLS private keys, and integration and webhook credentials. settings.rb raises
MultipleDbKeyBaseError on a second key and upstream ships no re-encrypt task, so a rotation is one-way."
algorithm: random_hex
validation: "^[a-f0-9]{128}$"
rotatable: false
encrypted_settings_key_base:
description: Key base encrypting settings files
algorithm: random_hex
validation: "^[a-f0-9]{128}$"
active_record_encryption_primary_key:
description: Primary key for Active Record encrypted columns
algorithm: random_hex_16
validation: "^[a-f0-9]{32}$"
active_record_encryption_deterministic_key:
description: Deterministic key for Active Record encrypted columns
algorithm: random_hex_16
validation: "^[a-f0-9]{32}$"
active_record_encryption_key_derivation_salt:
description: "PBKDF2 salt every Active Record encryption key derives from. It has no list form, so rotating it voids the primary-key rotation list as well."
algorithm: random_hex_16
validation: "^[a-f0-9]{32}$"
rotatable: false
gitlab_shell_secret:
description: Shared token authenticating gitlab-shell and gitaly against the rails API
algorithm: alphanumeric
validation: "^[A-Za-z0-9]{64}$"
gitaly_token:
description: Auth token shared between rails and the gitaly gRPC listener
algorithm: alphanumeric
validation: "^[A-Za-z0-9]{64}$"
workhorse_secret:
description: 32-byte value shared between workhorse and rails, mounted base64-encoded
algorithm: random_hex_16
validation: "^[a-f0-9]{32}$"
openid_connect_signing_key:
description: RSA private key signing GitLab's own OpenID Connect provider tokens
algorithm: rsa_pem_2048
validation: "^-----BEGIN RSA PRIVATE KEY-----[\\s\\S]+-----END RSA PRIVATE KEY-----\\s*$"
