Vault with GitLab CI

Run your deployment through gops vault run so Vault injects secrets only into the deploy command.

Configure the pipeline

Add GOPS_API_KEY as a protected secret in GitLab CI, and set GOPS_PROJECT_ID as a protected variable. The API key must have permission to export Vault secrets for that project.

Deploy with Vault

Add this to .gitlab-ci.yml. Change --path, --env, and npm run deploy to match your application.

image: node:20

deploy:
  stage: deploy
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  script:
    - npm install --global @getgitops/cli
    - npm ci
    - gops vault run --api-url https://cloud.getgitops.com/api --api-key "$GOPS_API_KEY" --project-id "$GOPS_PROJECT_ID" --path / --env production -- npm run deploy

The command fetches secrets from Vault, makes them available only for the deploy process, and does not write an environment file to the repository or CI workspace.

See the official GitLab CI documentation for its secret and variable configuration.