Skip to content

GitLab project access token

Rotates a GitLab project access token on a cron schedule.

Kind: GitLabProjectAccessToken API group: token-rotator.org Versions: v1alpha1 Status: implemented.

API credential

The CR references a Kubernetes Secret via spec.apiTokenSecretRef. That Secret must hold a GitLab token with permission to create and revoke project access tokens on the target project — typically a maintainer-or-higher personal access token, group access token, or a bootstrapping project access token.

Required scopes: api.

Rotating the bootstrap credential itself

See Guides › Bootstrap credentials.

Example

apiVersion: token-rotator.org/v1alpha1
kind: GitLabProjectAccessToken
metadata:
  name: ci-token
spec:
  project: mygroup/myproject
  accessLevel: Maintainer
  scopes: [api, read_registry]
  rotationSchedule: "0 0 1 * *"    # monthly, midnight UTC
  rotationStrategy: Immediate
  apiTokenSecretRef:
    name: gitlab-api-credentials
    key: token
  export:
    type: Secret
    name: gitlab-ci-token

Status

  • status.lastRotationTime — when the last successful rotation completed.
  • status.nextRotationTime — when the next rotation will occur.
  • status.currentTokenRef — the Secret holding the current token value.
  • status.conditions — Ready, with reason/message on failure.

Gotchas

  • Lifetime. The minted token's expiry is set to 2 × rotationInterval, giving a missed reconcile a second chance before consumers break.
  • Access level mapping. accessLevel: Maintainer maps to GitLab's integer 40. See the GitLab API reference for the full mapping.
  • Revocation is idempotent. A 404 from GitLab on revoke is treated as success (previously revoked or never existed).