[{"data":1,"prerenderedAt":1819},["ShallowReactive",2],{"/blog/simplify-your-cloud-account-management-for-kubernetes-access":3,"navigation-en-us":1034,"banner-en-us":1462,"footer-en-us":1472,"blog-post-authors-en-us-Viktor Nagy":1716,"blog-related-posts-en-us-simplify-your-cloud-account-management-for-kubernetes-access":1731,"blog-promotions-en-us":1756,"next-steps-en-us":1809},{"id":4,"title":5,"authors":6,"body":8,"category":1012,"date":1013,"description":1014,"extension":1015,"externalUrl":1016,"faq":1016,"featured":1017,"heroImage":1018,"meta":1019,"navigation":1017,"path":1020,"seo":1021,"slug":1026,"stem":1027,"tags":1028,"template":1032,"updatedDate":1016,"__hash__":1033},"blogPosts/en-us/blog/simplify-your-cloud-account-management-for-kubernetes-access.md","Simplify your cloud account management for Kubernetes access",[7],"Viktor Nagy",{"type":9,"value":10,"toc":1004},"minimark",[11,15,18,21,24,29,32,35,98,109,113,116,124,127,131,134,157,164,176,187,190,231,237,319,322,446,449,549,559,660,666,765,771,775,778,781,796,803,877,893,914,928,932,935,944,947,951,954,993,1000],[12,13,14],"p",{},"We hear you: Managing cloud accounts is risky, tedious, and time-consuming, but also a must-have in many situations. You might run your Kubernetes clusters with one of the hyperclouds, and your engineers need to access at least the non-production cluster to troubleshoot issues quickly and efficiently. Sometimes, you also need to give special, temporary access to engineers on a production cluster.",[12,16,17],{},"You have also told us that access requests might not come very often, but when they do, they are urgent, and given the high security requirements around the process, they can take close to a week to fulfill.",[12,19,20],{},"By giving access to your cloud infrastructure, you automatically expose yourself to risks. As a result, it's a best practice to restrict access only to the resources the given user must have access to. However, cloud identity and access management (IAM) is complex by nature.",[12,22,23],{},"If you are using Kubernetes and you need to give access specifically to your clusters only, GitLab can help. Your user will be able to identify with your cluster, so you can configure the Kubernetes role-based access controls (RBAC) to restrict their access within the cluster. With GitLab, and specifically the GitLab agent for Kubernetes, you can start at the last step and focus only on the RBAC aspect.",[25,26,28],"h2",{"id":27},"what-is-the-gitlab-agent-for-kubernetes","What is the GitLab agent for Kubernetes?",[12,30,31],{},"The GitLab agent for Kubernetes is a set of GitLab components that allows a permanent, bi-directional streaming channel between your GitLab instance and your Kubernetes cluster (one agent per cluster). Once the agent connection is configured, you can share it across projects and groups within your GitLab instance, allowing a single agent to serve all the access needs of a cluster.",[12,33,34],{},"Currently, the agent has several features to simplify your Kubernetes management tasks:",[36,37,38,48,57,66,75,83],"ul",{},[39,40,41,47],"li",{},[42,43,46],"a",{"href":44,"rel":45},"https://docs.gitlab.com/user/clusters/agent/ci_cd_workflow/",[],"Integrates with GitLab CI/CD"," for push-based deployments or regular cluster management jobs. The integration exposes a Kubernetes context per available agent in the Runner environment, and any tool that can take a context as an input (e.g. kubectl or helm CLI) can reach your cluster from the CI/CD jobs.",[39,49,50,51,56],{},"Integrates with the GitLab GUI, specifically the environment pages. Users can configure ",[42,52,55],{"href":53,"rel":54},"https://docs.gitlab.com/ci/environments/kubernetes_dashboard/",[],"an environment to show the Kubernetes resources"," available in a specific namespace, and even set up a Flux resource to track the reconciliation of your applications.",[39,58,59,60,65],{},"Enables users to use the GitLab-managed channel to ",[42,61,64],{"href":62,"rel":63},"https://docs.gitlab.com/user/clusters/agent/user_access/#access-a-cluster-with-the-kubernetes-api",[],"connect to the cluster from their local laptop",", without giving them cloud-specific Kubernetes access tokens.",[39,67,68,69,74],{},"Supports ",[42,70,73],{"href":71,"rel":72},"https://docs.gitlab.com/user/clusters/agent/gitops/#immediate-git-repository-reconciliation",[],"Flux GitRepository reconciliations"," by triggering a reconciliation automatically on new commits in repositories the agent can access.",[39,76,77,82],{},[42,78,81],{"href":79,"rel":80},"https://docs.gitlab.com/user/clusters/agent/vulnerabilities/",[],"Runs operational container scans"," and shows the reports in the GitLab UI.",[39,84,85,86,91,92,97],{},"Enables you to enrich the ",[42,87,90],{"href":88,"rel":89},"https://docs.gitlab.com/user/project/remote_development/",[],"remote development"," offering with ",[42,93,96],{"href":94,"rel":95},"https://docs.gitlab.com/user/workspace/",[],"workspaces",".",[99,100,101],"blockquote",{},[12,102,103,104,97],{},"Try simplifying your cloud account management for Kubernetes access today with ",[42,105,108],{"href":106,"rel":107},"https://gitlab.com/-/trials/new",[],"a free trial of GitLab Ultimate",[25,110,112],{"id":111},"the-agent-and-access-management","The agent and access management",[12,114,115],{},"The GitLab agent for Kubernetes, which is available for GitLab Ultimate and Premium, impersonates various GitLab-specific users when it acts on behalf of GitLab in the cluster.",[36,117,118,121],{},[39,119,120],{},"For the GitLab CI/CD integration, the agent impersonates the CI job as the user, and enriches the user with group specific metadata that describe the project and the group.",[39,122,123],{},"For the environment and local connections, the agent impersonates the GitLab user using the connection, and similarly to the CI/CD integration, the impersonated Kubernetes user is enriched with group specific metadata, like roles in configured groups.",[12,125,126],{},"As this article is about using the agent instead of cloud accounts for cluster access, let’s focus on the environment and local connections setup.",[25,128,130],{"id":129},"an-example-setup","An example setup",[12,132,133],{},"To offer a realistic setup, let’s assume that in our GitLab instance we have the following groups and projects:",[36,135,136,142,147,152],{},[39,137,138],{},[139,140,141],"code",{},"/app-dev-group/team-a/service-1",[39,143,144],{},[139,145,146],{},"/app-dev-group/team-a/service-2",[39,148,149],{},[139,150,151],{},"/app-dev-group/team-b/service-3",[39,153,154],{},[139,155,156],{},"/platform-group/clusters-project",[12,158,159,160,163],{},"In the above setup, the agents are registered against the ",[139,161,162],{},"clusters-project"," project and, in addition to other code, the project contains the agent configuration files:",[36,165,166,171],{},[39,167,168],{},[139,169,170],{},".gitlab/agents/dev-cluster/config.yaml",[39,172,173],{},[139,174,175],{},".gitlab/agents/prod-cluster/config.yaml",[12,177,178,179,182,183,186],{},"The ",[139,180,181],{},"dev-cluster"," and ",[139,184,185],{},"prod-cluster"," directory names are actually the agent names as well, and registered agents and related events can be seen within the projects “Operations/Kubernetes clusters” menu item. The agent offers some minimal features by default, without a configuration file. To benefit from the user access features and to share the agent connection across projects and groups, a configuration file is required.",[12,188,189],{},"Let’s assume that we want to configure the agents in the following way:",[36,191,192,217],{},[39,193,194,195],{},"For the development cluster connection:",[36,196,197,204,210],{},[39,198,199,200,203],{},"Everyone with at least developer role in team-a should be able to read-write their team specific namespace ",[139,201,202],{},"team-a"," only.",[39,205,206,207,209],{},"Everyone with group owner role in team-a should have namespace admin rights on the ",[139,208,202],{}," namespace only.",[39,211,212,213,216],{},"Members of ",[139,214,215],{},"team-b"," should not be able to access the cluster.",[39,218,219,220],{},"For the production cluster connection:",[36,221,222,227],{},[39,223,224,225,203],{},"Everyone with at least developer role in team-a should be able to read-only their team specific namespace ",[139,226,202],{},[39,228,212,229,216],{},[139,230,215],{},[12,232,233,234,236],{},"For the development cluster, the above setup requires an agent configuration file in ",[139,235,170],{}," as follows:",[238,239,244],"pre",{"className":240,"code":241,"language":242,"meta":243,"style":243},"language-yaml shiki shiki-themes github-light","user_access:\n  access_as:\n    user: {}\n  groups:\n    - id: app-dev-group/team-a # group_id=1\n    - id: app-dev-group/team-b # group_id=2\n\n","yaml","",[139,245,246,259,267,276,284,304],{"__ignoreMap":243},[247,248,251,255],"span",{"class":249,"line":250},"line",1,[247,252,254],{"class":253},"shJU0","user_access",[247,256,258],{"class":257},"sgsFI",":\n",[247,260,262,265],{"class":249,"line":261},2,[247,263,264],{"class":253},"  access_as",[247,266,258],{"class":257},[247,268,270,273],{"class":249,"line":269},3,[247,271,272],{"class":253},"    user",[247,274,275],{"class":257},": {}\n",[247,277,279,282],{"class":249,"line":278},4,[247,280,281],{"class":253},"  groups",[247,283,258],{"class":257},[247,285,287,290,293,296,300],{"class":249,"line":286},5,[247,288,289],{"class":257},"    - ",[247,291,292],{"class":253},"id",[247,294,295],{"class":257},": ",[247,297,299],{"class":298},"sYBdl","app-dev-group/team-a",[247,301,303],{"class":302},"sAwPA"," # group_id=1\n",[247,305,307,309,311,313,316],{"class":249,"line":306},6,[247,308,289],{"class":257},[247,310,292],{"class":253},[247,312,295],{"class":257},[247,314,315],{"class":298},"app-dev-group/team-b",[247,317,318],{"class":302}," # group_id=2\n",[12,320,321],{},"In this code snippet we added the group ID of the specific groups in a comment. We will need these IDs in the following Kubernetes RBAC definitions:",[238,323,325],{"className":240,"code":324,"language":242,"meta":243,"style":243},"apiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n  name: team-a-dev-can-edit\n  namespace: team-a\nroleRef:\n  name: edit\n  kind: ClusterRole\n  apiGroup: rbac.authorization.k8s.io\nsubjects:\n  - name: gitlab:group_role:1:developer\n    kind: Group\n\n",[139,326,327,337,347,354,364,374,381,391,402,413,421,435],{"__ignoreMap":243},[247,328,329,332,334],{"class":249,"line":250},[247,330,331],{"class":253},"apiVersion",[247,333,295],{"class":257},[247,335,336],{"class":298},"rbac.authorization.k8s.io/v1\n",[247,338,339,342,344],{"class":249,"line":261},[247,340,341],{"class":253},"kind",[247,343,295],{"class":257},[247,345,346],{"class":298},"RoleBinding\n",[247,348,349,352],{"class":249,"line":269},[247,350,351],{"class":253},"metadata",[247,353,258],{"class":257},[247,355,356,359,361],{"class":249,"line":278},[247,357,358],{"class":253},"  name",[247,360,295],{"class":257},[247,362,363],{"class":298},"team-a-dev-can-edit\n",[247,365,366,369,371],{"class":249,"line":286},[247,367,368],{"class":253},"  namespace",[247,370,295],{"class":257},[247,372,373],{"class":298},"team-a\n",[247,375,376,379],{"class":249,"line":306},[247,377,378],{"class":253},"roleRef",[247,380,258],{"class":257},[247,382,384,386,388],{"class":249,"line":383},7,[247,385,358],{"class":253},[247,387,295],{"class":257},[247,389,390],{"class":298},"edit\n",[247,392,394,397,399],{"class":249,"line":393},8,[247,395,396],{"class":253},"  kind",[247,398,295],{"class":257},[247,400,401],{"class":298},"ClusterRole\n",[247,403,405,408,410],{"class":249,"line":404},9,[247,406,407],{"class":253},"  apiGroup",[247,409,295],{"class":257},[247,411,412],{"class":298},"rbac.authorization.k8s.io\n",[247,414,416,419],{"class":249,"line":415},10,[247,417,418],{"class":253},"subjects",[247,420,258],{"class":257},[247,422,424,427,430,432],{"class":249,"line":423},11,[247,425,426],{"class":257},"  - ",[247,428,429],{"class":253},"name",[247,431,295],{"class":257},[247,433,434],{"class":298},"gitlab:group_role:1:developer\n",[247,436,438,441,443],{"class":249,"line":437},12,[247,439,440],{"class":253},"    kind",[247,442,295],{"class":257},[247,444,445],{"class":298},"Group\n",[12,447,448],{},"and...",[238,450,452],{"className":240,"code":451,"language":242,"meta":243,"style":243},"apiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n  name: team-a-owner-can-admin\n  namespace: team-a\nroleRef:\n  name: admin\n  kind: ClusterRole\n  apiGroup: rbac.authorization.k8s.io\nsubjects:\n  - name: gitlab:group_role:1:owner\n    kind: Group\n\n",[139,453,454,462,470,476,485,493,499,508,516,524,530,541],{"__ignoreMap":243},[247,455,456,458,460],{"class":249,"line":250},[247,457,331],{"class":253},[247,459,295],{"class":257},[247,461,336],{"class":298},[247,463,464,466,468],{"class":249,"line":261},[247,465,341],{"class":253},[247,467,295],{"class":257},[247,469,346],{"class":298},[247,471,472,474],{"class":249,"line":269},[247,473,351],{"class":253},[247,475,258],{"class":257},[247,477,478,480,482],{"class":249,"line":278},[247,479,358],{"class":253},[247,481,295],{"class":257},[247,483,484],{"class":298},"team-a-owner-can-admin\n",[247,486,487,489,491],{"class":249,"line":286},[247,488,368],{"class":253},[247,490,295],{"class":257},[247,492,373],{"class":298},[247,494,495,497],{"class":249,"line":306},[247,496,378],{"class":253},[247,498,258],{"class":257},[247,500,501,503,505],{"class":249,"line":383},[247,502,358],{"class":253},[247,504,295],{"class":257},[247,506,507],{"class":298},"admin\n",[247,509,510,512,514],{"class":249,"line":393},[247,511,396],{"class":253},[247,513,295],{"class":257},[247,515,401],{"class":298},[247,517,518,520,522],{"class":249,"line":404},[247,519,407],{"class":253},[247,521,295],{"class":257},[247,523,412],{"class":298},[247,525,526,528],{"class":249,"line":415},[247,527,418],{"class":253},[247,529,258],{"class":257},[247,531,532,534,536,538],{"class":249,"line":423},[247,533,426],{"class":257},[247,535,429],{"class":253},[247,537,295],{"class":257},[247,539,540],{"class":298},"gitlab:group_role:1:owner\n",[247,542,543,545,547],{"class":249,"line":437},[247,544,440],{"class":253},[247,546,295],{"class":257},[247,548,445],{"class":298},[12,550,551,552,555,556,558],{},"The above two code snippets can be applied to the cluster with the GitLab Flux integration or manually via ",[139,553,554],{},"kubectl",". They describe role bindings for the ",[139,557,202],{}," group members. It’s important to note that only the groups and projects from the agent configuration file can be targeted as RBAC groups. Therefore, the following RBAC will not work as the impersonated user resources don’t know about the referenced projects:",[238,560,562],{"className":240,"code":561,"language":242,"meta":243,"style":243},"apiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n  name: team-a-dev-can-edit\n  namespace: team-a\nroleRef:\n  name: edit\n  kind: ClusterRole\n  apiGroup: rbac.authorization.k8s.io\nsubjects:\n  - name: gitlab:project_role:3:developer # app-dev-group/team-a/service-1 project ID is 3\n    kind: Group\n\n",[139,563,564,572,580,586,594,602,608,616,624,632,638,652],{"__ignoreMap":243},[247,565,566,568,570],{"class":249,"line":250},[247,567,331],{"class":253},[247,569,295],{"class":257},[247,571,336],{"class":298},[247,573,574,576,578],{"class":249,"line":261},[247,575,341],{"class":253},[247,577,295],{"class":257},[247,579,346],{"class":298},[247,581,582,584],{"class":249,"line":269},[247,583,351],{"class":253},[247,585,258],{"class":257},[247,587,588,590,592],{"class":249,"line":278},[247,589,358],{"class":253},[247,591,295],{"class":257},[247,593,363],{"class":298},[247,595,596,598,600],{"class":249,"line":286},[247,597,368],{"class":253},[247,599,295],{"class":257},[247,601,373],{"class":298},[247,603,604,606],{"class":249,"line":306},[247,605,378],{"class":253},[247,607,258],{"class":257},[247,609,610,612,614],{"class":249,"line":383},[247,611,358],{"class":253},[247,613,295],{"class":257},[247,615,390],{"class":298},[247,617,618,620,622],{"class":249,"line":393},[247,619,396],{"class":253},[247,621,295],{"class":257},[247,623,401],{"class":298},[247,625,626,628,630],{"class":249,"line":404},[247,627,407],{"class":253},[247,629,295],{"class":257},[247,631,412],{"class":298},[247,633,634,636],{"class":249,"line":415},[247,635,418],{"class":253},[247,637,258],{"class":257},[247,639,640,642,644,646,649],{"class":249,"line":423},[247,641,426],{"class":257},[247,643,429],{"class":253},[247,645,295],{"class":257},[247,647,648],{"class":298},"gitlab:project_role:3:developer",[247,650,651],{"class":302}," # app-dev-group/team-a/service-1 project ID is 3\n",[247,653,654,656,658],{"class":249,"line":437},[247,655,440],{"class":253},[247,657,295],{"class":257},[247,659,445],{"class":298},[12,661,662,663,665],{},"For the production cluster we need the same agent configuration under ",[139,664,175],{}," and the following RBAC definitions:",[238,667,669],{"className":240,"code":668,"language":242,"meta":243,"style":243},"apiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n  name: team-a-dev-can-read\n  namespace: team-a\nroleRef:\n  name: view\n  kind: ClusterRole\n  apiGroup: rbac.authorization.k8s.io\nsubjects:\n  - name: gitlab:group_role:1:developer\n    kind: Group\n\n",[139,670,671,679,687,693,702,710,716,725,733,741,747,757],{"__ignoreMap":243},[247,672,673,675,677],{"class":249,"line":250},[247,674,331],{"class":253},[247,676,295],{"class":257},[247,678,336],{"class":298},[247,680,681,683,685],{"class":249,"line":261},[247,682,341],{"class":253},[247,684,295],{"class":257},[247,686,346],{"class":298},[247,688,689,691],{"class":249,"line":269},[247,690,351],{"class":253},[247,692,258],{"class":257},[247,694,695,697,699],{"class":249,"line":278},[247,696,358],{"class":253},[247,698,295],{"class":257},[247,700,701],{"class":298},"team-a-dev-can-read\n",[247,703,704,706,708],{"class":249,"line":286},[247,705,368],{"class":253},[247,707,295],{"class":257},[247,709,373],{"class":298},[247,711,712,714],{"class":249,"line":306},[247,713,378],{"class":253},[247,715,258],{"class":257},[247,717,718,720,722],{"class":249,"line":383},[247,719,358],{"class":253},[247,721,295],{"class":257},[247,723,724],{"class":298},"view\n",[247,726,727,729,731],{"class":249,"line":393},[247,728,396],{"class":253},[247,730,295],{"class":257},[247,732,401],{"class":298},[247,734,735,737,739],{"class":249,"line":404},[247,736,407],{"class":253},[247,738,295],{"class":257},[247,740,412],{"class":298},[247,742,743,745],{"class":249,"line":415},[247,744,418],{"class":253},[247,746,258],{"class":257},[247,748,749,751,753,755],{"class":249,"line":423},[247,750,426],{"class":257},[247,752,429],{"class":253},[247,754,295],{"class":257},[247,756,434],{"class":298},[247,758,759,761,763],{"class":249,"line":437},[247,760,440],{"class":253},[247,762,295],{"class":257},[247,764,445],{"class":298},[12,766,767,768,770],{},"These configurations allow project owners to set up the environment pages so members of ",[139,769,202],{}," will be able to see the status of their cluster workloads in real-time and they should be able to access the cluster from their local computers using their favorite Kubernetes tools.",[25,772,774],{"id":773},"explaining-the-magic","Explaining the magic",[12,776,777],{},"In the previous section, you learned how to set up role bindings for group members with specific roles. In this section, let's dive into the impersonated user and their attributes.",[12,779,780],{},"While Kubernetes does not have a User or Group resource, its authentication and authorization scheme pretends to have it. Users have a username, can belong to groups, and can have other extra attributes.",[12,782,783,784,787,788,791,792,795],{},"The impersonated GitLab user carries the ",[139,785,786],{},"gitlab:username:\u003Cusername>"," in the cluster. For example, if our imaginary user Béla has the GitLab username ",[139,789,790],{},"bela",", then in the cluster the impersonated user will be called ",[139,793,794],{},"gitlab:username:bela",". This allows targeting of a specific user in the cluster.",[12,797,798,799,802],{},"Every impersonated user belongs to the ",[139,800,801],{},"gitlab:user"," group. Moreover, for every project and group listed in the agent configuration, we check the current user’s role and add it as a group. This is more easily understood through an example, so let’s modify a little bit the agent configuration we used above.",[238,804,806],{"className":240,"code":805,"language":242,"meta":243,"style":243},"user_access:\n  access_as:\n    user: {}\n  projects:\n    - id: platform-group/clusters-project # project_id=1\n  groups:\n    - id: app-dev-group/team-a # group_id=1\n    - id: app-dev-group/team-b # group_id=2\n\n",[139,807,808,814,820,826,833,847,853,865],{"__ignoreMap":243},[247,809,810,812],{"class":249,"line":250},[247,811,254],{"class":253},[247,813,258],{"class":257},[247,815,816,818],{"class":249,"line":261},[247,817,264],{"class":253},[247,819,258],{"class":257},[247,821,822,824],{"class":249,"line":269},[247,823,272],{"class":253},[247,825,275],{"class":257},[247,827,828,831],{"class":249,"line":278},[247,829,830],{"class":253},"  projects",[247,832,258],{"class":257},[247,834,835,837,839,841,844],{"class":249,"line":286},[247,836,289],{"class":257},[247,838,292],{"class":253},[247,840,295],{"class":257},[247,842,843],{"class":298},"platform-group/clusters-project",[247,845,846],{"class":302}," # project_id=1\n",[247,848,849,851],{"class":249,"line":306},[247,850,281],{"class":253},[247,852,258],{"class":257},[247,854,855,857,859,861,863],{"class":249,"line":383},[247,856,289],{"class":257},[247,858,292],{"class":253},[247,860,295],{"class":257},[247,862,299],{"class":298},[247,864,303],{"class":302},[247,866,867,869,871,873,875],{"class":249,"line":393},[247,868,289],{"class":257},[247,870,292],{"class":253},[247,872,295],{"class":257},[247,874,315],{"class":298},[247,876,318],{"class":302},[12,878,879,880,882,883,885,886,889,890,892],{},"For the sake of example, let’s assume the contrived setup that our user Béla is a maintainer in the ",[139,881,843],{}," project, is a developer in ",[139,884,299],{}," group, and an owner of the ",[139,887,888],{},"app-dev-group/team-a/service-1"," project. In this case, the impersonated Kubernetes user ",[139,891,794],{}," will belong to the following groups:",[36,894,895,899,904,909],{},[39,896,897],{},[139,898,801],{},[39,900,901],{},[139,902,903],{},"gitlab:project_role:1:developer",[39,905,906],{},[139,907,908],{},"gitlab:project_role:1:maintainer",[39,910,911],{},[139,912,913],{},"gitlab:group_role:1:developer",[12,915,916,917,919,920,182,922,924,925,927],{},"What happens is that we check Béla’s role in every project and group listed in the agent configuration, and set up all the roles that Béla has there. As Béla is a maintainer in ",[139,918,843],{}," (project ID 1), we add him to both the ",[139,921,903],{},[139,923,908],{}," groups. Note as well, that we did not add any groups for the ",[139,926,888],{}," project, only its parent group that appears in the agent configuration.",[25,929,931],{"id":930},"simplifying-cluster-management","Simplifying cluster management",[12,933,934],{},"Setting up the agent and configuring the cluster as presented above is everything you need to model the presented access requirements in the cluster. You don’t have to manage cloud accounts or add in-cluster account management tools like Dex. The agent for Kubernetes and its user impersonation features can simplify your infrastructure management work.",[12,936,937,938,940,941,943],{},"When new people join your company, once they become members of the ",[139,939,202],{}," they immediately get access to the clusters as configured above. Similarly, as someone leaves your company, you just have to remove them from the group and their access will be disabled. As we mentioned, the agent supports local access to the clusters, too. As that local access runs through the GitLab-side agent component, it will be disabled as well when users are removed from the ",[139,942,202],{}," group.",[12,945,946],{},"Setting up the agent takes around two-to-five minutes per cluster. Setting up the required RBAC might take another five minutes. In 10 minutes, users can get controlled access to a cluster, saving days of work and decreasing the risks associated with cloud accounts.",[25,948,950],{"id":949},"get-started-today","Get started today",[12,952,953],{},"If you want to try this approach and allow access to your colleagues to some of your clusters without managing cloud accounts, the following documentation pages should help you to get started:",[36,955,956,965,985],{},[39,957,958,959,964],{},"On self-managed GitLab instances, you might need to ",[42,960,963],{"href":961,"rel":962},"https://docs.gitlab.com/administration/clusters/kas/",[],"configure the GitLab-side component (called KAS)"," of the agent for Kubernetes first.",[39,966,967,968,973,974,979,980,97],{},"You can learn more about ",[42,969,972],{"href":970,"rel":971},"https://docs.gitlab.com/user/clusters/agent/",[],"all the Kubernetes management features here",", or you can immediately dive in by ",[42,975,978],{"href":976,"rel":977},"https://docs.gitlab.com/user/clusters/agent/install/",[],"installing an agent",", and ",[42,981,984],{"href":982,"rel":983},"https://docs.gitlab.com/user/clusters/agent/user_access/",[],"granting users access to Kubernetes",[39,986,987,988,992],{},"You’ll likely want to ",[42,989,991],{"href":53,"rel":990},[],"configure a Kubernetes dashboard"," for your deployed application.",[99,994,995],{},[12,996,103,997,97],{},[42,998,108],{"href":106,"rel":999},[],[1001,1002,1003],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":243,"searchDepth":261,"depth":261,"links":1005},[1006,1007,1008,1009,1010,1011],{"id":27,"depth":261,"text":28},{"id":111,"depth":261,"text":112},{"id":129,"depth":261,"text":130},{"id":773,"depth":261,"text":774},{"id":930,"depth":261,"text":931},{"id":949,"depth":261,"text":950},"security","2024-03-19","In this tutorial, learn how to use the GitLab agent for Kubernetes and its user impersonation features for secure cluster access.\n\n","md",null,true,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749670563/Blog/Hero%20Images/cloudcomputing.jpg",{},"/en-us/blog/simplify-your-cloud-account-management-for-kubernetes-access",{"title":5,"description":1014,"ogTitle":5,"ogDescription":1014,"noIndex":1022,"ogImage":1018,"ogUrl":1023,"ogSiteName":1024,"ogType":1025,"canonicalUrls":1023},false,"https://about.gitlab.com/blog/simplify-your-cloud-account-management-for-kubernetes-access","https://about.gitlab.com","article","simplify-your-cloud-account-management-for-kubernetes-access","en-us/blog/simplify-your-cloud-account-management-for-kubernetes-access",[1029,1012,1030,1031],"cloud native","kubernetes","tutorial","BlogPost","UYoVLcH0czEBm2eyQ09qkv27VDyZ44rqwUwCJbDSQQQ",{"logo":1035,"freeTrial":1040,"sales":1045,"login":1050,"items":1055,"search":1382,"minimal":1413,"duo":1432,"switchNav":1441,"pricingDeployment":1452},{"config":1036},{"href":1037,"dataGaName":1038,"dataGaLocation":1039},"/","gitlab logo","header",{"text":1041,"config":1042},"Get free trial",{"href":1043,"dataGaName":1044,"dataGaLocation":1039},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":1046,"config":1047},"Request a demo",{"href":1048,"dataGaName":1049,"dataGaLocation":1039},"/sales/?contact-topic=request-demo","sales",{"text":1051,"config":1052},"Sign in",{"href":1053,"dataGaName":1054,"dataGaLocation":1039},"https://gitlab.com/users/sign_in/","sign in",[1056,1085,1185,1190,1304,1360],{"text":1057,"config":1058,"menu":1060},"Platform",{"dataNavLevelOne":1059},"platform",{"type":1061,"columns":1062},"cards",[1063,1069,1077],{"title":1057,"description":1064,"link":1065},"The intelligent orchestration platform for DevSecOps",{"text":1066,"config":1067},"Explore our Platform",{"href":1068,"dataGaName":1059,"dataGaLocation":1039},"/platform/",{"title":1070,"description":1071,"link":1072},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":1073,"config":1074},"Meet GitLab Duo",{"href":1075,"dataGaName":1076,"dataGaLocation":1039},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1078,"description":1079,"link":1080},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":1081,"config":1082},"Learn more",{"href":1083,"dataGaName":1084,"dataGaLocation":1039},"/why-gitlab/","why gitlab",{"text":1086,"left":1017,"config":1087,"menu":1089},"Product",{"dataNavLevelOne":1088},"solutions",{"type":1090,"link":1091,"columns":1095,"feature":1164},"lists",{"text":1092,"config":1093},"View all Solutions",{"href":1094,"dataGaName":1088,"dataGaLocation":1039},"/solutions/",[1096,1120,1143],{"title":1097,"description":1098,"link":1099,"items":1104},"Automation","CI/CD and automation to accelerate deployment",{"config":1100},{"icon":1101,"href":1102,"dataGaName":1103,"dataGaLocation":1039},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[1105,1109,1112,1116],{"text":1106,"config":1107},"CI/CD",{"href":1108,"dataGaLocation":1039,"dataGaName":1106},"/solutions/continuous-integration/",{"text":1070,"config":1110},{"href":1075,"dataGaLocation":1039,"dataGaName":1111},"gitlab duo agent platform - product menu",{"text":1113,"config":1114},"Source Code Management",{"href":1115,"dataGaLocation":1039,"dataGaName":1113},"/solutions/source-code-management/",{"text":1117,"config":1118},"Automated Software Delivery",{"href":1102,"dataGaLocation":1039,"dataGaName":1119},"Automated software delivery",{"title":1121,"description":1122,"link":1123,"items":1128},"Security","Deliver code faster without compromising security",{"config":1124},{"href":1125,"dataGaName":1126,"dataGaLocation":1039,"icon":1127},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1129,1133,1138],{"text":1130,"config":1131},"Application Security Testing",{"href":1125,"dataGaName":1132,"dataGaLocation":1039},"Application security testing",{"text":1134,"config":1135},"Software Supply Chain Security",{"href":1136,"dataGaLocation":1039,"dataGaName":1137},"/solutions/supply-chain/","Software supply chain security",{"text":1139,"config":1140},"Software Compliance",{"href":1141,"dataGaName":1142,"dataGaLocation":1039},"/solutions/software-compliance/","software compliance",{"title":1144,"link":1145,"items":1150},"Measurement",{"config":1146},{"icon":1147,"href":1148,"dataGaName":1149,"dataGaLocation":1039},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[1151,1155,1159],{"text":1152,"config":1153},"Visibility & Measurement",{"href":1148,"dataGaLocation":1039,"dataGaName":1154},"Visibility and Measurement",{"text":1156,"config":1157},"Value Stream Management",{"href":1158,"dataGaLocation":1039,"dataGaName":1156},"/solutions/value-stream-management/",{"text":1160,"config":1161},"Analytics & Insights",{"href":1162,"dataGaLocation":1039,"dataGaName":1163},"/solutions/analytics-and-insights/","Analytics and insights",{"title":1165,"type":1090,"items":1166},"GitLab for",[1167,1173,1179],{"text":1168,"config":1169},"Enterprise",{"icon":1170,"href":1171,"dataGaLocation":1039,"dataGaName":1172},"Building","/enterprise/","enterprise",{"text":1174,"config":1175},"Small Business",{"icon":1176,"href":1177,"dataGaLocation":1039,"dataGaName":1178},"Work","/small-business/","small business",{"text":1180,"config":1181},"Public Sector",{"icon":1182,"href":1183,"dataGaLocation":1039,"dataGaName":1184},"Organization","/solutions/public-sector/","public sector",{"text":1186,"config":1187},"Pricing",{"href":1188,"dataGaName":1189,"dataGaLocation":1039,"dataNavLevelOne":1189},"/pricing/","pricing",{"text":1191,"config":1192,"menu":1194},"Resources",{"dataNavLevelOne":1193},"resources",{"type":1090,"link":1195,"columns":1199,"feature":1293},{"text":1196,"config":1197},"View all resources",{"href":1198,"dataGaName":1193,"dataGaLocation":1039},"/resources/",[1200,1233,1260],{"title":1201,"items":1202},"Getting started",[1203,1208,1213,1218,1223,1228],{"text":1204,"config":1205},"Install",{"href":1206,"dataGaName":1207,"dataGaLocation":1039},"/install/","install",{"text":1209,"config":1210},"Quick start guides",{"href":1211,"dataGaName":1212,"dataGaLocation":1039},"/get-started/","quick setup checklists",{"text":1214,"config":1215},"Learn",{"href":1216,"dataGaLocation":1039,"dataGaName":1217},"https://university.gitlab.com/","learn",{"text":1219,"config":1220},"Product documentation",{"href":1221,"dataGaName":1222,"dataGaLocation":1039},"https://docs.gitlab.com/","product documentation",{"text":1224,"config":1225},"Best practice videos",{"href":1226,"dataGaName":1227,"dataGaLocation":1039},"/getting-started-videos/","best practice videos",{"text":1229,"config":1230},"Integrations",{"href":1231,"dataGaName":1232,"dataGaLocation":1039},"/integrations/","integrations",{"title":1234,"items":1235},"Discover",[1236,1241,1246,1251,1255],{"text":1237,"config":1238},"Customer success stories",{"href":1239,"dataGaName":1240,"dataGaLocation":1039},"/customers/","customer success stories",{"text":1242,"config":1243},"Blog",{"href":1244,"dataGaName":1245,"dataGaLocation":1039},"/blog/","blog",{"text":1247,"config":1248},"Demo Hub",{"href":1249,"dataGaName":1250,"dataGaLocation":1039},"/demo-hub/","demo hub",{"text":1252,"config":1253},"The Source",{"href":1254,"dataGaName":1245,"dataGaLocation":1039},"/the-source/",{"text":1256,"config":1257},"Remote",{"href":1258,"dataGaName":1259,"dataGaLocation":1039},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1261,"items":1262},"Connect",[1263,1268,1273,1278,1283,1288],{"text":1264,"config":1265},"GitLab Services",{"href":1266,"dataGaName":1267,"dataGaLocation":1039},"/services/","services",{"text":1269,"config":1270},"Contribute",{"href":1271,"dataGaName":1272,"dataGaLocation":1039},"https://contributors.gitlab.com","contribute",{"text":1274,"config":1275},"Community",{"href":1276,"dataGaName":1277,"dataGaLocation":1039},"/community/","community",{"text":1279,"config":1280},"Forum",{"href":1281,"dataGaName":1282,"dataGaLocation":1039},"https://forum.gitlab.com/","forum",{"text":1284,"config":1285},"Events",{"href":1286,"dataGaName":1287,"dataGaLocation":1039},"/events/","events",{"text":1289,"config":1290},"Partners",{"href":1291,"dataGaName":1292,"dataGaLocation":1039},"/partners/","partners",{"config":1294,"title":1297,"text":1298,"link":1299},{"background":1295,"textColor":1296},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1300,"config":1301},"Read the latest",{"href":1302,"dataGaName":1303,"dataGaLocation":1039},"/whats-new/","whats new",{"text":1305,"config":1306,"menu":1308},"Company",{"dataNavLevelOne":1307},"company",{"type":1090,"columns":1309},[1310],{"items":1311},[1312,1317,1323,1325,1330,1335,1340,1345,1350,1355],{"text":1313,"config":1314},"About",{"href":1315,"dataGaName":1316,"dataGaLocation":1039},"/company/","about",{"text":1318,"config":1319,"footerGa":1322},"Jobs",{"href":1320,"dataGaName":1321,"dataGaLocation":1039},"/jobs/","jobs",{"dataGaName":1321},{"text":1284,"config":1324},{"href":1286,"dataGaName":1287,"dataGaLocation":1039},{"text":1326,"config":1327},"Leadership",{"href":1328,"dataGaName":1329,"dataGaLocation":1039},"/company/team/e-group/","leadership",{"text":1331,"config":1332},"Handbook",{"href":1333,"dataGaName":1334,"dataGaLocation":1039},"https://handbook.gitlab.com/","handbook",{"text":1336,"config":1337},"Investor relations",{"href":1338,"dataGaName":1339,"dataGaLocation":1039},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1341,"config":1342},"Trust Center",{"href":1343,"dataGaName":1344,"dataGaLocation":1039},"/security/","trust center",{"text":1346,"config":1347},"AI Transparency Center",{"href":1348,"dataGaName":1349,"dataGaLocation":1039},"/ai-transparency-center/","ai transparency center",{"text":1351,"config":1352},"Newsletter",{"href":1353,"dataGaName":1354,"dataGaLocation":1039},"/company/contact/#contact-forms","newsletter",{"text":1356,"config":1357},"Press",{"href":1358,"dataGaName":1359,"dataGaLocation":1039},"/press/","press",{"text":1361,"config":1362,"menu":1363},"Contact us",{"dataNavLevelOne":1307},{"type":1090,"columns":1364},[1365],{"items":1366},[1367,1372,1377],{"text":1368,"config":1369},"Talk to sales",{"href":1370,"dataGaName":1371,"dataGaLocation":1039},"/sales/","talk to sales",{"text":1373,"config":1374},"Support portal",{"href":1375,"dataGaName":1376,"dataGaLocation":1039},"https://support.gitlab.com/hc/en-us","support portal",{"text":1378,"config":1379},"Customer portal",{"href":1380,"dataGaName":1381,"dataGaLocation":1039},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1383,"login":1384,"suggestions":1391},"Close",{"text":1385,"link":1386},"To search repositories and projects, login to",{"text":1387,"config":1388},"gitlab.com",{"href":1053,"dataGaName":1389,"dataGaLocation":1390},"search login","search",{"text":1392,"default":1393},"Suggestions",[1394,1396,1400,1402,1406,1410],{"text":1070,"config":1395},{"href":1075,"dataGaName":1070,"dataGaLocation":1390},{"text":1397,"config":1398},"Code Suggestions (AI)",{"href":1399,"dataGaName":1397,"dataGaLocation":1390},"/solutions/code-suggestions/",{"text":1106,"config":1401},{"href":1108,"dataGaName":1106,"dataGaLocation":1390},{"text":1403,"config":1404},"GitLab on AWS",{"href":1405,"dataGaName":1403,"dataGaLocation":1390},"/partners/technology-partners/aws/",{"text":1407,"config":1408},"GitLab on Google Cloud",{"href":1409,"dataGaName":1407,"dataGaLocation":1390},"/partners/technology-partners/google-cloud-platform/",{"text":1411,"config":1412},"Why GitLab?",{"href":1083,"dataGaName":1411,"dataGaLocation":1390},{"freeTrial":1414,"mobileIcon":1419,"desktopIcon":1424,"secondaryButton":1427},{"text":1415,"config":1416},"Start free trial",{"href":1417,"dataGaName":1044,"dataGaLocation":1418},"https://gitlab.com/-/trials/new/","nav",{"altText":1420,"config":1421},"Gitlab Icon",{"src":1422,"dataGaName":1423,"dataGaLocation":1418},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1420,"config":1425},{"src":1426,"dataGaName":1423,"dataGaLocation":1418},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1428,"config":1429},"Get Started",{"href":1430,"dataGaName":1431,"dataGaLocation":1418},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1433,"mobileIcon":1437,"desktopIcon":1439},{"text":1434,"config":1435},"Learn more about GitLab Duo",{"href":1075,"dataGaName":1436,"dataGaLocation":1418},"gitlab duo",{"altText":1420,"config":1438},{"src":1422,"dataGaName":1423,"dataGaLocation":1418},{"altText":1420,"config":1440},{"src":1426,"dataGaName":1423,"dataGaLocation":1418},{"button":1442,"mobileIcon":1447,"desktopIcon":1449},{"text":1443,"config":1444},"/switch",{"href":1445,"dataGaName":1446,"dataGaLocation":1418},"#contact","switch",{"altText":1420,"config":1448},{"src":1422,"dataGaName":1423,"dataGaLocation":1418},{"altText":1420,"config":1450},{"src":1451,"dataGaName":1423,"dataGaLocation":1418},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1453,"mobileIcon":1458,"desktopIcon":1460},{"text":1454,"config":1455},"Back to pricing",{"href":1188,"dataGaName":1456,"dataGaLocation":1418,"icon":1457},"back to pricing","GoBack",{"altText":1420,"config":1459},{"src":1422,"dataGaName":1423,"dataGaLocation":1418},{"altText":1420,"config":1461},{"src":1426,"dataGaName":1423,"dataGaLocation":1418},{"title":1463,"titleMobile":1464,"button":1465,"config":1470},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":1081,"config":1466},{"href":1467,"dataGaName":1468,"dataGaLocation":1469},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1471,"disabled":1022},"release",{"data":1473},{"text":1474,"source":1475,"edit":1481,"contribute":1486,"config":1491,"items":1496,"minimal":1705},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1476,"config":1477},"View page source",{"href":1478,"dataGaName":1479,"dataGaLocation":1480},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1482,"config":1483},"Edit this page",{"href":1484,"dataGaName":1485,"dataGaLocation":1480},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1487,"config":1488},"Please contribute",{"href":1489,"dataGaName":1490,"dataGaLocation":1480},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1492,"facebook":1493,"youtube":1494,"linkedin":1495},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1497,1544,1597,1641,1673],{"title":1186,"links":1498,"subMenu":1513},[1499,1503,1508],{"text":1500,"config":1501},"View plans",{"href":1188,"dataGaName":1502,"dataGaLocation":1480},"view plans",{"text":1504,"config":1505},"Why Premium?",{"href":1506,"dataGaName":1507,"dataGaLocation":1480},"/pricing/premium/","why premium",{"text":1509,"config":1510},"Why Ultimate?",{"href":1511,"dataGaName":1512,"dataGaLocation":1480},"/pricing/ultimate/","why ultimate",[1514],{"title":1515,"links":1516},"Contact Us",[1517,1520,1522,1524,1529,1534,1539],{"text":1518,"config":1519},"Contact sales",{"href":1370,"dataGaName":1049,"dataGaLocation":1480},{"text":1373,"config":1521},{"href":1375,"dataGaName":1376,"dataGaLocation":1480},{"text":1378,"config":1523},{"href":1380,"dataGaName":1381,"dataGaLocation":1480},{"text":1525,"config":1526},"Status",{"href":1527,"dataGaName":1528,"dataGaLocation":1480},"https://status.gitlab.com/","status",{"text":1530,"config":1531},"Terms of use",{"href":1532,"dataGaName":1533,"dataGaLocation":1480},"/terms/","terms of use",{"text":1535,"config":1536},"Privacy statement",{"href":1537,"dataGaName":1538,"dataGaLocation":1480},"/privacy/","privacy statement",{"text":1540,"config":1541},"Cookie preferences",{"dataGaName":1542,"dataGaLocation":1480,"id":1543,"isOneTrustButton":1017},"cookie preferences","ot-sdk-btn",{"title":1086,"links":1545,"subMenu":1554},[1546,1550],{"text":1547,"config":1548},"DevSecOps platform",{"href":1068,"dataGaName":1549,"dataGaLocation":1480},"devsecops platform",{"text":1551,"config":1552},"AI-Assisted Development",{"href":1075,"dataGaName":1553,"dataGaLocation":1480},"ai-assisted development",[1555],{"title":1556,"links":1557},"Topics",[1558,1563,1568,1573,1578,1583,1587,1592],{"text":1559,"config":1560},"CICD",{"href":1561,"dataGaName":1562,"dataGaLocation":1480},"/topics/ci-cd/","cicd",{"text":1564,"config":1565},"GitOps",{"href":1566,"dataGaName":1567,"dataGaLocation":1480},"/topics/gitops/","gitops",{"text":1569,"config":1570},"DevOps",{"href":1571,"dataGaName":1572,"dataGaLocation":1480},"/topics/devops/","devops",{"text":1574,"config":1575},"Version Control",{"href":1576,"dataGaName":1577,"dataGaLocation":1480},"/topics/version-control/","version control",{"text":1579,"config":1580},"DevSecOps",{"href":1581,"dataGaName":1582,"dataGaLocation":1480},"/topics/devsecops/","devsecops",{"text":1584,"config":1585},"Cloud Native",{"href":1586,"dataGaName":1029,"dataGaLocation":1480},"/topics/cloud-native/",{"text":1588,"config":1589},"AI for Coding",{"href":1590,"dataGaName":1591,"dataGaLocation":1480},"/topics/devops/ai-for-coding/","ai for coding",{"text":1593,"config":1594},"Agentic AI",{"href":1595,"dataGaName":1596,"dataGaLocation":1480},"/topics/agentic-ai/","agentic ai",{"title":1598,"links":1599},"Solutions",[1600,1602,1604,1609,1613,1616,1620,1623,1625,1628,1631,1636],{"text":1130,"config":1601},{"href":1125,"dataGaName":1130,"dataGaLocation":1480},{"text":1119,"config":1603},{"href":1102,"dataGaName":1103,"dataGaLocation":1480},{"text":1605,"config":1606},"Agile development",{"href":1607,"dataGaName":1608,"dataGaLocation":1480},"/solutions/agile-delivery/","agile delivery",{"text":1610,"config":1611},"SCM",{"href":1115,"dataGaName":1612,"dataGaLocation":1480},"source code management",{"text":1559,"config":1614},{"href":1108,"dataGaName":1615,"dataGaLocation":1480},"continuous integration & delivery",{"text":1617,"config":1618},"Value stream management",{"href":1158,"dataGaName":1619,"dataGaLocation":1480},"value stream management",{"text":1564,"config":1621},{"href":1622,"dataGaName":1567,"dataGaLocation":1480},"/solutions/gitops/",{"text":1168,"config":1624},{"href":1171,"dataGaName":1172,"dataGaLocation":1480},{"text":1626,"config":1627},"Small business",{"href":1177,"dataGaName":1178,"dataGaLocation":1480},{"text":1629,"config":1630},"Public sector",{"href":1183,"dataGaName":1184,"dataGaLocation":1480},{"text":1632,"config":1633},"Education",{"href":1634,"dataGaName":1635,"dataGaLocation":1480},"/solutions/education/","education",{"text":1637,"config":1638},"Financial services",{"href":1639,"dataGaName":1640,"dataGaLocation":1480},"/solutions/finance/","financial services",{"title":1191,"links":1642},[1643,1645,1647,1649,1652,1654,1657,1659,1661,1663,1665,1667,1669,1671],{"text":1204,"config":1644},{"href":1206,"dataGaName":1207,"dataGaLocation":1480},{"text":1209,"config":1646},{"href":1211,"dataGaName":1212,"dataGaLocation":1480},{"text":1214,"config":1648},{"href":1216,"dataGaName":1217,"dataGaLocation":1480},{"text":1219,"config":1650},{"href":1221,"dataGaName":1651,"dataGaLocation":1480},"docs",{"text":1242,"config":1653},{"href":1244,"dataGaName":1245,"dataGaLocation":1480},{"text":1655,"config":1656},"What's new",{"href":1302,"dataGaName":1303,"dataGaLocation":1480},{"text":1237,"config":1658},{"href":1239,"dataGaName":1240,"dataGaLocation":1480},{"text":1256,"config":1660},{"href":1258,"dataGaName":1259,"dataGaLocation":1480},{"text":1264,"config":1662},{"href":1266,"dataGaName":1267,"dataGaLocation":1480},{"text":1269,"config":1664},{"href":1271,"dataGaName":1272,"dataGaLocation":1480},{"text":1274,"config":1666},{"href":1276,"dataGaName":1277,"dataGaLocation":1480},{"text":1279,"config":1668},{"href":1281,"dataGaName":1282,"dataGaLocation":1480},{"text":1284,"config":1670},{"href":1286,"dataGaName":1287,"dataGaLocation":1480},{"text":1289,"config":1672},{"href":1291,"dataGaName":1292,"dataGaLocation":1480},{"title":1305,"links":1674},[1675,1677,1679,1681,1683,1685,1689,1694,1696,1698,1700],{"text":1313,"config":1676},{"href":1315,"dataGaName":1307,"dataGaLocation":1480},{"text":1318,"config":1678},{"href":1320,"dataGaName":1321,"dataGaLocation":1480},{"text":1326,"config":1680},{"href":1328,"dataGaName":1329,"dataGaLocation":1480},{"text":1331,"config":1682},{"href":1333,"dataGaName":1334,"dataGaLocation":1480},{"text":1336,"config":1684},{"href":1338,"dataGaName":1339,"dataGaLocation":1480},{"text":1686,"config":1687},"Sustainability",{"href":1688,"dataGaName":1686,"dataGaLocation":1480},"/sustainability/",{"text":1690,"config":1691},"Diversity, inclusion and belonging (DIB)",{"href":1692,"dataGaName":1693,"dataGaLocation":1480},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1341,"config":1695},{"href":1343,"dataGaName":1344,"dataGaLocation":1480},{"text":1351,"config":1697},{"href":1353,"dataGaName":1354,"dataGaLocation":1480},{"text":1356,"config":1699},{"href":1358,"dataGaName":1359,"dataGaLocation":1480},{"text":1701,"config":1702},"Modern Slavery Transparency Statement",{"href":1703,"dataGaName":1704,"dataGaLocation":1480},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1706},[1707,1710,1713],{"text":1708,"config":1709},"Terms",{"href":1532,"dataGaName":1533,"dataGaLocation":1480},{"text":1711,"config":1712},"Cookies",{"dataGaName":1542,"dataGaLocation":1480,"id":1543,"isOneTrustButton":1017},{"text":1714,"config":1715},"Privacy",{"href":1537,"dataGaName":1538,"dataGaLocation":1480},[1717],{"id":1718,"title":7,"body":1016,"config":1719,"content":1721,"description":1016,"extension":1725,"meta":1726,"navigation":1017,"path":1727,"seo":1728,"stem":1729,"__hash__":1730},"blogAuthors/en-us/blog/authors/viktor-nagy.yml",{"template":1720},"BlogAuthor",{"name":7,"config":1722},{"headshot":1723,"ctfId":1724},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749662918/Blog/Author%20Headshots/nagy-headshot.jpg","nagyvgitlab","yml",{},"/en-us/blog/authors/viktor-nagy",{},"en-us/blog/authors/viktor-nagy","rM3QZ5iaPa1fk9rDH9Dq-owlsuuFm699I03jWP1dUY4",[1732,1740,1748],{"title":1733,"description":1734,"heroImage":1735,"category":1012,"date":1736,"authors":1737,"slug":1739,"externalUrl":1016},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1738],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1741,"description":1742,"heroImage":1735,"category":1012,"date":1743,"authors":1744,"slug":1747,"externalUrl":1016},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1745,1746],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1749,"description":1750,"heroImage":1751,"category":1012,"date":1752,"authors":1753,"slug":1755,"externalUrl":1016},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1754],"Alisa Ho","claude-security-and-gitlab",{"promotions":1757},[1758,1772,1784,1795],{"id":1759,"categories":1760,"header":1762,"text":1763,"button":1764,"image":1769},"ai-modernization",[1761],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1765,"config":1766},"Get your AI maturity score",{"href":1767,"dataGaName":1768,"dataGaLocation":1245},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1770},{"src":1771},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1773,"categories":1774,"header":1776,"text":1763,"button":1777,"image":1781},"devops-modernization",[1775,1582],"product","Are you just managing tools or shipping innovation?",{"text":1778,"config":1779},"Get your DevOps maturity score",{"href":1780,"dataGaName":1768,"dataGaLocation":1245},"/assessments/devops-modernization-assessment/",{"config":1782},{"src":1783},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1785,"categories":1786,"header":1787,"text":1763,"button":1788,"image":1792},"security-modernization",[1012],"Are you trading speed for security?",{"text":1789,"config":1790},"Get your security maturity score",{"href":1791,"dataGaName":1768,"dataGaLocation":1245},"/assessments/security-modernization-assessment/",{"config":1793},{"src":1794},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1796,"paths":1797,"header":1800,"text":1801,"button":1802,"image":1807},"github-azure-migration",[1798,1799],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1803,"config":1804},"See how GitLab compares to GitHub",{"href":1805,"dataGaName":1806,"dataGaLocation":1245},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1808},{"src":1783},{"header":1810,"blurb":1811,"button":1812,"secondaryButton":1817},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1813,"config":1814},"Get your free trial",{"href":1815,"dataGaName":1044,"dataGaLocation":1816},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1518,"config":1818},{"href":1370,"dataGaName":1049,"dataGaLocation":1816},1786803765349]