[{"data":1,"prerenderedAt":1483},["ShallowReactive",2],{"/blog/understanding-kubernestes-rbac":3,"navigation-en-us":697,"banner-en-us":1124,"footer-en-us":1134,"blog-post-authors-en-us-Abubakar Siddiq Ango":1378,"blog-related-posts-en-us-understanding-kubernestes-rbac":1393,"blog-promotions-en-us":1419,"next-steps-en-us":1473},{"id":4,"title":5,"authors":6,"body":8,"category":676,"date":677,"description":678,"extension":679,"externalUrl":680,"faq":680,"featured":681,"heroImage":682,"meta":683,"navigation":684,"path":685,"seo":686,"slug":690,"stem":691,"tags":692,"template":695,"updatedDate":680,"__hash__":696},"blogPosts/en-us/blog/understanding-kubernestes-rbac.md","What you need to know about Kubernetes RBAC",[7],"Abubakar Siddiq Ango",{"type":9,"value":10,"toc":665},"minimark",[11,15,20,36,39,42,46,49,52,57,194,197,226,230,319,338,342,345,350,468,472,573,577,586,608,612,627,631,661],[12,13,14],"p",{},"Managing access to resources is an essential part of ensuring the reliability, security, and efficiency of any infrastructure, but can quickly get complicated to manage. With Kubernetes, attribute-based access control (ABAC) is very powerful but complex, while role-based access control (RBAC) makes it easier to manage permissions using kubectl and the Kubernetes API directly. This post shares how to get started with RBAC and some best practices to adopt.",[16,17,19],"h2",{"id":18},"rbac-vs-abac","RBAC vs ABAC",[12,21,22,23,29,30,35],{},"RBAC made beta ",[24,25,28],"a",{"href":26,"rel":27},"https://kubernetes.io/blog/2017/04/rbac-support-in-kubernetes/",[],"release with Kubernetes 1.6"," and general availability ",[24,31,34],{"href":32,"rel":33},"https://kubernetes.io/blog/2017/10/using-rbac-generally-available-18/",[],"with 1.8",". A fundamental building block of Kubernetes, RBAC is an authorization mechanism for controlling how the Kubernetes API is accessed using permissions.",[12,37,38],{},"RBAC is now preferred over ABAC, which is difficult to manage and understand. ABAC also requires SSH and root access to make authorization policy changes.",[12,40,41],{},"Resource management can be delegated using RBAC without giving away SSH access to the Cluster Master VM and permission policies can be configured using kubectl or the Kubernetes API itself.",[16,43,45],{"id":44},"rbac-resources","RBAC resources",[12,47,48],{},"Using RBAC, Authorizations can be given using a set of permissions that can be limited within a namespace or the entire cluster. To do this, you can define A set of permission is called a Role, which is defined within a namespace. If you want A role that is cluster-wide, this is defined as a ClusterRole.",[12,50,51],{},"Below, you can see an example of a role definition:",[53,54,56],"h3",{"id":55},"role","Role",[58,59,64],"pre",{"className":60,"code":61,"language":62,"meta":63,"style":63},"language-yaml shiki shiki-themes github-light","kind: Role\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n  namespace: default\n  name: pod-reader\nrules:\n- apiGroups: [\"\"] # \"\" indicates the core API group\n  resources: [\"pods\"]\n  verbs: [\"get\", \"watch\", \"list\"]\n\n","yaml","",[65,66,67,84,95,104,115,126,134,156,170],"code",{"__ignoreMap":63},[68,69,72,76,80],"span",{"class":70,"line":71},"line",1,[68,73,75],{"class":74},"shJU0","kind",[68,77,79],{"class":78},"sgsFI",": ",[68,81,83],{"class":82},"sYBdl","Role\n",[68,85,87,90,92],{"class":70,"line":86},2,[68,88,89],{"class":74},"apiVersion",[68,91,79],{"class":78},[68,93,94],{"class":82},"rbac.authorization.k8s.io/v1\n",[68,96,98,101],{"class":70,"line":97},3,[68,99,100],{"class":74},"metadata",[68,102,103],{"class":78},":\n",[68,105,107,110,112],{"class":70,"line":106},4,[68,108,109],{"class":74},"  namespace",[68,111,79],{"class":78},[68,113,114],{"class":82},"default\n",[68,116,118,121,123],{"class":70,"line":117},5,[68,119,120],{"class":74},"  name",[68,122,79],{"class":78},[68,124,125],{"class":82},"pod-reader\n",[68,127,129,132],{"class":70,"line":128},6,[68,130,131],{"class":74},"rules",[68,133,103],{"class":78},[68,135,137,140,143,146,149,152],{"class":70,"line":136},7,[68,138,139],{"class":78},"- ",[68,141,142],{"class":74},"apiGroups",[68,144,145],{"class":78},": [",[68,147,148],{"class":82},"\"\"",[68,150,151],{"class":78},"] ",[68,153,155],{"class":154},"sAwPA","# \"\" indicates the core API group\n",[68,157,159,162,164,167],{"class":70,"line":158},8,[68,160,161],{"class":74},"  resources",[68,163,145],{"class":78},[68,165,166],{"class":82},"\"pods\"",[68,168,169],{"class":78},"]\n",[68,171,173,176,178,181,184,187,189,192],{"class":70,"line":172},9,[68,174,175],{"class":74},"  verbs",[68,177,145],{"class":78},[68,179,180],{"class":82},"\"get\"",[68,182,183],{"class":78},", ",[68,185,186],{"class":82},"\"watch\"",[68,188,183],{"class":78},[68,190,191],{"class":82},"\"list\"",[68,193,169],{"class":78},[12,195,196],{},"Like other Kubernetes resources, a role definition contains kind, apiVersion, and metadata, but with the addition of rules.",[12,198,199,200,183,203,183,206,183,209,183,212,183,215,183,218,221,222,225],{},"For the rules key, you will define how your permissions will work. You can specify what resources within apiGroup(s) are permitted and how they can be accessed using verbs (including ",[65,201,202],{},"create",[65,204,205],{},"delete",[65,207,208],{},"deletecollection",[65,210,211],{},"get",[65,213,214],{},"list",[65,216,217],{},"patch",[65,219,220],{},"update",", and ",[65,223,224],{},"watch","). The apiGroups key defines the location in the API where the resources are found. If you provide an empty value in this list, it means the core API group.",[53,227,229],{"id":228},"clusterrole","ClusterRole",[58,231,233],{"className":60,"code":232,"language":62,"meta":63,"style":63},"kind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n  # \"namespace\" omitted since ClusterRoles are not namespaced\n  name: secret-reader\nrules:\n- apiGroups: [\"\"]\n  resources: [\"secrets\"]\n  verbs: [\"get\", \"watch\", \"list\"]\n\n",[65,234,235,244,252,258,263,272,278,290,301],{"__ignoreMap":63},[68,236,237,239,241],{"class":70,"line":71},[68,238,75],{"class":74},[68,240,79],{"class":78},[68,242,243],{"class":82},"ClusterRole\n",[68,245,246,248,250],{"class":70,"line":86},[68,247,89],{"class":74},[68,249,79],{"class":78},[68,251,94],{"class":82},[68,253,254,256],{"class":70,"line":97},[68,255,100],{"class":74},[68,257,103],{"class":78},[68,259,260],{"class":70,"line":106},[68,261,262],{"class":154},"  # \"namespace\" omitted since ClusterRoles are not namespaced\n",[68,264,265,267,269],{"class":70,"line":117},[68,266,120],{"class":74},[68,268,79],{"class":78},[68,270,271],{"class":82},"secret-reader\n",[68,273,274,276],{"class":70,"line":128},[68,275,131],{"class":74},[68,277,103],{"class":78},[68,279,280,282,284,286,288],{"class":70,"line":136},[68,281,139],{"class":78},[68,283,142],{"class":74},[68,285,145],{"class":78},[68,287,148],{"class":82},[68,289,169],{"class":78},[68,291,292,294,296,299],{"class":70,"line":158},[68,293,161],{"class":74},[68,295,145],{"class":78},[68,297,298],{"class":82},"\"secrets\"",[68,300,169],{"class":78},[68,302,303,305,307,309,311,313,315,317],{"class":70,"line":172},[68,304,175],{"class":74},[68,306,145],{"class":78},[68,308,180],{"class":82},[68,310,183],{"class":78},[68,312,186],{"class":82},[68,314,183],{"class":78},[68,316,191],{"class":82},[68,318,169],{"class":78},[12,320,321,322,324,325,328,329,331,332,334,335,337],{},"The major difference in the definition for a ",[65,323,229],{}," is the absence of a namespace, because the permissions defined here are cluster-scoped. However, when referenced by a ",[65,326,327],{},"RoleBinding",", a ",[65,330,229],{}," can be used to grant permissions to namespaced resources defined in the ",[65,333,229],{}," role within the ",[65,336,327],{},"’s namespace.",[53,339,341],{"id":340},"rolebinding-and-clusterrolebinding","RoleBinding and ClusterRoleBinding",[12,343,344],{},"A RoleBinding allows you to associate a Role with a user or list of users. This grants the Role permissions to the users. The user(s) are defined under subjects, and the Role association under role references (roleRef). For example:",[346,347,349],"h4",{"id":348},"rolebinding","RoleBinding:",[58,351,353],{"className":60,"code":352,"language":62,"meta":63,"style":63},"kind: RoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n  name: read-pods\n  namespace: default\nsubjects:\n- kind: User\n  name: abu\n  apiGroup: rbac.authorization.k8s.io\nroleRef:\n  kind: Role\n  name: pod-reader\n  apiGroup: rbac.authorization.k8s.io\n\n",[65,354,355,364,372,378,387,395,402,413,422,432,440,450,459],{"__ignoreMap":63},[68,356,357,359,361],{"class":70,"line":71},[68,358,75],{"class":74},[68,360,79],{"class":78},[68,362,363],{"class":82},"RoleBinding\n",[68,365,366,368,370],{"class":70,"line":86},[68,367,89],{"class":74},[68,369,79],{"class":78},[68,371,94],{"class":82},[68,373,374,376],{"class":70,"line":97},[68,375,100],{"class":74},[68,377,103],{"class":78},[68,379,380,382,384],{"class":70,"line":106},[68,381,120],{"class":74},[68,383,79],{"class":78},[68,385,386],{"class":82},"read-pods\n",[68,388,389,391,393],{"class":70,"line":117},[68,390,109],{"class":74},[68,392,79],{"class":78},[68,394,114],{"class":82},[68,396,397,400],{"class":70,"line":128},[68,398,399],{"class":74},"subjects",[68,401,103],{"class":78},[68,403,404,406,408,410],{"class":70,"line":136},[68,405,139],{"class":78},[68,407,75],{"class":74},[68,409,79],{"class":78},[68,411,412],{"class":82},"User\n",[68,414,415,417,419],{"class":70,"line":158},[68,416,120],{"class":74},[68,418,79],{"class":78},[68,420,421],{"class":82},"abu\n",[68,423,424,427,429],{"class":70,"line":172},[68,425,426],{"class":74},"  apiGroup",[68,428,79],{"class":78},[68,430,431],{"class":82},"rbac.authorization.k8s.io\n",[68,433,435,438],{"class":70,"line":434},10,[68,436,437],{"class":74},"roleRef",[68,439,103],{"class":78},[68,441,443,446,448],{"class":70,"line":442},11,[68,444,445],{"class":74},"  kind",[68,447,79],{"class":78},[68,449,83],{"class":82},[68,451,453,455,457],{"class":70,"line":452},12,[68,454,120],{"class":74},[68,456,79],{"class":78},[68,458,125],{"class":82},[68,460,462,464,466],{"class":70,"line":461},13,[68,463,426],{"class":74},[68,465,79],{"class":78},[68,467,431],{"class":82},[346,469,471],{"id":470},"clusterrolebinding","ClusterRoleBinding:",[58,473,475],{"className":60,"code":474,"language":62,"meta":63,"style":63},"kind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n  name: read-secrets-global\nsubjects:\n- kind: Group\n  name: manager\n  apiGroup: rbac.authorization.k8s.io\nroleRef:\n  kind: ClusterRole\n  name: secret-reader\n  apiGroup: rbac.authorization.k8s.io\n\n",[65,476,477,486,494,500,509,515,526,535,543,549,557,565],{"__ignoreMap":63},[68,478,479,481,483],{"class":70,"line":71},[68,480,75],{"class":74},[68,482,79],{"class":78},[68,484,485],{"class":82},"ClusterRoleBinding\n",[68,487,488,490,492],{"class":70,"line":86},[68,489,89],{"class":74},[68,491,79],{"class":78},[68,493,94],{"class":82},[68,495,496,498],{"class":70,"line":97},[68,497,100],{"class":74},[68,499,103],{"class":78},[68,501,502,504,506],{"class":70,"line":106},[68,503,120],{"class":74},[68,505,79],{"class":78},[68,507,508],{"class":82},"read-secrets-global\n",[68,510,511,513],{"class":70,"line":117},[68,512,399],{"class":74},[68,514,103],{"class":78},[68,516,517,519,521,523],{"class":70,"line":128},[68,518,139],{"class":78},[68,520,75],{"class":74},[68,522,79],{"class":78},[68,524,525],{"class":82},"Group\n",[68,527,528,530,532],{"class":70,"line":136},[68,529,120],{"class":74},[68,531,79],{"class":78},[68,533,534],{"class":82},"manager\n",[68,536,537,539,541],{"class":70,"line":158},[68,538,426],{"class":74},[68,540,79],{"class":78},[68,542,431],{"class":82},[68,544,545,547],{"class":70,"line":172},[68,546,437],{"class":74},[68,548,103],{"class":78},[68,550,551,553,555],{"class":70,"line":434},[68,552,445],{"class":74},[68,554,79],{"class":78},[68,556,243],{"class":82},[68,558,559,561,563],{"class":70,"line":442},[68,560,120],{"class":74},[68,562,79],{"class":78},[68,564,271],{"class":82},[68,566,567,569,571],{"class":70,"line":452},[68,568,426],{"class":74},[68,570,79],{"class":78},[68,572,431],{"class":82},[16,574,576],{"id":575},"best-practices","Best practices",[12,578,579,580,585],{},"Applying the principle of ",[24,581,584],{"href":582,"rel":583},"https://medium.com/@haim_50405/establish-least-privileged-best-practice-for-your-kubernetes-clusters-f0785e1aee39",[],"least privileges"," is crucial, as it reduces exposure and vulnerability. A few of the essential best practices include:",[587,588,589,593,596,599],"ul",{},[590,591,592],"li",{},"Be specific with the resources you are granting access to and the verbs being used; avoid wild cards",[590,594,595],{},"Use Roles instead of Cluster Roles where possible",[590,597,598],{},"Only give permissions required for the specific tasks to be performed by a user and nothing more",[590,600,601,602,607],{},"Create and use service accounts for processes and services like ",[24,603,606],{"href":604,"rel":605},"https://docs.helm.sh/rbac#tiller-and-role-based-access-control",[],"Tiller"," that require permission instead of using the default service accounts",[16,609,611],{"id":610},"gitlab-rbac","GitLab + RBAC",[12,613,614,615,620,621,626],{},"Currently, integrating GitLab with a Kubernetes cluster with RBAC enabled is not supported. You will need to enable and use the legacy ABAC mechanism (",[24,616,619],{"href":617,"rel":618},"https://docs.gitlab.com/user/project/clusters/#security-implications",[],"see the documentation here","). RBAC will be supported in ",[24,622,625],{"href":623,"rel":624},"https://gitlab.com/gitlab-org/gitlab-ce/issues/29398",[],"a future release",". This affects GitLab.com and all self-managed versions of GitLab.",[16,628,630],{"id":629},"learn-more","Learn more",[587,632,633,640,647,654],{},[590,634,635],{},[24,636,639],{"href":637,"rel":638},"https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/",[],"Controlling access",[590,641,642],{},[24,643,646],{"href":644,"rel":645},"https://kubernetes.io/docs/reference/access-authn-authz/authorization/",[],"Authorization",[590,648,649],{},[24,650,653],{"href":651,"rel":652},"https://kubernetes.io/docs/reference/access-authn-authz/rbac/",[],"RBAC",[590,655,656],{},[24,657,660],{"href":658,"rel":659},"https://sysdig.com/blog/kubernetes-security-rbac-tls/",[],"RBAC and TLS certificates",[662,663,664],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":63,"searchDepth":86,"depth":86,"links":666},[667,668,673,674,675],{"id":18,"depth":86,"text":19},{"id":44,"depth":86,"text":45,"children":669},[670,671,672],{"id":55,"depth":97,"text":56},{"id":228,"depth":97,"text":229},{"id":340,"depth":97,"text":341},{"id":575,"depth":86,"text":576},{"id":610,"depth":86,"text":611},{"id":629,"depth":86,"text":630},"engineering","2018-08-07","Role-based access control is now default, and expected in most Kubernetes deployments. Here's the What, Why and How of RBAC.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749678884/Blog/Hero%20Images/understanding-kubernetes-rbac-post-cover.jpg",{},true,"/en-us/blog/understanding-kubernestes-rbac",{"title":5,"description":678,"ogTitle":5,"ogDescription":678,"noIndex":681,"ogImage":682,"ogUrl":687,"ogSiteName":688,"ogType":689,"canonicalUrls":687},"https://about.gitlab.com/blog/understanding-kubernestes-rbac","https://about.gitlab.com","article","understanding-kubernestes-rbac","en-us/blog/understanding-kubernestes-rbac",[693,694],"kubernetes","cloud native","BlogPost","hWbHbh5sr5SRxUrNPXSLEgrODRvLOoEnIz4MRJi1CdA",{"logo":698,"freeTrial":703,"sales":708,"login":713,"items":718,"search":1044,"minimal":1075,"duo":1094,"switchNav":1103,"pricingDeployment":1114},{"config":699},{"href":700,"dataGaName":701,"dataGaLocation":702},"/","gitlab logo","header",{"text":704,"config":705},"Get free trial",{"href":706,"dataGaName":707,"dataGaLocation":702},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":709,"config":710},"Request a demo",{"href":711,"dataGaName":712,"dataGaLocation":702},"/sales/?contact-topic=request-demo","sales",{"text":714,"config":715},"Sign in",{"href":716,"dataGaName":717,"dataGaLocation":702},"https://gitlab.com/users/sign_in/","sign in",[719,747,847,852,966,1022],{"text":720,"config":721,"menu":723},"Platform",{"dataNavLevelOne":722},"platform",{"type":724,"columns":725},"cards",[726,732,740],{"title":720,"description":727,"link":728},"The intelligent orchestration platform for DevSecOps",{"text":729,"config":730},"Explore our Platform",{"href":731,"dataGaName":722,"dataGaLocation":702},"/platform/",{"title":733,"description":734,"link":735},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":736,"config":737},"Meet GitLab Duo",{"href":738,"dataGaName":739,"dataGaLocation":702},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":741,"description":742,"link":743},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":630,"config":744},{"href":745,"dataGaName":746,"dataGaLocation":702},"/why-gitlab/","why gitlab",{"text":748,"left":684,"config":749,"menu":751},"Product",{"dataNavLevelOne":750},"solutions",{"type":752,"link":753,"columns":757,"feature":826},"lists",{"text":754,"config":755},"View all Solutions",{"href":756,"dataGaName":750,"dataGaLocation":702},"/solutions/",[758,782,805],{"title":759,"description":760,"link":761,"items":766},"Automation","CI/CD and automation to accelerate deployment",{"config":762},{"icon":763,"href":764,"dataGaName":765,"dataGaLocation":702},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[767,771,774,778],{"text":768,"config":769},"CI/CD",{"href":770,"dataGaLocation":702,"dataGaName":768},"/solutions/continuous-integration/",{"text":733,"config":772},{"href":738,"dataGaLocation":702,"dataGaName":773},"gitlab duo agent platform - product menu",{"text":775,"config":776},"Source Code Management",{"href":777,"dataGaLocation":702,"dataGaName":775},"/solutions/source-code-management/",{"text":779,"config":780},"Automated Software Delivery",{"href":764,"dataGaLocation":702,"dataGaName":781},"Automated software delivery",{"title":783,"description":784,"link":785,"items":790},"Security","Deliver code faster without compromising security",{"config":786},{"href":787,"dataGaName":788,"dataGaLocation":702,"icon":789},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[791,795,800],{"text":792,"config":793},"Application Security Testing",{"href":787,"dataGaName":794,"dataGaLocation":702},"Application security testing",{"text":796,"config":797},"Software Supply Chain Security",{"href":798,"dataGaLocation":702,"dataGaName":799},"/solutions/supply-chain/","Software supply chain security",{"text":801,"config":802},"Software Compliance",{"href":803,"dataGaName":804,"dataGaLocation":702},"/solutions/software-compliance/","software compliance",{"title":806,"link":807,"items":812},"Measurement",{"config":808},{"icon":809,"href":810,"dataGaName":811,"dataGaLocation":702},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[813,817,821],{"text":814,"config":815},"Visibility & Measurement",{"href":810,"dataGaLocation":702,"dataGaName":816},"Visibility and Measurement",{"text":818,"config":819},"Value Stream Management",{"href":820,"dataGaLocation":702,"dataGaName":818},"/solutions/value-stream-management/",{"text":822,"config":823},"Analytics & Insights",{"href":824,"dataGaLocation":702,"dataGaName":825},"/solutions/analytics-and-insights/","Analytics and insights",{"title":827,"type":752,"items":828},"GitLab for",[829,835,841],{"text":830,"config":831},"Enterprise",{"icon":832,"href":833,"dataGaLocation":702,"dataGaName":834},"Building","/enterprise/","enterprise",{"text":836,"config":837},"Small Business",{"icon":838,"href":839,"dataGaLocation":702,"dataGaName":840},"Work","/small-business/","small business",{"text":842,"config":843},"Public Sector",{"icon":844,"href":845,"dataGaLocation":702,"dataGaName":846},"Organization","/solutions/public-sector/","public sector",{"text":848,"config":849},"Pricing",{"href":850,"dataGaName":851,"dataGaLocation":702,"dataNavLevelOne":851},"/pricing/","pricing",{"text":853,"config":854,"menu":856},"Resources",{"dataNavLevelOne":855},"resources",{"type":752,"link":857,"columns":861,"feature":955},{"text":858,"config":859},"View all resources",{"href":860,"dataGaName":855,"dataGaLocation":702},"/resources/",[862,895,922],{"title":863,"items":864},"Getting started",[865,870,875,880,885,890],{"text":866,"config":867},"Install",{"href":868,"dataGaName":869,"dataGaLocation":702},"/install/","install",{"text":871,"config":872},"Quick start guides",{"href":873,"dataGaName":874,"dataGaLocation":702},"/get-started/","quick setup checklists",{"text":876,"config":877},"Learn",{"href":878,"dataGaLocation":702,"dataGaName":879},"https://university.gitlab.com/","learn",{"text":881,"config":882},"Product documentation",{"href":883,"dataGaName":884,"dataGaLocation":702},"https://docs.gitlab.com/","product documentation",{"text":886,"config":887},"Best practice videos",{"href":888,"dataGaName":889,"dataGaLocation":702},"/getting-started-videos/","best practice videos",{"text":891,"config":892},"Integrations",{"href":893,"dataGaName":894,"dataGaLocation":702},"/integrations/","integrations",{"title":896,"items":897},"Discover",[898,903,908,913,917],{"text":899,"config":900},"Customer success stories",{"href":901,"dataGaName":902,"dataGaLocation":702},"/customers/","customer success stories",{"text":904,"config":905},"Blog",{"href":906,"dataGaName":907,"dataGaLocation":702},"/blog/","blog",{"text":909,"config":910},"Demo Hub",{"href":911,"dataGaName":912,"dataGaLocation":702},"/demo-hub/","demo hub",{"text":914,"config":915},"The Source",{"href":916,"dataGaName":907,"dataGaLocation":702},"/the-source/",{"text":918,"config":919},"Remote",{"href":920,"dataGaName":921,"dataGaLocation":702},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":923,"items":924},"Connect",[925,930,935,940,945,950],{"text":926,"config":927},"GitLab Services",{"href":928,"dataGaName":929,"dataGaLocation":702},"/services/","services",{"text":931,"config":932},"Contribute",{"href":933,"dataGaName":934,"dataGaLocation":702},"https://contributors.gitlab.com","contribute",{"text":936,"config":937},"Community",{"href":938,"dataGaName":939,"dataGaLocation":702},"/community/","community",{"text":941,"config":942},"Forum",{"href":943,"dataGaName":944,"dataGaLocation":702},"https://forum.gitlab.com/","forum",{"text":946,"config":947},"Events",{"href":948,"dataGaName":949,"dataGaLocation":702},"/events/","events",{"text":951,"config":952},"Partners",{"href":953,"dataGaName":954,"dataGaLocation":702},"/partners/","partners",{"config":956,"title":959,"text":960,"link":961},{"background":957,"textColor":958},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":962,"config":963},"Read the latest",{"href":964,"dataGaName":965,"dataGaLocation":702},"/whats-new/","whats new",{"text":967,"config":968,"menu":970},"Company",{"dataNavLevelOne":969},"company",{"type":752,"columns":971},[972],{"items":973},[974,979,985,987,992,997,1002,1007,1012,1017],{"text":975,"config":976},"About",{"href":977,"dataGaName":978,"dataGaLocation":702},"/company/","about",{"text":980,"config":981,"footerGa":984},"Jobs",{"href":982,"dataGaName":983,"dataGaLocation":702},"/jobs/","jobs",{"dataGaName":983},{"text":946,"config":986},{"href":948,"dataGaName":949,"dataGaLocation":702},{"text":988,"config":989},"Leadership",{"href":990,"dataGaName":991,"dataGaLocation":702},"/company/team/e-group/","leadership",{"text":993,"config":994},"Handbook",{"href":995,"dataGaName":996,"dataGaLocation":702},"https://handbook.gitlab.com/","handbook",{"text":998,"config":999},"Investor relations",{"href":1000,"dataGaName":1001,"dataGaLocation":702},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1003,"config":1004},"Trust Center",{"href":1005,"dataGaName":1006,"dataGaLocation":702},"/security/","trust center",{"text":1008,"config":1009},"AI Transparency Center",{"href":1010,"dataGaName":1011,"dataGaLocation":702},"/ai-transparency-center/","ai transparency center",{"text":1013,"config":1014},"Newsletter",{"href":1015,"dataGaName":1016,"dataGaLocation":702},"/company/contact/#contact-forms","newsletter",{"text":1018,"config":1019},"Press",{"href":1020,"dataGaName":1021,"dataGaLocation":702},"/press/","press",{"text":1023,"config":1024,"menu":1025},"Contact us",{"dataNavLevelOne":969},{"type":752,"columns":1026},[1027],{"items":1028},[1029,1034,1039],{"text":1030,"config":1031},"Talk to sales",{"href":1032,"dataGaName":1033,"dataGaLocation":702},"/sales/","talk to sales",{"text":1035,"config":1036},"Support portal",{"href":1037,"dataGaName":1038,"dataGaLocation":702},"https://support.gitlab.com/hc/en-us","support portal",{"text":1040,"config":1041},"Customer portal",{"href":1042,"dataGaName":1043,"dataGaLocation":702},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1045,"login":1046,"suggestions":1053},"Close",{"text":1047,"link":1048},"To search repositories and projects, login to",{"text":1049,"config":1050},"gitlab.com",{"href":716,"dataGaName":1051,"dataGaLocation":1052},"search login","search",{"text":1054,"default":1055},"Suggestions",[1056,1058,1062,1064,1068,1072],{"text":733,"config":1057},{"href":738,"dataGaName":733,"dataGaLocation":1052},{"text":1059,"config":1060},"Code Suggestions (AI)",{"href":1061,"dataGaName":1059,"dataGaLocation":1052},"/solutions/code-suggestions/",{"text":768,"config":1063},{"href":770,"dataGaName":768,"dataGaLocation":1052},{"text":1065,"config":1066},"GitLab on AWS",{"href":1067,"dataGaName":1065,"dataGaLocation":1052},"/partners/technology-partners/aws/",{"text":1069,"config":1070},"GitLab on Google Cloud",{"href":1071,"dataGaName":1069,"dataGaLocation":1052},"/partners/technology-partners/google-cloud-platform/",{"text":1073,"config":1074},"Why GitLab?",{"href":745,"dataGaName":1073,"dataGaLocation":1052},{"freeTrial":1076,"mobileIcon":1081,"desktopIcon":1086,"secondaryButton":1089},{"text":1077,"config":1078},"Start free trial",{"href":1079,"dataGaName":707,"dataGaLocation":1080},"https://gitlab.com/-/trials/new/","nav",{"altText":1082,"config":1083},"Gitlab Icon",{"src":1084,"dataGaName":1085,"dataGaLocation":1080},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1082,"config":1087},{"src":1088,"dataGaName":1085,"dataGaLocation":1080},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1090,"config":1091},"Get Started",{"href":1092,"dataGaName":1093,"dataGaLocation":1080},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1095,"mobileIcon":1099,"desktopIcon":1101},{"text":1096,"config":1097},"Learn more about GitLab Duo",{"href":738,"dataGaName":1098,"dataGaLocation":1080},"gitlab duo",{"altText":1082,"config":1100},{"src":1084,"dataGaName":1085,"dataGaLocation":1080},{"altText":1082,"config":1102},{"src":1088,"dataGaName":1085,"dataGaLocation":1080},{"button":1104,"mobileIcon":1109,"desktopIcon":1111},{"text":1105,"config":1106},"/switch",{"href":1107,"dataGaName":1108,"dataGaLocation":1080},"#contact","switch",{"altText":1082,"config":1110},{"src":1084,"dataGaName":1085,"dataGaLocation":1080},{"altText":1082,"config":1112},{"src":1113,"dataGaName":1085,"dataGaLocation":1080},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1115,"mobileIcon":1120,"desktopIcon":1122},{"text":1116,"config":1117},"Back to pricing",{"href":850,"dataGaName":1118,"dataGaLocation":1080,"icon":1119},"back to pricing","GoBack",{"altText":1082,"config":1121},{"src":1084,"dataGaName":1085,"dataGaLocation":1080},{"altText":1082,"config":1123},{"src":1088,"dataGaName":1085,"dataGaLocation":1080},{"title":1125,"titleMobile":1126,"button":1127,"config":1132},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":630,"config":1128},{"href":1129,"dataGaName":1130,"dataGaLocation":1131},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1133,"disabled":681},"release",{"data":1135},{"text":1136,"source":1137,"edit":1143,"contribute":1148,"config":1153,"items":1158,"minimal":1367},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1138,"config":1139},"View page source",{"href":1140,"dataGaName":1141,"dataGaLocation":1142},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1144,"config":1145},"Edit this page",{"href":1146,"dataGaName":1147,"dataGaLocation":1142},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1149,"config":1150},"Please contribute",{"href":1151,"dataGaName":1152,"dataGaLocation":1142},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1154,"facebook":1155,"youtube":1156,"linkedin":1157},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1159,1206,1259,1303,1335],{"title":848,"links":1160,"subMenu":1175},[1161,1165,1170],{"text":1162,"config":1163},"View plans",{"href":850,"dataGaName":1164,"dataGaLocation":1142},"view plans",{"text":1166,"config":1167},"Why Premium?",{"href":1168,"dataGaName":1169,"dataGaLocation":1142},"/pricing/premium/","why premium",{"text":1171,"config":1172},"Why Ultimate?",{"href":1173,"dataGaName":1174,"dataGaLocation":1142},"/pricing/ultimate/","why ultimate",[1176],{"title":1177,"links":1178},"Contact Us",[1179,1182,1184,1186,1191,1196,1201],{"text":1180,"config":1181},"Contact sales",{"href":1032,"dataGaName":712,"dataGaLocation":1142},{"text":1035,"config":1183},{"href":1037,"dataGaName":1038,"dataGaLocation":1142},{"text":1040,"config":1185},{"href":1042,"dataGaName":1043,"dataGaLocation":1142},{"text":1187,"config":1188},"Status",{"href":1189,"dataGaName":1190,"dataGaLocation":1142},"https://status.gitlab.com/","status",{"text":1192,"config":1193},"Terms of use",{"href":1194,"dataGaName":1195,"dataGaLocation":1142},"/terms/","terms of use",{"text":1197,"config":1198},"Privacy statement",{"href":1199,"dataGaName":1200,"dataGaLocation":1142},"/privacy/","privacy statement",{"text":1202,"config":1203},"Cookie preferences",{"dataGaName":1204,"dataGaLocation":1142,"id":1205,"isOneTrustButton":684},"cookie preferences","ot-sdk-btn",{"title":748,"links":1207,"subMenu":1216},[1208,1212],{"text":1209,"config":1210},"DevSecOps platform",{"href":731,"dataGaName":1211,"dataGaLocation":1142},"devsecops platform",{"text":1213,"config":1214},"AI-Assisted Development",{"href":738,"dataGaName":1215,"dataGaLocation":1142},"ai-assisted development",[1217],{"title":1218,"links":1219},"Topics",[1220,1225,1230,1235,1240,1245,1249,1254],{"text":1221,"config":1222},"CICD",{"href":1223,"dataGaName":1224,"dataGaLocation":1142},"/topics/ci-cd/","cicd",{"text":1226,"config":1227},"GitOps",{"href":1228,"dataGaName":1229,"dataGaLocation":1142},"/topics/gitops/","gitops",{"text":1231,"config":1232},"DevOps",{"href":1233,"dataGaName":1234,"dataGaLocation":1142},"/topics/devops/","devops",{"text":1236,"config":1237},"Version Control",{"href":1238,"dataGaName":1239,"dataGaLocation":1142},"/topics/version-control/","version control",{"text":1241,"config":1242},"DevSecOps",{"href":1243,"dataGaName":1244,"dataGaLocation":1142},"/topics/devsecops/","devsecops",{"text":1246,"config":1247},"Cloud Native",{"href":1248,"dataGaName":694,"dataGaLocation":1142},"/topics/cloud-native/",{"text":1250,"config":1251},"AI for Coding",{"href":1252,"dataGaName":1253,"dataGaLocation":1142},"/topics/devops/ai-for-coding/","ai for coding",{"text":1255,"config":1256},"Agentic AI",{"href":1257,"dataGaName":1258,"dataGaLocation":1142},"/topics/agentic-ai/","agentic ai",{"title":1260,"links":1261},"Solutions",[1262,1264,1266,1271,1275,1278,1282,1285,1287,1290,1293,1298],{"text":792,"config":1263},{"href":787,"dataGaName":792,"dataGaLocation":1142},{"text":781,"config":1265},{"href":764,"dataGaName":765,"dataGaLocation":1142},{"text":1267,"config":1268},"Agile development",{"href":1269,"dataGaName":1270,"dataGaLocation":1142},"/solutions/agile-delivery/","agile delivery",{"text":1272,"config":1273},"SCM",{"href":777,"dataGaName":1274,"dataGaLocation":1142},"source code management",{"text":1221,"config":1276},{"href":770,"dataGaName":1277,"dataGaLocation":1142},"continuous integration & delivery",{"text":1279,"config":1280},"Value stream management",{"href":820,"dataGaName":1281,"dataGaLocation":1142},"value stream management",{"text":1226,"config":1283},{"href":1284,"dataGaName":1229,"dataGaLocation":1142},"/solutions/gitops/",{"text":830,"config":1286},{"href":833,"dataGaName":834,"dataGaLocation":1142},{"text":1288,"config":1289},"Small business",{"href":839,"dataGaName":840,"dataGaLocation":1142},{"text":1291,"config":1292},"Public sector",{"href":845,"dataGaName":846,"dataGaLocation":1142},{"text":1294,"config":1295},"Education",{"href":1296,"dataGaName":1297,"dataGaLocation":1142},"/solutions/education/","education",{"text":1299,"config":1300},"Financial services",{"href":1301,"dataGaName":1302,"dataGaLocation":1142},"/solutions/finance/","financial services",{"title":853,"links":1304},[1305,1307,1309,1311,1314,1316,1319,1321,1323,1325,1327,1329,1331,1333],{"text":866,"config":1306},{"href":868,"dataGaName":869,"dataGaLocation":1142},{"text":871,"config":1308},{"href":873,"dataGaName":874,"dataGaLocation":1142},{"text":876,"config":1310},{"href":878,"dataGaName":879,"dataGaLocation":1142},{"text":881,"config":1312},{"href":883,"dataGaName":1313,"dataGaLocation":1142},"docs",{"text":904,"config":1315},{"href":906,"dataGaName":907,"dataGaLocation":1142},{"text":1317,"config":1318},"What's new",{"href":964,"dataGaName":965,"dataGaLocation":1142},{"text":899,"config":1320},{"href":901,"dataGaName":902,"dataGaLocation":1142},{"text":918,"config":1322},{"href":920,"dataGaName":921,"dataGaLocation":1142},{"text":926,"config":1324},{"href":928,"dataGaName":929,"dataGaLocation":1142},{"text":931,"config":1326},{"href":933,"dataGaName":934,"dataGaLocation":1142},{"text":936,"config":1328},{"href":938,"dataGaName":939,"dataGaLocation":1142},{"text":941,"config":1330},{"href":943,"dataGaName":944,"dataGaLocation":1142},{"text":946,"config":1332},{"href":948,"dataGaName":949,"dataGaLocation":1142},{"text":951,"config":1334},{"href":953,"dataGaName":954,"dataGaLocation":1142},{"title":967,"links":1336},[1337,1339,1341,1343,1345,1347,1351,1356,1358,1360,1362],{"text":975,"config":1338},{"href":977,"dataGaName":969,"dataGaLocation":1142},{"text":980,"config":1340},{"href":982,"dataGaName":983,"dataGaLocation":1142},{"text":988,"config":1342},{"href":990,"dataGaName":991,"dataGaLocation":1142},{"text":993,"config":1344},{"href":995,"dataGaName":996,"dataGaLocation":1142},{"text":998,"config":1346},{"href":1000,"dataGaName":1001,"dataGaLocation":1142},{"text":1348,"config":1349},"Sustainability",{"href":1350,"dataGaName":1348,"dataGaLocation":1142},"/sustainability/",{"text":1352,"config":1353},"Diversity, inclusion and belonging (DIB)",{"href":1354,"dataGaName":1355,"dataGaLocation":1142},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1003,"config":1357},{"href":1005,"dataGaName":1006,"dataGaLocation":1142},{"text":1013,"config":1359},{"href":1015,"dataGaName":1016,"dataGaLocation":1142},{"text":1018,"config":1361},{"href":1020,"dataGaName":1021,"dataGaLocation":1142},{"text":1363,"config":1364},"Modern Slavery Transparency Statement",{"href":1365,"dataGaName":1366,"dataGaLocation":1142},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1368},[1369,1372,1375],{"text":1370,"config":1371},"Terms",{"href":1194,"dataGaName":1195,"dataGaLocation":1142},{"text":1373,"config":1374},"Cookies",{"dataGaName":1204,"dataGaLocation":1142,"id":1205,"isOneTrustButton":684},{"text":1376,"config":1377},"Privacy",{"href":1199,"dataGaName":1200,"dataGaLocation":1142},[1379],{"id":1380,"title":7,"body":680,"config":1381,"content":1383,"description":680,"extension":1387,"meta":1388,"navigation":684,"path":1389,"seo":1390,"stem":1391,"__hash__":1392},"blogAuthors/en-us/blog/authors/abubakar-siddiq-ango.yml",{"template":1382},"BlogAuthor",{"name":7,"config":1384},{"headshot":1385,"ctfId":1386},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749660104/Blog/Author%20Headshots/abuango-headshot.jpg","abuango","yml",{},"/en-us/blog/authors/abubakar-siddiq-ango",{},"en-us/blog/authors/abubakar-siddiq-ango","u5Jv4JxCpfmcGQuXEU4Lr5xVBJP9LAB2NkXRMLeYwPE",[1394,1403,1411],{"title":1395,"description":1396,"heroImage":1397,"category":676,"date":1398,"authors":1399,"slug":1402,"externalUrl":680},"Confidential AI for GitLab Self-Hosted","Give developers AI coding agents in GitLab Duo without source code leaving a hardware-encrypted boundary — no GPUs needed.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1773866173/vte9qh8rriznvyclhkes.png","2026-08-06",[1400,1401],"Mathias Ewald","Martin Paloncy, Edgeless Systems","confidential-ai-for-gitlab-self-hosted",{"title":1404,"description":1405,"heroImage":1406,"category":676,"date":1407,"authors":1408,"slug":1410,"externalUrl":680},"Green DevOps: Why carbon measurement belongs in your CI/CD pipeline","CI/CD pipelines have a hidden carbon cost. Here's why measuring it matters, and how you can get started with Eco CI and Carmen in GitLab.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1765809212/noh0mdfn9o94ry9ykura.png","2026-07-09",[1409],"Lysanne Pinto","green-devops-carbon-measurement-cicd-pipeline",{"title":1412,"description":1413,"heroImage":1414,"category":676,"date":1415,"authors":1416,"slug":1418,"externalUrl":680},"How to build CI/CD observability at scale","This practical guide to GitLab pipeline analytics helps self-managed users gain operational insights using Prometheus and Grafana.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1774465167/n5hlvrsrheadeccyr1oz.png","2026-04-28",[1417],"Paul Meresanu","how-to-build-ci-cd-observability-at-scale",{"promotions":1420},[1421,1435,1447,1459],{"id":1422,"categories":1423,"header":1425,"text":1426,"button":1427,"image":1432},"ai-modernization",[1424],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1428,"config":1429},"Get your AI maturity score",{"href":1430,"dataGaName":1431,"dataGaLocation":907},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1433},{"src":1434},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1436,"categories":1437,"header":1439,"text":1426,"button":1440,"image":1444},"devops-modernization",[1438,1244],"product","Are you just managing tools or shipping innovation?",{"text":1441,"config":1442},"Get your DevOps maturity score",{"href":1443,"dataGaName":1431,"dataGaLocation":907},"/assessments/devops-modernization-assessment/",{"config":1445},{"src":1446},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1448,"categories":1449,"header":1451,"text":1426,"button":1452,"image":1456},"security-modernization",[1450],"security","Are you trading speed for security?",{"text":1453,"config":1454},"Get your security maturity score",{"href":1455,"dataGaName":1431,"dataGaLocation":907},"/assessments/security-modernization-assessment/",{"config":1457},{"src":1458},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1460,"paths":1461,"header":1464,"text":1465,"button":1466,"image":1471},"github-azure-migration",[1462,1463],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1467,"config":1468},"See how GitLab compares to GitHub",{"href":1469,"dataGaName":1470,"dataGaLocation":907},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1472},{"src":1446},{"header":1474,"blurb":1475,"button":1476,"secondaryButton":1481},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1477,"config":1478},"Get your free trial",{"href":1479,"dataGaName":707,"dataGaLocation":1480},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1180,"config":1482},{"href":1032,"dataGaName":712,"dataGaLocation":1480},1786803756017]