---
title: "Fortanix DSM with GitLab"
slug: "fortanix-dsm-with-gitlab"
updated: 2026-07-08T17:24:17Z
published: 2026-07-08T17:24:17Z
canonical: "support.fortanix.com/fortanix-dsm-with-gitlab"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with GitLab

## 1.0 Introduction

The objective of this article is to facilitate a secure and efficient secret management process. It outlines the steps required for generating and importing secrets, as well as for using existing secrets from **Fortanix-Data-Security-Manager (DSM)** within **GitLab** build environments.

Follow the instructions to implement this integration effectively, enhancing data security and optimizing CI/CD pipelines.

## 2.0 Prerequisites

Ensure the following:

- Access to a Fortanix DSM account with appropriate administrative privileges.
- A GitLab account with access to the project where you intend to set up the integration. *For more information, refer to* [*Getting Started with GitLab*](https://gitlab.com/users/sign_up)*.*
- Knowledge about the process of saving secrets in Fortanix DSM, including generating and importing the secret.
- Access to necessary permissions in Fortanix DSM and GitLab for group, application, plugin, variable, and secret management.

## 3.0 Use Case 1: Generating and Importing a Secret

This section describes the steps to configure Fortanix DSM to generate and import a security object.

### 3.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 3.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 3.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_Add_Group(14).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 3.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(67).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 3.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-gitlab#33-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 3.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 3.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-gitlab#34-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. From the **API Key Details** dialog box, copy the **API Key** of the app to be used later.

### 3.6 Generating the Plugin

Perform the following steps to generate a plugin in Fortanix DSM:

1. Run the following command to generate a new plugin in Fortanix DSM: *For more information, refer to the* [*User’s Guide: Plugin Library*](/v1/docs/users-guide-plugin-library)*.*

```bash
numericAlphabet
= "0123456789"
alphanumericAlphabet
= numericAlphabet .. "abcdefghijklmnopqrstuvwxyz"
alphanumericCapsAlphabet
= alphanumericAlphabet .. "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
alphanumericCapsSymbolsAlphabets
= alphanumericCapsAlphabet .. "!@#$&*_%="
function
genPass(alphabet, len, name, import)
    local alphabetSize = #alphabet
    local password = ''
    for i = 1, len, 1 do
        local random_char =
math.random(alphabetSize)
        password = password ..
string.sub(alphabet, random_char, random_char)
    end
    local pass = Blob.from_bytes(password)
    if import == "yes" then
        local sobject = assert(Sobject.import {
name = name, obj_type = "SECRET", value = pass, key_ops =
{'APPMANAGEABLE', 'EXPORT'} })
        return password
    end
    return password;
end
function
run(input)
    if input.type == "numeric" then
        return genPass(numericAlphabet,
input.length, input.name, input.import)
    end
    if input.type == "alphanumeric"
then
        return genPass(alphanumericAlphabet, input.length,
input.name, input.import)
    end  
    if input.type ==
"alphanumeric_caps" then
        return
genPass(alphanumericCapsAlphabet, input.length, input.name, input.import)
    end  
    if input.type ==
"alphanumeric_caps_symbols" then
        return
genPass(alphanumericCapsSymbolsAlphabets, input.length, input.name,
input.import)      
    end
end
```
  - Set the import option to **yes** if you want to store the secret in Fortanix DSM.

```bash
{
    "type": "alphanumeric_caps",
    "length": 64,
    "name": "GitLab-Secret",
    "import": "yes"
}
```
  - Set the import option to **no** if you only want a new value generated for rotation.

```bash
{
    "type": "numeric",
    "length": 64,
    "name": "GitLab-Secret",
    "import": "no"
}
```

### 3.7 Integration Steps

Perform the following steps:

1. Navigate to GitLab and select the project where you want to set up the integration.
2. In GitLab, go to **Settings** → **CI/CD** **→** **Variables**, and add the following new variables:
  - `FORTANIX_API_ENDPOINT`
  - `FORTANIX_API_KEY`
  - `FORTANIX_PLUGIN_ID`
3. Under the top level of your GitLab project, locate the `.gitlab-ci.yaml` configuration file and edit this file as follows to define the CI/CD pipeline for the integration:

```bash
stages:
  - build

build:
  stage: build
  image: ubuntu
  script:
  - apt-get update
  - apt install jq -y
  - apt install curl -y
  - jq --version
  - curl -V
  - secret=$(curl -s -X POST -H "Authorization:Basic ${FORTANIX_API_KEY}" ${FORTANIX_API_ENDPOINT}/sys/v1/plugins/${FORTANIX_PLUGIN_ID} -d "{\"type\":\"alphanumeric_caps\", \"name\":\"$CI_PIPELINE_ID\",\"import\":\"yes\", \"length\":\"48\"}" | jq -r)
  - echo $CI_PIPELINE_ID
  - echo $secret
  - nsecret=$(curl -s -X POST -H "Authorization:Basic ${FORTANIX_API_KEY}" ${FORTANIX_API_ENDPOINT}/sys/v1/plugins/${FORTANIX_PLUGIN_ID} -d "{\"type\":\"alphanumeric_caps\", \"import\":\"no\", \"length\":\"48\"}" | jq -r)
  - echo $nsecret
  - encodesecret=$(echo $nsecret | base64)
  - rotate=$(curl -s -X POST -H "Authorization:Basic ${FORTANIX_API_KEY}" ${FORTANIX_API_ENDPOINT}/crypto/v1/keys/rekey -d "{\"name\":\"$CI_PIPELINE_ID\", \"value\":\"$encodesecret\"}" | jq -r .kid)
  - echo $rotate
```

The pipeline must automatically run after editing the `.gitlab-ci.yaml` file. If not, select **Build** → **Pipelines** → **Run** pipeline to initiate the process.

![case 1.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/20557776236436.png)

**Figure 4: Run the job**
4. On Gitlab UI, navigate to **Build** → **Jobs** from the left navigation panel to review the latest output.

## 4.0 Use Case 2: Using an Existing Secret from Fortanix DSM

Ensure you have a secret in Fortanix DSM that you want to use in the integration and this secret is marked as exportable within Fortanix DSM.

Perform the following steps to utilize an existing secret from Fortanix DSM in your integration with GitLab:

1. Navigate to your GitLab project where you want to set up the integration.
2. In GitLab, go to **Settings** → **CI/CD** → **Variables** and add the following new variables:
  - `FORTANIX_API_ENDPOINT`
  - `FORTANIX_API_KEY`
  - `FORTANIX_SECRET_NAME`
3. Under the top level of your GitLab project, locate the `.gitlab-ci.yaml` configuration file and edit this file as follows to define the CI/CD pipeline for the integration:

```bash
stages:
  - build

build:
  stage: build
  image: ubuntu
  script:
  - apt-get update
  - apt install jq -y
  - apt install curl -y
  - jq --version
  - curl -V
  - secret=$(curl -s -X POST -H "Authorization:Basic ${FORTANIX_API_KEY}" ${FORTANIX_API_ENDPOINT}/crypto/v1/keys/export -d "{\"name\":\"${FORTANIX_SECRET_NAME}\"}" | jq -r .value)
  - echo $CI_PIPELINE_ID
  - echo $secret
```

The pipeline must automatically run after editing the `.gitlab-ci.yaml` file. If not, select **Build** → **Pipelines** **→** **Run** pipeline to initiate the integration process.

![case 2.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/20557822276244.png)

**Figure 5: Job success**
4. On GitLab UI, navigate to **Build** → **Jobs** from the left navigation panel to review the latest output.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

## Related

- [Authentication](/dsm-authentication.md)
- [Fortanix DSM for Git Commit Signing](/fortanix-dsm-for-git-commit-signing.md)
- [Usage Metrics](/fortanix-dsm-usage-metrics.md)
- [Fortanix DSM with Ansible Lookup Plugin](/fortanix-dsm-with-ansible-lookup-plugin.md)