This change ensures a higher level of security between projects. In 17.0, we will remove the Limit setting completely, and set the Allow access setting to enabled for all projects. From this point forward, if the Limit setting is disabled in any project, it will not be possible to re-enable this setting in 16.0 or later. The Limit setting was deprecated in 16.0 in preference of the better Allow access setting and Limit setting was disabled by default for all new projects. With this new setting, you must be a maintainer in your own project, but only need to have the Guest role in the other projects. Similar to the older setting, you can optionally allow other projects to access your project with a job token if you list those projects explicitly in the Allow access to this project with a CI_JOB_TOKEN setting’s allowlist. When enabled with no other configuration, job tokens from other projects cannot access your project. The job token functionality was updated in 15.9 with a better security setting to allow access to your project with a job token. To use the job token to access other projects from your pipeline, you must list those projects explicitly in the Limit CI_JOB_TOKEN access setting’s allowlist, and you must be a maintainer in all the projects. When enabled with no other configuration, your pipelines cannot access other projects. You can prevent job tokens from your project’s pipelines from being used to access other projects. In GitLab 14.4 we introduced the ability to limit your project’s CI/CD job token ( CI_JOB_TOKEN) access to make it more secure. To discuss this change or learn more, see the deprecation issue.
Removal in GitLab 17.0 ( breaking change).
0 kommentar(er)
