GitLab Credentials Guide

Bootstrap guide for giving the platform automation scripts full access to all managed groups and projects under tierpoint/prodtech. Follows the same god-mode-then-scope-down pattern as the GitHub guide.

Script that uses this: scripts/identity/Invoke-GitLabVariableDistribution.ps1
See also: GitHub Credentials Guide — same pattern for GitHub

---

Prerequisites

• Invoke-TenantIdentitySetup.ps1 must have run first. The GitLab variable distribution seeds SPN credentials (client-id and secret) for kv-demos-platform, kv-tplabs-platform, and kv-phx-platform into GitLab CI/CD variables. Those SPNs must exist and their secrets must be in the tenant Key Vaults before this script can read them.
• Azure CLI logged in as kris@hybridsolutions.cloud with access to kv-hcs-vault-01
• Environment loaded: . D:\git\platform\scripts\Load-HCSEnvironment.ps1

---

Phase 1 — God-mode bootstrap

Step 1 — Create god-mode PATs (one per account)

You have two GitLab accounts with access to tierpoint/prodtech. Create one PAT per account.

PAT 1 — KristopherjTurner personal account (gitlab.com)

Where: gitlab.com → User Settings → Access Tokens

Token name: hcs-platform-godmode-<YYYY-MM-DD>

Expiration: 90 days

Scopes — select ALL:

Scope	Why
api	Full API access — read/write groups, projects, CI/CD variables, members
read_user	Read authenticated user profile
read_api	Read-only API (subset of api, included for completeness)
read_repository	Read repository content
write_repository	Push to repositories
read_registry	Read GitLab Container Registry
write_registry	Write to GitLab Container Registry
create_runner	Register GitLab Runners
manage_runner	Manage Runner configuration

sudo and admin_mode are only available on self-hosted GitLab instances where your account has admin rights. On gitlab.com they are not available — skip them. The api scope alone is sufficient for all group/project variable management.

Store in KV immediately:

az keyvault secret set `
  --vault-name kv-hcs-vault-01 `
  --name hcs-platform-gitlab-kjt-godmode-pat `
  --value '<paste-token-here>'

---

PAT 2 — kristopher.turner@tierpoint.com (gitlab.com TierPoint account)

Same process. Token name: hcs-platform-tp-godmode-<YYYY-MM-DD>

Store in KV:

az keyvault secret set `
  --vault-name kv-hcs-vault-01 `
  --name hcs-platform-gitlab-tp-godmode-pat `
  --value '<paste-token-here>'

---

Step 2 — Add both secrets to secret-inventory.md

Add these rows to docs/identity/secret-inventory.md:

Secret name	Vault	Purpose	Rotation	Notes
hcs-platform-gitlab-kjt-godmode-pat	kv-hcs-vault-01	God-mode GitLab PAT — KristopherjTurner account — all scopes	Revoke after Phase 2	Temporary
hcs-platform-gitlab-tp-godmode-pat	kv-hcs-vault-01	God-mode GitLab PAT — TierPoint account — all scopes	Revoke after Phase 2	Temporary

Tick the corresponding rows in Table C of docs/onboarding/tracker.md.

---

Step 3 — Seed group CI/CD variables

The script uses the TierPoint account god-mode PAT (hcs-platform-gitlab-tp-godmode-pat) by default, since that account has access to the tierpoint/prodtech group.

. D:\git\platform\scripts\Load-HCSEnvironment.ps1

# Preview first
pwsh D:\git\platform\scripts\identity\Invoke-GitLabVariableDistribution.ps1 -DryRun

# Review log output, then run live
pwsh D:\git\platform\scripts\identity\Invoke-GitLabVariableDistribution.ps1

What the script seeds:

Group-level variables (inherited by all projects under tierpoint/prodtech)

Group	Variable	Source KV secret	Masked
tierpoint/prodtech	PLATFORM_PAT	hcs-platform-gitlab-tp-godmode-pat (→ replaced by hcs-platform-gitlab-tp-pat in Phase 2)	Yes
tierpoint/prodtech/azurelocal	AZL_KV_NAME	Static: kv-demos-platform	No

Subgroup-level variables (per-tenant KV access for lab environment projects)

These variables let CI/CD jobs in each lab-environment subgroup authenticate to the correct tenant Key Vault to pull secrets at runtime.

Group	Variable	Source KV secret	Source vault	Masked
tierpoint/prodtech/azurelocal/lab-environments	KV_SP_CLIENT_ID	tpdemos-platform-automation-spn-client-id	kv-demos-platform	No
tierpoint/prodtech/azurelocal/lab-environments	KV_SP_SECRET	tpdemos-platform-automation-spn-secret	kv-demos-platform	Yes
tierpoint/prodtech/azurelocal/lab-environments	KV_TENANT_ID	Static: 28217fed-1ba3-4974-89c0-f1423aafe640	—	No

Note on subgroup variable scope: Where tplabs and phx projects live in different subgroups than tpdemos, set their KV_SP_CLIENT_ID / KV_SP_SECRET / KV_TENANT_ID at those subgroup paths or at the project level. Update the script's $script:GroupDefinitions array to add those group paths before running.

---

Phase 2 — Scoped per-account PATs (AB#23)

Create these after the god-mode bootstrap is confirmed working. Scopes: api, read_repository, write_repository only — no runner management or registry write.

Expiration: 365 days with calendar reminder to rotate.

GitLab account	KV secret name (→ kv-hcs-vault-01)
KristopherjTurner (gitlab.com personal)	hcs-platform-gitlab-kjt-pat
kristopher.turner@tierpoint.com	hcs-platform-gitlab-tp-pat

Store each immediately:

az keyvault secret set `
  --vault-name kv-hcs-vault-01 `
  --name hcs-platform-gitlab-tp-pat `
  --value '<paste-token>'

Add each to docs/identity/secret-inventory.md and tick the corresponding row in Table C of docs/onboarding/tracker.md.

Re-seed group variables with scoped PAT

pwsh D:\git\platform\scripts\identity\Invoke-GitLabVariableDistribution.ps1 `
  -PatKvSecretName hcs-platform-gitlab-tp-pat `
  -DryRun

pwsh D:\git\platform\scripts\identity\Invoke-GitLabVariableDistribution.ps1 `
  -PatKvSecretName hcs-platform-gitlab-tp-pat

This re-seeds PLATFORM_PAT using the scoped token, replacing the god-mode value.

---

Phase 3 — Revoke god-mode PATs

Only do this after the scoped PATs are confirmed in KV and PLATFORM_PAT has been re-seeded.

1. GitLab → User Settings → Access Tokens → revoke hcs-platform-godmode-* on both accounts
2. Remove from KV:

   az keyvault secret delete --vault-name kv-hcs-vault-01 --name hcs-platform-gitlab-kjt-godmode-pat
   az keyvault secret delete --vault-name kv-hcs-vault-01 --name hcs-platform-gitlab-tp-godmode-pat

3. Update secret-inventory.md — mark both rows as revoked/deleted with the date.