GitLab Secrets Manager now supports the External Secrets Operator (ESO) and Terraform to extend secure secret retrieval beyond CI/CD pipelines. It uses OpenBao as its backend, providing a unified source of truth for secrets across the software delivery chain. This integration allows a single secret store to be used for Kubernetes workloads via ESO, Terraform or OpenTofu runs, OpenBao or Vault CLI commands, GitLab CI/CD jobs, and any external automation through its API. For Kubernetes, ESO syncs secrets from GitLab Secrets Manager by authenticating with OpenBao using a short-lived JSON Web Token. A SecretStore resource in Kubernetes is configured to point to GitLab Secrets Manager and define authentication details and namespace mapping. An ExternalSecret resource then specifies which secrets to pull from GitLab and where to store them as Kubernetes Secrets that workloads can access. Terraform can also securely read secrets from GitLab Secrets Manager as a data source, authenticating with minted JWTs to avoid storing credentials in state or configuration files. Vault-compatible tooling like the OpenBao or Vault CLI can interact with GitLab Secrets Manager as they would with a standard Vault instance. The Secrets Manager API offers a direct method for external systems to fetch secrets without hardcoding credentials. GitLab Secrets Manager is currently in public beta for Premium and Ultimate customers and will be a paid feature upon general availability.