3 ms·

> For automation use cases that currently use group or project access tokens, we suggest that you look into service accounts, available on GitLab Premium and Ul

> For automation use cases that currently use group or project access tokens, we suggest that you look into service accounts, available on GitLab Premium and Ultimate tiers. TL:DR; because we wanted to make automation that doesn't periodically break be a paid feature. I use gitlab daily, I think the product is great and think they do a good job walking the difficult line between being financially sustainable and providing surplus value to the community. As a paid user (at work) and a free user (at home) I _want_ them to be a profitable enterprise because that's what's best for everyone. But I still think we can be honest about what's going on here. You can still have non-expiring tokens - you just have to pay. Personally, I am not a huge fan of this move because I think it overall increases the amount of busywork and toil in the world.

mooreds 3y ago
From my reading, Gitlab Ultimate admins can't set the limit to greater than 365 days, only less. From https://about.gitlab.com/blog/2023/10/25/access-token-lifetime-limits/ https://about.gitlab.com/blog/2023/10/25/access-token-lifeti... "In GitLab Ultimate, administrators have the ability to set a custom allowable limit for token expiration. This policy allows administrators to set a lifetime less than 365 days for compliance purposes." https://docs.gitlab.com/ee/administration/settings/account_and_limit_settings.html#limit-the-lifetime-of-access-tokens https://docs.gitlab.com/ee/administration/settings/account_a... "Users can optionally specify a maximum lifetime in days for access tokens, this includes personal, group, and project access tokens. This lifetime is not a requirement, and can be set to any value greater than 0 and less than or equal to 365." What am I missing?
- xyzzy123 3y ago
  That you can use a service account instead. Their tokens don't expire (but they will add an option to allow you to set an expiry). It hurts because the kind of maturity you need to maintain an ops calendar and be diligent about rotation across time and personnel changes is exactly the sort of thing that small orgs on cheaper plans tend to be bad at.
  - mooreds 3y ago
    Ah, thanks for that.

mooreds 3y ago

From my reading, Gitlab Ultimate admins can't set the limit to greater than 365 days, only less. From https://about.gitlab.com/blog/2023/10/25/access-token-lifetime-limits/ https://about.gitlab.com/blog/2023/10/25/access-token-lifeti... "In GitLab Ultimate, administrators have the ability to set a custom allowable limit for token expiration. This policy allows administrators to set a lifetime less than 365 days for compliance purposes." https://docs.gitlab.com/ee/administration/settings/account_and_limit_settings.html#limit-the-lifetime-of-access-tokens https://docs.gitlab.com/ee/administration/settings/account_a... "Users can optionally specify a maximum lifetime in days for access tokens, this includes personal, group, and project access tokens. This lifetime is not a requirement, and can be set to any value greater than 0 and less than or equal to 365." What am I missing?

xyzzy123 3y ago
That you can use a service account instead. Their tokens don't expire (but they will add an option to allow you to set an expiry). It hurts because the kind of maturity you need to maintain an ops calendar and be diligent about rotation across time and personnel changes is exactly the sort of thing that small orgs on cheaper plans tend to be bad at.
- mooreds 3y ago
  Ah, thanks for that.