DevOps / GitLab CI Basics Interview Questions
What are protected branches and protected variables in GitLab CI?
Protected branches and protected variables are security features that control who can push to critical branches and which jobs can access sensitive CI/CD variables.
# Protected variables are set in: # Settings > CI/CD > Variables > Add variable # Tick "Protected variable" checkbox # A protected variable is ONLY available in jobs running on: # 1. Protected branches (e.g. main, production) # 2. Protected tags # Example: PROD_API_KEY is protected: deploy-production: stage: deploy script: - echo "Using: $PROD_API_KEY" # only available because main is protected rules: - if: $CI_COMMIT_BRANCH == "main" # main is a protected branch # feature branches (unprotected) CANNOT access $PROD_API_KEY: test-on-feature: script: - echo "$PROD_API_KEY" # will be empty - variable not available here rules: - if: $CI_COMMIT_BRANCH =~ /^feature/ # Protected branches in GitLab: # Settings > Repository > Protected branches # Can restrict push access to Maintainers, Developers, No one # Can require merge request approval before merging # Can require status checks (pipeline must pass)
| Setting | Controls |
|---|---|
| Allowed to merge | Minimum role required to merge into this branch |
| Allowed to push and merge | Minimum role required to push directly (bypass MR) |
| Allowed to force push | Whether force push is allowed (usually disabled) |
| Code owner approval | Whether CODEOWNERS must approve changes |
Security design: this combination means developers on feature branches cannot access production secrets even if they have access to the project. Only pipelines running on protected branches (typically main or release tags) can use protected variables like production API keys.
A CI variable is marked as 'Protected'. In which job will it be available?
What is the security benefit of combining protected branches with protected variables?
More Related questions...
