CI/CD

Automate Cerbos policy deployments with CircleCI

Push validated Cerbos policies to Cerbos Hub on every merge using a CircleCI workflow.

Workflow-driven

A single config file triggers policy uploads on every push to your main branch

Environment secrets

Store Cerbos Hub credentials as project environment variables, injected securely at runtime

Zero-downtime updates

Cerbos Hub distributes updated bundles to connected PDPs with no restarts or redeployments

How Cerbos works with CircleCI

Authorization policies should go through the same review and deployment rigour as application code. CircleCI lets you automate that workflow so every policy change is tested and deployed without manual steps.

Cerbos Hub stores your compiled policy bundles and distributes them to connected PDP instances. A CI/CD pipeline pushes validated policies to Cerbos Hub on every merge, and your PDPs pick up the changes automatically.

With CircleCI handling the pipeline and Cerbos Hub handling distribution, policy updates flow from pull request to production with a full audit trail and zero downtime.

Policy-as-codeHuman-readable YAML policies managed like source code Scalable PDPStateless policy decision point with sub-millisecond latency Centralized managementManage, test, and deploy policies from a single control plane

How to deploy Cerbos policies with CircleCI

Create a config file, Add .circleci/config.yml to your repository with a job that runs the cerbosctl Docker image.
Store credentials as environment variables, Add CERBOS_HUB_CLIENT_ID and CERBOS_HUB_CLIENT_SECRET in your CircleCI project settings.
Push to main, Every push to main triggers the workflow, which uploads your policies to Cerbos Hub using hub store replace-files.
PDPs update automatically, Connected PDP instances pull the latest policy bundle from Cerbos Hub with zero downtime.

FAQ

How does the CircleCI workflow deploy policies?

A job runs the cerbosctl Docker image and executes `hub store replace-files` to upload your policy directory to Cerbos Hub. Connected PDP instances pull the updated bundle automatically.