CI/CD

Automate Cerbos policy deployments with GitLab Runners

Push validated Cerbos policies to Cerbos Hub on every merge using a GitLab CI/CD pipeline.

Pipeline-driven

A single .gitlab-ci.yml file triggers policy uploads on every push to your main branch

Protected variables

Store Cerbos Hub credentials as protected and masked CI/CD variables, injected securely at runtime

Zero-downtime updates

Cerbos Hub distributes updated bundles to connected PDPs with no restarts or redeployments

How Cerbos works with GitLab CI/CD

Authorization policies should go through the same review and deployment rigour as application code. GitLab CI/CD lets you automate that workflow so every policy change is tested and deployed without manual steps.

Cerbos Hub stores your compiled policy bundles and distributes them to connected PDP instances. A CI/CD pipeline pushes validated policies to Cerbos Hub on every merge, and your PDPs pick up the changes automatically.

With GitLab CI/CD handling the pipeline and Cerbos Hub handling distribution, policy updates flow from pull request to production with a full audit trail and zero downtime.

Policy-as-codeHuman-readable YAML policies managed like source code Scalable PDPStateless policy decision point with sub-millisecond latency Centralized managementManage, test, and deploy policies from a single control plane

How to deploy Cerbos policies with GitLab CI/CD

Create a CI/CD config file, Add .gitlab-ci.yml to your repository with a job that uses Docker-in-Docker to run the cerbosctl image.
Store credentials as CI/CD variables, Add CERBOS_HUB_CLIENT_ID and CERBOS_HUB_CLIENT_SECRET as protected, masked variables in GitLab.
Push to main, Every push to main triggers the pipeline, which uploads your policies to Cerbos Hub using hub store replace-files.
PDPs update automatically, Connected PDP instances pull the latest policy bundle from Cerbos Hub with zero downtime.

FAQ

How does the GitLab pipeline deploy policies?

A job uses Docker-in-Docker to run the cerbosctl image and execute `hub store replace-files`, uploading your policy directory to Cerbos Hub. Connected PDP instances pull the updated bundle automatically.