Clarify private self-managed GitLab uses key-pinning, not IdP registration (DOCS-137) - #3798
Merged
matthewhelmke merged 1 commit intoAug 18, 2026
Conversation
…gistration Add a note to the self-managed section: assuming an identity from a pipeline does not require registering GitLab as a custom identity provider, and IdP registration cannot work for a private instance whose issuer Chainguard can't reach. Steers users to the --issuer-keys flow. Refs DOCS-137. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
✅ Deploy Preview for ornate-narwhal-088216 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
matthewhelmke
marked this pull request as ready for review
August 18, 2026 17:34
s-stumbo
approved these changes
Aug 18, 2026
matthewhelmke
deleted the
matthewhelmke/docs-137-self-managed-gitlab-framing
branch
August 18, 2026 19:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Adds a note to the Self-managed GitLab instances section clarifying that you don't register a self-managed GitLab as a custom identity provider to assume an identity from a pipeline — and that registering an identity provider can't work for a private instance anyway.
Why
DOCS-137 originally proposed documenting a customer's full "register GitLab as an OIDC identity provider" procedure. Testing showed that procedure doesn't apply to the audience that needs it. For a private, internet-unreachable instance, registering an identity provider fails, and a non-pinned identity stalls at assumption. The pinned-key flow (already documented in #3795) is the only path that works. So the useful change is a short signpost steering private-instance users to
--issuer-keys, not a new procedure.How this was tested
On a private self-managed GitLab test instance (local k3s, issuer unreachable by Chainguard's STS):
chainctl iam identity-providers create --oidc-issuer=https://<private>issuer could not be validatedidentities create(no--issuer-keys)--issuer-keys+--audience(the #3795 flow)Full data and the three self-managed cases are on DOCS-137.
Refs DOCS-137.
Created in collaboration with Claude Code running Opus 4.8 on 2026-08-18.