Skip to content

Clarify private self-managed GitLab uses key-pinning, not IdP registration (DOCS-137) #3798

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matthewhelmke merged 1 commit into from
Aug 18, 2026
Merged

Clarify private self-managed GitLab uses key-pinning, not IdP registration (DOCS-137) #3798

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion content/platform/administration/assumable-ids/identity-examples/gitlab-identity.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ lead: ""
description: "Procedural tutorial outlining how to create a Chainguard identity that can be assumed by a GitLab CI/CD pipeline."
type: "article"
date: 2023-06-28T08:48:45+00:00
lastmod: 2026-08-18T14:29:28+00:00
lastmod: 2026-08-18T17:17:24+00:00
draft: false
tags: ["Chainguard Containers", "Procedural"]
images: []
Expand Down Expand Up @@ -94,6 +94,8 @@ Set `--identity-issuer` and `--audience` to your instance's URL instead of `http

Because the keys are pinned rather than fetched on demand, the identity doesn't pick up key rotations automatically. GitLab rotates its signing keys, so `chainctl` creates a static identity that expires after a set period, 30 days by default. Recreate the identity with the current JWKS before it expires or whenever the keys rotate.

> **Note**: You don't need to register your self-managed GitLab as a [custom identity provider](/platform/administration/custom-idps/custom-idps/) to assume an identity from a pipeline. Custom identity providers federate human sign-in to Chainguard, whereas a pipeline assumes an identity through the OIDC token exchange described above. Registering a private instance as an identity provider won't work in any case, because Chainguard can't reach its issuer to validate it — the same reachability limit that requires you to pin the keys with `--issuer-keys`.

## Create an assumable identity with Terraform

This section outlines how to use Terraform to create an identity for a GitLab pipeline to assume. This involves creating two Terraform configuration files that, together, will produce such an identity.
Expand Down