Federation and Zero Trust CI in
summary
The U.S. DOE exascale team implements federated auth for GitLab CI by making OmniAuth credentials extraction first-class, storing OAuth2/SAML credential fields and passing access tokens to runners. Runners validate tokens against identity providers (Google, JSON Web Token IDP), perform UID remapping (setuid fallback), and emit Enterprise Edition audit events with job/project IDs for traceability. Demo shows CI jobs running as federated identities on VMs and the asti instance and the remap+validation flow succeeds. federated runners validate access tokens
AI-written summary · about
chapters (13)
- 0:00Introduction and background
- 1:05Exascale Computing Project overview
- 3:53CI challenges in HPC environments
- 5:40Federation and Zero Trust model
- 7:07Technical enhancements in GitLab
- 11:08Live demo setup and shell runner
- 12:39Set UID enhancement demo
- 16:31Federation with OmniAuth demo
- 18:19Pre-production testing environment
- 20:44Runner admin validation script
- 23:34Auditing Federation events
- 25:00Lessons learned and next steps
- 28:10Q&A and closing
related talks
20mSecuring OIDC Federation in CI/CD Workflows
34mZero trust CI/CD pipeline
50mDestroying Long-Lived Cloud Credentials with Workload Identity Federation
17mOIDC and CICD: Why Your CI Pipeline Is Your Greatest Security Threat
28mBuilding Identity for an Open Perimeter
29mCompliance and Identity Management in Kubernetes
23mZero-Trust Architecture for Agentic AI: Securing Multi-User Access and Third-Party Integrations
28mIdentity: From Legacy to Microservices