Skip to main content

CI Trust

CI Trust is a security feature of the Connected AI Platform that enables a secure, automated connection between your GitHub repository and your Managed Kubeflow Workspace. This mapping allows your CI/CD systems (such as GitHub Actions) to securely log in and interact with your CAIP environments (clusters and namespaces) without the need for long-lived credentials.

By leveraging OpenID Connect (OIDC), CI Trust establishes a trust relationship between the Connected AI Platform and your CI system. This allows your CI pipelines to assume roles and access resources in your Managed Kubeflow Workspace securely, following best practices for authentication and authorization.

How it works​

  • A trust relationship is configured between the Connected AI Platform and your CI system using OIDC.
  • When a pipeline runs, the CI system authenticates using OIDC and receives a short-lived access token.
  • The token allows the pipeline to assume roles and access resources in your Managed Kubeflow Workspace as needed.

This approach minimizes the use of long-lived tokens and ensures that only trusted CI pipelines can access your environment.

Setting Up CI Trust​

To set up CI Trust for your project, submit a service request:

Establish CI Trust

Once approved, your GitHub repository will be securely mapped to your Managed Kubeflow Workspace, enabling safe and automated CI/CD workflows.

Setting Up Spaceship Runners​

If you haven't already, you must set up the Spaceship Runners for your Git repository. Follow the document below for setup instructions:

Spaceship Runners Onboarding

Role To Assume​

Once the trust relationship is established and roles are assigned, you can assume the IAM role in your CI flow. These Roles adhere to the following naming convention:

  • cicd-technical-user-[product]-[functional-area]

The product here is the CAIP cluster, for example, for managed Kubeflow it's mcaip-kflw, and the functional area is your CAIP namespace (e.g., cais-lighthouse), the role would be:

  • cicd-technical-user-mcaip-kflw-cais-lighthouse

Example: GitHub Actions Workflow​

Below is an example of how to configure your GitHub Actions workflow to use CI Trust with the Connected AI Platform.

jobs:
  login:
    runs-on: cawe-linux-x64-general-small
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-skip-session-tagging: true
          role-to-assume: arn:aws:iam::${{ account-number }}:role/orbit/${{ role-name }}
          aws-region: ${{ region }}