i must be doing something stupidly wrong here....i have cerbos configured to use gitlab. i've tested the token from cli and it works. with cli, i do

git clone <https://oauth2>:<token>@<gitlabURL>/repo.git

and it works just fine. however, i see my cerbos pods crashing with

cerbos: error: failed to create store: failed to clone from https://<giturl>/repo.git to /work: authentication required

I think you have to set

username

to

oauth2

. It appears to be empty in the screenshot.

wait

No.

username: oauth2

and

password: ${GITHUB-TOKEN}

oooooooh

Yes, that's for GitHub. GitLab works differently.

i'll try it out

BTW, the environment variable name has no significance to Cerbos. You can call it

GITLAB_TOKEN

or whatever that makes sense to you. I reckon it would be confusing to see

GITHUB-TOKEN

being used to authenticate to GitLab 🙂

yup i'm aware of that. i'll change that after i'm done testing. thank you!

That would be it because that's not a valid policy. Empty stores are completely fine.

ok

Does your repo have the

policies

directory that's referenced in the config?

yes, that directory exists. i have just copy and pasted a sample policy from

<https://docs.cerbos.dev/cerbos/latest/policies/resource_policies.html>

for testing

Which version of Cerbos are you using? It should log what the actual error is.

0.24

There's nothing after that?

let me check...

You can run

cerbos compile

on the directory to get more detailed errors. From the error message I think it's because you copied a resource policy that references a derived role set which doesn't exist in the storez

yeah i think so too after reading a bit more

The whole directory can be empty as well if you just want to check whether GitLab works. You can add your policies to it later.

oh ok

You're welcome

is there a way i can configure cerbos to not crash when an invalid policy file is encountered? just skip it and log that?

Our recommended approach is the GitOps model where policies are validated and tested before being pushed to "production". Therefore, there's no option in Cerbos to skip invalid ones.