# Automating Cerbos Policy deployments with Azure DevOps Pipelines

AAlex OlivierJuly 09, 20253 min read

This guide shows you how to set up an Azure DevOps Pipeline to automatically upload your Cerbos policies to a Cerbos Hub store whenever you push changes to the `main` branch of your repository.

## Prerequisites

- An Azure DevOps organization and a Project.
- Your policies is hosted in a repository (either Azure Repos or linked from GitHub, Bitbucket).
- The ID of your Cerbos Hub store, which you can find in the store section of the Cerbos Hub.
- Your `CERBOS_HUB_CLIENT_ID` and `CERBOS_HUB_CLIENT_SECRET` values generated in the **Client credentials** section of the Cerbos Hub store. Make sure to select the `Read & Write` option when creating the credentials to allow uploading policies.

## Step 1: Create the Pipeline YAML File

. In the root directory of your repository, create a new file named `azure-pipelines.yml`.
. Copy and paste the following code into the file. This code defines the trigger, the agent environment, and the steps to run.
. Replace `[STORE_ID]` with the ID of your Cerbos Hub store. You can find this in the Cerbos Hub UI under the store settings.

```yaml
----
# azure-pipelines.yml
trigger:
  branches:
    include:
      - main # This pipeline runs on pushes to the main branch

pool:
  vmImage: 'ubuntu-latest' # Use a Microsoft-hosted Linux agent

jobs:
- job: UploadCerbosPolicies
  displayName: 'Upload Cerbos Policies'
  steps:
    # Step 1: Check out the source code from the repository
    - checkout: self

# Step 2: Run the docker command to upload policies
    - script: |
        docker run --rm \
          -e CERBOS_HUB_STORE_ID="[STORE_ID]" \
          -e CERBOS_HUB_CLIENT_ID=$CERBOS_HUB_CLIENT_ID \
          -e CERBOS_HUB_CLIENT_SECRET=$CERBOS_HUB_CLIENT_SECRET \
          -v "$(System.DefaultWorkingDirectory)":/app \
          ghcr.io/cerbos/cerbosctl:latest \
          hub store replace-files /app --message="Policy upload from Azure DevOps"
      displayName: 'Upload Policies to Cerbos Hub'
      env:
        # Map the secret variables created in the UI to environment variables for this script
        CERBOS_HUB_CLIENT_ID: $(CERBOS_HUB_CLIENT_ID)
        CERBOS_HUB_CLIENT_SECRET: $(CERBOS_HUB_CLIENT_SECRET)
```

**Key Azure DevOps Concepts Used:**

- `trigger`: Defines when the pipeline runs, equivalent to `on:` in GitHub Actions.
- `pool`: Specifies the type of build agent to use, equivalent to `runs-on`.
- `job` and `steps`: Structure the work to be done.
- `checkout: self`: The task to get your source code.
- `script`: A simple task to run a shell script.
- `$(System.DefaultWorkingDirectory)`: The predefined variable for the checkout directory, like `$PWD` or `$CI_PROJECT_DIR`.
- `env:`: The section where you map pipeline variables to environment variables for the script, note the `$(VariableName)` syntax.

## Step 2: Create the Pipeline in Azure DevOps

- Go to your Azure DevOps project. In the left sidebar, click on _Pipelines_.
- Click the _New pipeline_ button (or _Create pipeline_ if it is your first one).
- _Where is your code?_ Select the correct location, for example, _Azure Repos Git_, _GitHub_. You may need to authorize access.
- _Select a repository:_ Choose the repository where you just added the `azure-pipelines.yml` file.
- _Configure your pipeline:_ Azure DevOps detects your YAML file. Select _Existing Azure Pipelines YAML file_.
- Select the branch, for example, `main` and the path, `/azure-pipelines.yml`, then click _Continue_.

## Step 3: Add Your Secrets

- You now see the YAML file in the pipeline editor view. _Do not run it yet._
- In the top right corner, click the _Variables_ button.
- Click _New variable_
\-\- Name: `CERBOS_HUB_CLIENT_ID`
\-\- Value: Paste your client ID.
- Check the box for _Keep this value secret_.
- Click _OK_.
- Click _New variable_ again.
\-\- Name: `CERBOS_HUB_CLIENT_SECRET`
\-\- Value: Paste your client secret.
- Check the box for _Keep this value secret_.
- Click _OK_.
- Click the _Save_ button at the bottom of the variables pane.

## Step 4: Save and Run the Pipeline

- Now that the secrets are saved, click the _Save and run_ button, or just _Run_, in the top right corner.
- Confirm the branch and commit message, and click _Save and run_ again.

## Step 5: Verify the Run

- You are taken to the pipeline run summary page.
- Click on the `Upload Cerbos Policies` job to see the live logs.
- If everything is configured correctly, all steps complete with a green checkmark, and your policies are uploaded to Cerbos Hub.