Skip to content
SkiMasque
Sign InGet Started

Give CI jobs access to private infrastructure without giving them the whole network.

Authenticate the job with OIDC, apply a policy, and reach only the destinations it allows.

Use SkiMasque ConnectView on GitHub

SkiMasque Connect for GitHub Actions

The Action exchanges GitHub OIDC for a renewable credential. Transparent mode routes configured private TCP/UDP and split DNS on dedicated Ubuntu runners. Explicit proxy mode sets HTTP, HTTPS and SOCKS variables for tools that support them. Policy applies to traffic through the gateway; public traffic outside configured routes keeps its normal path.

.github/workflows/deploy.yml
permissions:
  id-token: write          # the job mints its own OIDC token
  contents: read

steps:
  - uses: skimasque-dev/connect@v2
    with:
      proxy: gateway.skimasque.com:443
      audience: https://gateway.skimasque.com
      mode: proxy
      application: terraform

  - run: terraform apply -auto-approve   # egresses through the gateway

Set Up ConnectView on GitHub

The problem

A deployment job may need to reach:

  • database
  • private API
  • Kubernetes API
  • internal service
  • cloud control endpoint

The traditional answer is often a VPN or VPC route from the CI runner into the private network.

Traditional access

  1. CI job
    potential
  2. VPN
    potential
  3. Whole network
    potential
  4. Everything on it
Traditional access: a CI job connects through a VPN to the whole network.

SkiMasque

  1. CI job
    proves identitycontrol plane
  2. Identity
    checkedcontrol plane
  3. Policy
    active
  4. Sessionexpires ACTIVE
    active
  5. One destinationdb.prod:5432
SkiMasque access: a CI job proves an identity, a policy allows one destination, and a temporary session carries the traffic.
Traditional access reaches a whole network; SkiMasque reaches one destination for a limited time.

SkiMasque makes the access specific to the job.

GitHub Actions flow

  1. GitHub Actionsacme/widget
    OIDCcontrol plane
  2. Identity
    policycontrol plane
  3. Policy ACCESS GRANTED
  4. Session20 min
    active
  5. Gateway
    active
  6. Databasedb.prod:5432
A GitHub Actions job proves its identity with OIDC, SkiMasque evaluates the policy, and an active session carries its traffic through the gateway to the private database.

Example

A Terraform deployment requests:

WHO
acme/infrastructure · deploy-production · main
WHAT
terraform
WHERE
db.prod:5432
LIMITS
20 minutes · 100 Mbps

Result:

ACCESS GRANTED

Agent sessions close at expiry; CI credentials renew while the job runs.

EXPIRED

Pull requests vs production

Feature branch

WHO
feature/*
WHAT
—
WHERE
staging-api:443
LIMITS
—

Main

WHO
main
WHAT
—
WHERE
staging-api:443 · db.prod:5432
LIMITS
—

Production workflow

WHO
deploy-production
WHAT
—
WHERE
db.prod:5432 · api.prod:443
LIMITS
—
Three workflows in the same repository reach different destinations.

These are illustrative policies, not automatic permissions. Configure repository, branch and workflow matches to grant each job the access it needs.

Lifecycle of a CI session

  1. JOB START
    OIDCcontrol plane
  2. IDENTITY
    policycontrol plane
  3. SESSION CREATED ACTIVE
    active
  4. DEPLOYMENT
  5. JOB COMPLETE
    potential
  6. SESSION EXPIRED EXPIRED
A CI job proves its identity, opens gateway tunnels, deploys and completes. Cleanup closes local tunnels; credentials expire independently and can renew during the job.

CI/CD integrations

Supported today:

  • GitHub Actions
  • generic OIDC
  • GitLab CI
  • Buildkite

Use proxy mode for proxy-aware tools. For psql and other raw-socket tools, configure transparent routes and private DNS, with IP/CIDR policy and a gateway that can reach those networks. Use compatible Action/client releases.

Additional integrations under consideration:

  • CircleCI
  • Jenkins
  • other workload identity providers