Deploy Endor Labs GitLab App

Learn how to continuously monitor your environment with the Endor Labs GitLab App.

Endor Labs provides a GitLab App that continuously monitors users’ projects for security and operational risk. You can use the GitLab App to selectively scan your repositories for SCA, secrets, SAST, and CI/CD tools.

When you use Endor Labs GitLab App, Endor Labs creates namespaces based on your organization hierarchy in GitLab.

The namespaces created by the Endor Labs GitLab App are not like regular namespaces and are called managed namespaces. These namespaces are named after subgroup slugs in GitLab.

Limitations of GitLab groups in Endor Labs namespace

Ensure that you consider the following limitations when you use the GitLab monitoring scan.

  • GitLab supports up to 20 levels of subgroup nesting, while Endor Labs currently supports a maximum of 10 levels, assuming the installation is created at the tenant level. If a GitLab installation is created within a nested namespace, such as tenant.namespace1.namespace2, the available nesting depth for subgroups in GitLab is reduced. In this case, Endor Labs can only support up to eight levels of nested subgroups.
  • Endor Labs supports GitLab groups with a maximum of 64 characters
  • Endor Labs does not support dot(.) in group paths and will skip the creation of namespace for such groups.

Managed Namespaces in Endor Labs

Managed namespaces are always reflective in terms of structure and content in the SCM platform.

  • You cannot delete managed namespaces.

  • You cannot delete projects present within managed namespaces.

  • You cannot add projects or create namespaces within managed namespaces.

  • You cannot create any new Endor Labs App installation within the managed namespaces.

    For example, you cannot create an Endor Labs GitHub App installation within a namespace that was created by the Endor Labs GitLab App.

Any modifications to the namespaces have to be done at the SCM side. The changes that you make to the namespaces and projects are reflected in Endor Labs after a rescan.

If your SCM has the following hierarchy:

graph TD
    HC[HappyCorp]

    %% Main divisions
    Web[Web]
    Mobile[Mobile]
    Desktop[Desktop]

    %% Web subgroups
    WA[Alpha]
    WB[Beta]
    WG[Gamma]

    %% Mobile subgroups
    MD[Delta]
    ME[Epsilon]
    MZ[Zeta]

    %% Desktop subgroups
    DP[Pi]
    DR[Rho]
    DS[Sigma]

    %% Main connections
    HC --> Web
    HC --> Mobile
    HC --> Desktop

    %% Web connections
    Web --> WA
    Web --> WB
    Web --> WG

    %% Mobile connections
    Mobile --> MD
    Mobile --> ME
    Mobile --> MZ

    %% Desktop connections
    Desktop --> DP
    Desktop --> DR
    Desktop --> DS

    class HC main
    class Web,Mobile,Desktop division

Endor Labs creates HappyCorp as the parent namespace with Web, Mobile, and Desktop as the child namespaces. The namespace HappyCorp will be under the Endor Labs namespace (for example, HappyEndor) that you create.

Each of these child namespaces have further child namespaces as follows:

  • Web: Alpha, Beta, Gamma
  • Mobile: Delta, Epsilon, Zeta
  • Desktop: Pi, Rho, Sigma

The following diagram shows the organization of namespaces in Endor Labs.

graph TD
    EN[HappyEndor]
    HC[HappyCorp]

    %% Main divisions
    Web[Web]
    Mobile[Mobile]
    Desktop[Desktop]

    %% Web subgroups
    WA[Alpha]
    WB[Beta]
    WG[Gamma]

    %% Mobile subgroups
    MD[Delta]
    ME[Epsilon]
    MZ[Zeta]

    %% Desktop subgroups
    DP[Pi]
    DR[Rho]
    DS[Sigma]

    %% Main connections
    EN --> HC
    HC --> Web
    HC --> Mobile
    HC --> Desktop

    %% Web connections
    Web --> WA
    Web --> WB
    Web --> WG

    %% Mobile connections
    Mobile --> MD
    Mobile --> ME
    Mobile --> MZ

    %% Desktop connections
    Desktop --> DP
    Desktop --> DR
    Desktop --> DS

    class HC main
    class Web,Mobile,Desktop division

Prerequisites for GitLab App

Before installing and scanning projects with Endor Labs GitLab App, make sure you have:

  • A GitLab cloud account and organization. If you don’t have one, create one at GitLab.
  • Endor Labs GitLab App requires a GitLab personal access token with at least read_api permission.

Install the GitLab App

  1. Sign in to Endor Labs.

  2. Select Projects from the left sidebar and click Add Project.

  3. From GITLAB, select GitLab App. GitLab App

  4. Enter the GitLab organization URL in the format: https://gitlab.com/{group}/{subgroup1}/....

    You need to enter at least the root group. For example, https://gitlab.com/group1.

    You can provide the host URL up to any subgroup level. For example, https://gitlab.com/group1/subgroup1/subgroup2/subgroup3.

    Endor Labs creates namespaces for groups and subgroups and maps projects to these namespaces.

    If the GitLab installation is created at the tenant level, Endor Labs supports up to 10 levels of GitLab group nesting. If the installation is created within a nested namespace under the tenant, the supported nesting depth decreases by one level for each additional level of nesting.

  5. Enter the GitLab personal access token.

    The personal access token must have at least the read_api permission.

  6. Select the scan types to enable.

    • SCA- Perform software composition analysis.
    • Secret - Scan GitLab projects for exposed secrets.
    • CI/CD - Scan GitLab projects and identify all the CI/CD tools used.
    • SAST - Scan GitLab projects to generate SAST findings.

    The available scan types depend upon your license.

  7. Click Create.

Endor Labs GitLab App scans your GitLab projects every 24 hours and reports any new findings or changes to release versions of your code.

Manage GitLab App on Endor Labs

You can edit or delete the GitLab App integrations.

To edit the GitLab App integration:

  1. Sign in to Endor Labs and select Manage > Integrations from the left navigation menu.
  2. Click Manage next to GitLab under Source Control Managers. Manage GitLab App
  3. Click on the three vertical dots next to the integration, and select Edit Integration. You can update your personal access token and choose the scanners. Edit GitLab App
  4. Click Save. The changes are applicable from the next scanning cycle.

To delete a GitLab App integration, click on the three vertical dots next to the integration, and select Delete Integration. Manage GitLab App When you delete the integration, it will also delete all child namespaces, projects and references associated with the auto generated root group namespace. It also deletes any manually created namespaces and projects under auto generated namespace.

To manually trigger a scan, click Rescan Org. GitLab App scans your repositories every 24 hours, use Rescan Org to manually schedule outside the 24-hour period.

Click Scan More Repositories to go to Projects, where you can add more projects to scan through the GitLab App.

When you create a new installation of the GitLab app, it cannot be in the same root group. For example, if a GitLab installation exists in gitlab.com/group1/sg1, you cannot create another installation under group1 like gitlab.com/group1/sg2/. You need to create the with a different root group. For example, gitlab.com/group2/sg2.