Deploy Endor Labs GitLab App

Learn how to continuously monitor your environment with the Endor Labs GitLab App.

Beta

Endor Labs provides a GitLab App that continuously monitors users’ projects for security and operational risk. You can use the GitLab App to selectively scan your repositories for SCA, secrets, SAST, and CI/CD tools.

When you use Endor Labs GitLab App, Endor Labs creates namespaces based on your organization hierarchy in GitLab.

The namespaces created by the Endor Labs GitLab App are not like regular namespaces and are called managed namespaces. These namespaces are named after subgroup slugs in GitLab.

Limitations of GitLab groups in Endor Labs namespace

Ensure that you consider the following limitations when you use the GitLab monitoring scan.

GitLab supports up to 20 levels of subgroup nesting, while Endor Labs currently supports a maximum of 10 levels, assuming the installation is created at the tenant level. If a GitLab installation is created within a nested namespace, such as tenant.namespace1.namespace2, the available nesting depth for subgroups in GitLab is reduced. In this case, Endor Labs can only support up to eight levels of nested subgroups.
Endor Labs supports GitLab groups with a maximum of 64 characters
Endor Labs does not support dot(.) in group paths and will skip the creation of namespace for such groups.

Managed namespaces for GitLab

Managed namespaces are always reflective in terms of structure and content in GitLab.

Managed namespaces have the following restrictions:

You cannot delete managed namespaces.
You cannot delete projects present within managed namespaces.
You cannot add projects or create namespaces within managed namespaces.
You cannot create any new Endor Labs App installation within the managed namespaces.

For example, you cannot create an Endor Labs GitHub App installation within a namespace that was created by the Endor Labs GitLab App.

Any modifications to the namespaces have to be in GitLab. The changes that you make to the namespaces and projects are reflected in Endor Labs after a rescan.

If your organization has the following hierarchy in GitLab:

graph TD
    GL((GitLab))
    HC[HappyCorp]

    %% Main divisions
    Web[Web]
    Mobile[Mobile]
    Desktop[Desktop]

    %% Web subgroups
    WA[Alpha]
    WB[Beta]
    WG[Gamma]

    %% Mobile subgroups
    MD[Delta]
    ME[Epsilon]
    MZ[Zeta]

    %% Desktop subgroups
    DP[Pi]
    DR[Rho]
    DS[Sigma]

    %% Main connections
    GL --> HC
    HC --> Web
    HC --> Mobile
    HC --> Desktop

    %% Web connections
    Web --> WA
    Web --> WB
    Web --> WG

    %% Mobile connections
    Mobile --> MD
    Mobile --> ME
    Mobile --> MZ

    %% Desktop connections
    Desktop --> DP
    Desktop --> DR
    Desktop --> DS

    class HC main
    class Web,Mobile,Desktop division
    classDef default fill:#D3D3D3
    classDef circle fill:white
    class GL circle

Endor Labs creates managed namespaces that mirror your GitLab groups under an Endor Labs namespace (for example, happyendor). Endor Labs creates happycorp as the parent namespace with web, mobile, and desktop as the child namespaces. The namespace happycorp will be under the Endor Labs namespace.

Each of these child namespaces have further child namespaces as follows:

web: alpha, beta, gamma
mobile: delta, epsilon, zeta
desktop: pi, rho, sigma

The following diagram shows the organization of namespaces in Endor Labs.

graph TD
    EN[happyendor]
    HC[happycorp]

    %% Main divisions
    Web[web]
    Mobile[mobile]
    Desktop[desktop]

    %% Web subgroups
    WA[alpha]
    WB[beta]
    WG[gamma]

    %% Mobile subgroups
    MD[delta]
    ME[epsilon]
    MZ[zeta]

    %% Desktop subgroups
    DP[pi]
    DR[rho]
    DS[sigma]

    %% Main connections
    EN --> HC
    HC --> Web
    HC --> Mobile
    HC --> Desktop

    %% Web connections
    Web --> WA
    Web --> WB
    Web --> WG

    %% Mobile connections
    Mobile --> MD
    Mobile --> ME
    Mobile --> MZ

    %% Desktop connections
    Desktop --> DP
    Desktop --> DR
    Desktop --> DS

    class HC main
    class EN endor
    class Web,Mobile,Desktop division
    class WA,WB,WG,MD,ME,MZ,DP,DR,DS group
    classDef main fill:#3FE1F3
    classDef division fill:#3FE1F3
    classDef group fill:#3FE1F3

Note

In Endor Labs, namespaces are always in lowercase. If your groups have uppercase characters in their names, the corresponding namespaces will be converted to lowercase.

Manage multiple installations of GitLab App

You cannot create multiple GitLab installations with the same root group in the host URL within the same Endor Labs namespace.

For example, if a GitLab installation exists with a host URL like gitlab.com/group1/sg1, you cannot create another installation with a host URL like gitlab.com/group1/sg2 within the same Endor namespace. Instead, you must create the installation with a different root group in the host URL, such as gitlab.com/group2/sg2.

graph TD

      %% Endor Labs namespace
      EN[happyendor]

      %% GitLab groups
      G1[group1]
      G2[group2]
      SG1[sg1]
      SG2[sg2]

      %% connections
      EN --> G1
      EN --> G2
      G1 --> SG1
      G2 --> SG2

      class EN endor
      class G1,G2,SG1,SG2 managed
      classDef managed fill:#3FE1F3

If you wish to create an installation with a host URL like gitlab.com/group1/sg2, it should be inside a different Endor Labs namespace.

graph TD

      %% Endor Labs namespace
      EN[happyendor]
      EN2[happyendor2]

      %% GitLab groups
      G1[group1]
      G2[group1]
      SG1[sg1]
      SG2[sg2]

      %% connections
      EN --> G1
      EN2 --> G2
      G1 --> SG1
      G2 --> SG2

      class EN,EN2 endor
      class G1,G2,SG1,SG2 managed
      classDef managed fill:#3FE1F3

Prerequisites for GitLab App

Before installing and scanning projects with Endor Labs GitLab App, make sure you have:

A GitLab cloud account and organization. If you don’t have one, create one at GitLab.
Endor Labs GitLab App requires a GitLab personal access token with at least read_api permission.

Install the GitLab App

Sign in to Endor Labs.
Select Projects from the left sidebar and click Add Project.
From GITLAB, select GitLab App.
Enter the GitLab organization URL in the format: https://gitlab.com/{group}/{subgroup1}/....

You need to enter at least the root group. For example, https://gitlab.com/group1.

You can provide the host URL up to any subgroup level. For example, https://gitlab.com/group1/subgroup1/subgroup2/subgroup3.

Endor Labs creates namespaces for groups and subgroups and maps projects to these namespaces.

If the GitLab installation is created at the tenant level, Endor Labs supports up to 10 levels of GitLab group nesting. If the installation is created within a nested namespace under the tenant, the supported nesting depth decreases by one level for each additional level of nesting.
Enter the GitLab personal access token.

The personal access token must have at least the read_api permission.
Select the scan types to enable.
- SCA- Perform software composition analysis.
- Secret - Scan GitLab projects for exposed secrets.
- CI/CD - Scan GitLab projects and identify all the CI/CD tools used.
- SAST - Scan GitLab projects to generate SAST findings.
- AI models - Scan source code to detect AI models and assess associated risks.
The available scan types depend upon your license.
Click Create.

Endor Labs GitLab App scans your GitLab projects every 24 hours and reports any new findings or changes to release versions of your code.

Manage GitLab App on Endor Labs

You can edit or delete the GitLab App integrations.

To edit the GitLab App integration:

Sign in to Endor Labs and select Manage > Integrations from the left navigation menu.
Click Manage next to GitLab under Source Control Managers.
Click on the three vertical dots next to the integration, and select Edit Integration. You can update your personal access token and choose the scanners.
Click Save. The changes are applicable from the next scanning cycle.

To delete a GitLab App integration, click on the three vertical dots next to the integration, and select Delete Integration. Manage GitLab App When you delete the integration, it will also delete all child namespaces, projects and references associated with the auto generated root group namespace. It also deletes any manually created namespaces and projects under auto generated namespace.

To manually trigger a scan, click Rescan Org. GitLab App scans your repositories every 24 hours, use Rescan Org to manually schedule outside the 24-hour period.

Click Scan More Repositories to go to Projects, where you can add more projects to scan through the GitLab App.