Learn how to continuously monitor your environment with the Endor Labs GitLab App.
Endor Labs provides a GitLab App that continuously monitors users’ projects for security and operational risk. You can use the GitLab App to selectively scan your repositories for SCA, secrets, SAST, and CI/CD tools. You can use the GitLab App with a GitLab cloud account or a self-hosted GitLab instance.
When you use Endor Labs GitLab App, Endor Labs creates namespaces based on your organization hierarchy in GitLab.
The namespaces created by the Endor Labs GitLab App are not like regular namespaces and are called managed namespaces. These namespaces are named after subgroup slugs in GitLab.
See Manage GitLab App to learn how to manage your GitLab App integration in Endor Labs.
Limitations of GitLab groups in Endor Labs namespace
Ensure that you consider the following limitations when you use the GitLab monitoring scan.
- GitLab supports up to 20 levels of subgroup nesting, while Endor Labs currently supports a maximum of 10 levels, assuming the installation is created at the tenant level. If a GitLab installation is created within a nested namespace, such as
tenant.namespace1.namespace2, the available nesting depth for subgroups in GitLab is reduced. In this case, Endor Labs can only support up to eight levels of nested subgroups.
- Endor Labs supports GitLab groups with a maximum of 64 characters.
Managed namespaces for GitLab
Managed namespaces are always reflective in terms of structure and content in GitLab.
Managed namespaces have the following restrictions:
-
You cannot delete managed namespaces.
-
You cannot delete projects present within managed namespaces.
-
You cannot add projects or create namespaces within managed namespaces.
-
You cannot create any new Endor Labs App installation within the managed namespaces.
For example, you cannot create an Endor Labs GitHub App installation within a namespace that was created by the Endor Labs GitLab App.
Any modifications to the namespaces have to be in GitLab. The changes that you make to the namespaces and projects are reflected in Endor Labs after a rescan.
If your organization has the following hierarchy in GitLab:
graph TD
GL((GitLab))
HC[HappyCorp]
%% Main divisions
Web[Web]
Mobile[Mobile]
Desktop[Desktop]
%% Web subgroups
WA[Alpha]
WB[Beta]
WG[Gamma]
%% Mobile subgroups
MD[Delta]
ME[Epsilon]
MZ[Zeta]
%% Desktop subgroups
DP[Pi]
DR[Rho]
DS[Sigma]
%% Main connections
GL --> HC
HC --> Web
HC --> Mobile
HC --> Desktop
%% Web connections
Web --> WA
Web --> WB
Web --> WG
%% Mobile connections
Mobile --> MD
Mobile --> ME
Mobile --> MZ
%% Desktop connections
Desktop --> DP
Desktop --> DR
Desktop --> DS
class HC main
class Web,Mobile,Desktop division
classDef default fill:#D3D3D3
classDef circle fill:white
class GL circle
Endor Labs creates managed namespaces that mirror your GitLab groups under an Endor Labs namespace (for example, happyendor). Endor Labs creates happycorp as the parent namespace with web, mobile, and desktop as the child namespaces. The namespace happycorp will be under the Endor Labs namespace.
Each of these child namespaces have further child namespaces as follows:
- web: alpha, beta, gamma
- mobile: delta, epsilon, zeta
- desktop: pi, rho, sigma
The following diagram shows the organization of namespaces in Endor Labs.
graph TD
EN[happyendor]
HC[happycorp]
%% Main divisions
Web[web]
Mobile[mobile]
Desktop[desktop]
%% Web subgroups
WA[alpha]
WB[beta]
WG[gamma]
%% Mobile subgroups
MD[delta]
ME[epsilon]
MZ[zeta]
%% Desktop subgroups
DP[pi]
DR[rho]
DS[sigma]
%% Main connections
EN --> HC
HC --> Web
HC --> Mobile
HC --> Desktop
%% Web connections
Web --> WA
Web --> WB
Web --> WG
%% Mobile connections
Mobile --> MD
Mobile --> ME
Mobile --> MZ
%% Desktop connections
Desktop --> DP
Desktop --> DR
Desktop --> DS
class HC main
class EN endor
class Web,Mobile,Desktop division
class WA,WB,WG,MD,ME,MZ,DP,DR,DS group
classDef main fill:#3FE1F3
classDef division fill:#3FE1F3
classDef group fill:#3FE1F3
Note
In Endor Labs, namespaces are always in lowercase. If your groups have uppercase characters in their names, the corresponding namespaces will be converted to lowercase.
Manage multiple installations of GitLab App
You cannot create multiple GitLab installations with the same root group in the host URL within the same Endor Labs namespace.
For example, if a GitLab installation exists with a host URL like gitlab.com/group1/sg1, you cannot create another installation with a host URL like gitlab.com/group1/sg2 within the same Endor namespace. Instead, you must create the installation with a different root group in the host URL, such as gitlab.com/group2/sg2.
graph TD
%% Endor Labs namespace
EN[happyendor]
%% GitLab groups
G1[group1]
G2[group2]
SG1[sg1]
SG2[sg2]
%% connections
EN --> G1
EN --> G2
G1 --> SG1
G2 --> SG2
class EN endor
class G1,G2,SG1,SG2 managed
classDef managed fill:#3FE1F3
If you wish to create an installation with a host URL like gitlab.com/group1/sg2, it should be inside a different Endor Labs namespace.
graph TD
%% Endor Labs namespace
EN[happyendor]
EN2[happyendor2]
%% GitLab groups
G1[group1]
G2[group1]
SG1[sg1]
SG2[sg2]
%% connections
EN --> G1
EN2 --> G2
G1 --> SG1
G2 --> SG2
class EN,EN2 endor
class G1,G2,SG1,SG2 managed
classDef managed fill:#3FE1F3
Prerequisites for GitLab App
Before installing and scanning projects with Endor Labs GitLab App, make sure you have:
Install the GitLab App
-
Sign in to Endor Labs.
-
Select Projects from the left sidebar and click Add Project.
-
From GITLAB, select GitLab App.
-
Enter the GitLab organization URL in the format: https://gitlab.com/{group}/{subgroup1}/....
You need to enter at least the root group. For example, https://gitlab.com/group1.
You can provide the host URL up to any subgroup level. For example, https://gitlab.com/group1/subgroup1/subgroup2/subgroup3.
Endor Labs creates namespaces for groups and subgroups and maps projects to these namespaces.
If the GitLab installation is created at the tenant level, Endor Labs supports up to 10 levels of GitLab group nesting. If the installation is created within a nested namespace under the tenant, the supported nesting depth decreases by one level for each additional level of nesting.
-
Enter the GitLab personal access token.
The personal access token must have at least the read_api permission.
-
Select the scan types to enable:
- SCA: Perform software composition analysis and discover AI models used in your repository.
- Secret: Scan GitLab projects for exposed secrets.
- CI/CD: Scan GitLab projects and identify all the CI/CD tools used.
- SAST: Scan GitLab projects to generate SAST findings.
The available scan types depend upon your license.
-
Select Include Archived Repositories to scan your archived repositories. By default, the GitLab archived repositories aren’t scanned.
-
Click Create.
Endor Labs GitLab App scans your GitLab projects every 24 hours and reports any new findings or changes to release versions of your code.
Note
Only users with admin authorization role can create and manage installations.
