Outpost configuration

​

Configure Outpost integration

1. Select User menu > Integrations from the left sidebar.
2. Click Configure under On-Prem Integration.
3. Choose from the following authentication methods:
   • API: Use the Endor Labs API key authentication for Outpost. You need to enter the API key and API secret. See API key authentication for Outpost for more information.
     If you use Endor Labs with an EU tenant, use https://api.eu.endorlabs.com instead of https://api.endorlabs.com.
   • Azure: Use the Azure managed identity authentication for Outpost. You need to enter the Azure managed identity client ID. See Azure Managed Identity authentication for Outpost for more information.
   • Google: Use the GCP service account authentication for Outpost. You need to enter the GCP service account name. See GCP Service Account authentication for Outpost for more information.
4. Click Advanced to configure the following parameters:
   • Select Enable Build Tool Caching to enable build tool caching. Bazel remote cache is installed and the build tools are cached in the cluster.
   • Enter the number of concurrent scans that Outpost can run in Max Running Scans.
   • Enter the maximum duration of a scan in Max Duration.
5. Click Enable Scheduler to store the configuration and enable Outpost.
6. Click Download Helm Values to download the endor-outpost-values.yaml file. You can choose to customize the values before you deploy Outpost. You can also extract the chart from oci://endorcipublic.azurecr.io/charts/onprem-scheduler and refer the default values.yaml for all the available options. See Helm Chart Values for more information.
7. Run the following command to deploy Outpost in your Kubernetes cluster.
   helm install endorlabsscheduler oci://endorcipublic.azurecr.io/charts/onprem-scheduler \
   -n <your Kubernetes namespace> \
   -f endor-outpost-values.yaml
   
   The command installs the Outpost scheduler on your Kubernetes cluster.
   ImportantIf you use GCP service account authentication, you need to configure annotations for the service account in Helm values.Add the following annotations to the Helm chart values before you run the Helm install command.

   scheduler:
    .
    .
     serviceAccount:
       create: true
       annotations:
         iam.gke.io/gcp-service-account: "endor-scanner-sa@project-name-123456.iam.gserviceaccount.com"
   endorctl:
    .
    .
     serviceAccount:
       create: true
       annotations:
         iam.gke.io/gcp-service-account: "endor-scanner-sa@project-name-123456.iam.gserviceaccount.com"
   

   If you run the Helm command directly, update the generated Helm command to set the annotations with the following options:

   --set scheduler.serviceAccount.annotations.iam.gke.io/gcp-service-account="<GCP_SERVICE_ACCOUNT_NAME>@<GCP_PROJECT_NAME>.iam.gserviceaccount.com"
   --set endorctl.serviceAccount.annotations.iam.gke.io/gcp-service-account="<GCP_SERVICE_ACCOUNT_NAME>@<GCP_PROJECT_NAME>.iam.gserviceaccount.com"
   

   For example:

   helm install endorlabsscheduler oci://endorcipublic.azurecr.io/charts/onprem-scheduler \
       -n <k8s-ns> \
       --set endorAPI=https://api.endorlabs.com \
       --set endorNamespace=nryn \
       --set auth.gcpServiceAccountName=endor-scanner-sa@project-name-123456.iam.gserviceaccount.com \
       --set scheduler.serviceAccount.annotations.iam.gke.io/gcp-service-account="endor-scanner-sa@project-name-123456.iam.gserviceaccount.com" \
       --set endorctl.serviceAccount.annotations.iam.gke.io/gcp-service-account="endor-scanner-sa@project-name-123456.iam.gserviceaccount.com" \
       --set bazelremote.install=false
   

   The annotations are automatically added to the Helm chart values if you choose Azure managed identity authentication.
8. If you do not want to customize the values, the Helm command with your configured values appears in the user interface. You can copy the command and run it on your Kubernetes cluster. For example, the following command appears on the user interface when you configure the integration on the endor Kubernetes namespace with the Azure managed identity authentication and build tool caching enabled. The root Endor Labs namespace is endor.
   helm install endorlabsscheduler oci://endorcipublic.azurecr.io/charts/onprem-scheduler \
        -n endor \
        --set endorAPI=https://api.endorlabs.com \
        --set endorNamespace=endor \
        --set auth.azureManagedIdentityClientID=12a34b56-7c89-0d1e-2f34-567g890h1234 \
        --set bazelremote.install=true
   
   You can copy the command and run it on your Kubernetes cluster to deploy Outpost.

​

Update Outpost configuration

helm uninstall endorlabsscheduler -n <your namespace>

1. Select User menu > Integrations from the left sidebar.
2. Click Manage under On-Prem Integration.
3. Update the configuration and click Enable Scheduler to update the configuration.
4. Apply the updated values with the helm install command as described in Configure Outpost integration.

​

View Outpost logs

1. Select User menu > Integrations from the left sidebar.
2. Click View Logs under On-Prem Integration. You can copy the logs to the clipboard or download the logs. By default, the logs are brief logs are displayed. You can select Show Verbose Logs to view the detailed logs. The log level is set as All by default. You can select Info to view the info logs and Debug to view the debug logs.

​

Helm Chart Values

helm pull oci://endorcipublic.azurecr.io/charts/onprem-scheduler --untar

# Default values for onprem-scheduler.
# This file is YAML-formatted.

# Base URL for the Endor Labs platform [Do not modify]
endorAPI: "https://api.endorlabs.com"

# Your organization's namespace in Endor Labs [Do not modify unless there is a change in your tenant]
endorNamespace: "required"

# Log level for scheduler and endorctl. Optional.
logLevel: "info"

# Log output format for scheduler. Optional.
logOutput: "json"

# Authentication configuration - use ONE of the following methods.
# NOTE: Only one authentication method (apiKey & apiSecret, gcpServiceAccountName,
# or azureManagedIdentityClientID) must be set.
auth:
  # Option 1: API Key authentication. Enter the Endor Labs API key and secret.
  # You can also create Kubernetes secrets for the API key and secret and provide the secret names instead of directly entering the values.
  apiKey: ""
  apiSecret: ""

  # Option 2: GCP Service Account authentication. Enter the GCP service account name.
  # NOTE: Ensure service accounts are created with workload identity annotations.
  gcpServiceAccountName: ""

  # Option 3: Azure Managed Identity authentication. Enter the Azure managed identity client ID.
  # NOTE: Ensure service accounts are created with workload identity annotations.
  azureManagedIdentityClientID: ""

scheduler:
  # Maximum number of scans that you want to run concurrently. Optional.
  maxRunningJobs: 20

  # Scheduler container image settings.
  image:
    # Container repository for the scheduler image [Do not modify]
    repository: "endorcipublic.azurecr.io/scheduler"

    # Image version to use [Do not modify]
    tag: "latest"

    # Image pull policy [Do not modify]
    pullPolicy: "Always"

  # Labels for the scheduler deployment. Optional.
  labels: {}

  # Annotations for the scheduler deployment. Optional.
  annotations: {}

  # Labels for the scheduler pod. Optional.
  podLabels: {}

  # Annotations for the scheduler pod. Optional.
  podAnnotations: {}

  serviceAccount:
    # Specifies whether a service account should be created. Optional.
    create: false

    # Name of the service account to use for scheduler. Optional.
    name: ""

    # Labels for the scheduler service account. Optional.
    labels: {}

    # Annotations for the scheduler service account. Optional.
    annotations: {}

  # Pod-level security context for the scheduler. Optional.
  podSecurityContext: {}

  # Container-level security context for the scheduler. Optional.
  securityContext: {}

  # Resource constraints for the scheduler pod. Optional.
  resources:
    requests:
      cpu: 512m
      memory: 512Mi

  healthProbes:
    # Port used to perform health checks. Optional.
    port: 8080

    # Readiness probe for the scheduler pod. Optional.
    readinessProbe:
      enabled: true
      failureThreshold: 2
      successThreshold: 1
      periodSeconds: 5
      timeoutSeconds: 1
      initialDelaySeconds: 10

    # Liveness probe for the scheduler pod. Optional.
    livenessProbe:
      enabled: true
      failureThreshold: 4
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 1
      initialDelaySeconds: 0

  # Node selector for the scheduler pod. Optional.
  nodeSelector: {}

  # Tolerations for the scheduler pod. Optional.
  tolerations: []

  # Affinity settings for the scheduler pod. Optional.
  affinity: {}

  # Volumes for the scheduler pod. Optional.
  volumes: []

  # Volume mounts for the scheduler pod. Optional.
  volumeMounts: []

  # Additional environment variables for the scheduler pod. Optional.
  additionalEnvs: []

endorctl:
  # Maximum runtime duration in minutes for a scan. Optional. Default value is 60.
  maxDuration: 1440

  bazelRemote:
    # Bazel remote cache service name.
    # Refer bazelremote values below. Optional.
    serviceName: "bazel-remote-cache"

    # Bazel remote cache GRPC service port.
    # Refer bazelremote values below. Optional.
    servicePort: 9092

  # Endorctl container image settings.
  image:
    # Container repository for the endorctl image [Do not modify]
    repository: "endorcipublic.azurecr.io/endorctl_bare"

    # Image version to use [Do not modify]
    tag: "latest"

    # Image pull policy [Do not modify]
    pullPolicy: "Always"

  # Labels for the endorctl job. Optional.
  labels: {}

  # Annotations for the endorctl job. Optional.
  annotations: {}

  # Labels for the endorctl pod. Optional.
  podLabels: {}

  # Annotations for the endorctl pod. Optional.
  podAnnotations: {}

  serviceAccount:
    # Specifies whether a service account should be created. Optional.
    create: false

    # Name of the service account to use for endorctl. Optional.
    name: ""

    # Labels for the endorctl service account. Optional.
    labels: {}

    # Annotations for the endorctl service account. Optional.
    annotations: {}

  # Pod-level security context for the endorctl. Optional.
  podSecurityContext: {}

  # Container-level security context for the endorctl. Optional.
  securityContext: {}

  # Resource constraints for the endorctl job. Optional.
  resources: {}

  # Node selector for the endorctl pod. Optional.
  nodeSelector: {}

  # Tolerations for the endorctl pod. Optional.
  tolerations: []

  # Affinity settings for the endorctl pod. Optional.
  affinity: {}

  # Volumes for the endorctl pod. Optional.
  volumes: []

  # Volume mounts for the endorctl pod. Optional.
  volumeMounts: []

  # Backoff limit for the endorctl job. Optional.
  backoffLimit: 0

  # TTL seconds after finished for the endorctl job. Optional.
  ttlSecondsAfterFinished: 100

  # Additional environment variables for the endorctl pod. Optional.
  additionalEnvs: []

#
# DEPENDENCIES
#

# Bazel remote cache configuration. Optional. Not enabled by default.
bazelremote:
  # Whether to install the Bazel remote cache component
  install: false

  image:
    # Container repository for the Bazel remote cache image [Do not modify]
    repository: "buchgr/bazel-remote-cache"

    # Specific version of the Bazel remote cache to use [Do not modify]
    tag: "v2.4.1"

    # Image pull policy [Do not modify]
    pullPolicy: "IfNotPresent"

  # Full name of the chart. Optional.
  fullnameOverride: "bazel-remote-cache"

  # Bazel-remote config to provision inside of the container. Optional.
  conf: |-
    # https://github.com/buchgr/bazel-remote#example-configuration-file
    dir: /data
    max_size: 500
    experimental_remote_asset_api: true
    access_log_level: all
    port: 8080
    grpc_port: 9092

  ## For advanced bazel-remote configuration options,
  ## Refer https://github.com/slamdev/helm-charts/tree/master/charts/bazel-remote#readme

​

Post-deployment configuration

• GitHub Cloud
• GitHub Enterprise
• GitLab Cloud and self-hosted
• Bitbucket Data Center
• Bitbucket Cloud
• Azure DevOps Cloud

​

Configure Outpost on GitLab self-hosted with self-signed certificates

1. Download the self-signed certificate from the GitLab self-hosted instance.
2. Create a kubectl configmap using the certificate in the Outpost cluster.
   kubectl create configmap gitlab-cert --from-file=<cert-name>=<path-of-the-certificate> -n <name-of-the-namespace>
   
   For example:
   kubectl create configmap gitlab-cert --from-file=gitlab-dev-CA.pem=/Users/doe/Downloads/gitlab-dev-CA.pem -n onprem-scheduler
   
3. Configure Outpost and download endor-outpost-values.yaml file.
4. Modify the values yaml file to volume mount the certificate in the scheduler and endorctl image.
   If you use Endor Labs with an EU tenant, use https://api.eu.endorlabs.com instead of https://api.endorlabs.com.
   endorAPI: "https://api.endorlabs.com"
   endorNamespace: "<Endor Labs namespace>"
   auth:
     apiKey: "<apiKey>"
     apiSecret: "<apiSecret>"
   scheduler:
     image:
       repository: "endorcipublic.azurecr.io/scheduler"
       tag: "latest"
       pullPolicy: "Always"
     volumes:
       - name: gitlab-cert
         configMap:
           name: gitlab-cert
     volumeMounts:
       - name: gitlab-cert
         mountPath: /etc/ssl/certs/gitlab-dev-CA.pem
         subPath: gitlab-dev-CA.pem
   endorctl:
     image:
       repository: "endorcipublic.azurecr.io/endorctl_bare"
       tag: "latest"
       pullPolicy: "Always"
     volumes:
       - name: gitlab-cert
         configMap:
           name: gitlab-cert
     volumeMounts:
       - name: gitlab-cert
         mountPath: /etc/ssl/certs/gitlab-dev-CA.pem
         subPath: gitlab-dev-CA.pem
   
5. Run the following command to deploy Outpost in your Kubernetes cluster.
   helm install endorlabsscheduler oci://endorcipublic.azurecr.io/charts/onprem-scheduler \
   -n <your Kubernetes namespace> \
   -f endor-outpost-values.yaml
   
6. Install the GitLab App.

​

Configure Outpost on GitHub Enterprise Server with self-signed certificates

1. Download the self-signed certificate from the GitHub Enterprise Server instance.
2. Check if a ConfigMap for the GitHub certificate already exists.
   kubectl -n <namespace> get configmap github-cert -o yaml
   
3. If a previous certificate exists, delete it before creating a new one.
   kubectl -n <namespace> delete configmap github-cert
   
4. Create a new ConfigMap with the certificate in the Outpost cluster.
   kubectl create configmap github-cert --from-file=github-CA.pem=<path-of-the-certificate> -n <namespace>
   
   For example:
   kubectl create configmap github-cert --from-file=github-CA.pem=/Users/doe/Downloads/github-CA.pem -n onprem-scheduler
   
5. Verify that the ConfigMap has been created:
   kubectl -n <namespace> get configmap github-cert -o yaml
   
6. Modify the values yaml file to volume mount the certificate in the scheduler and endorctl image. Mount your cert file under /etc/ssl/certs directory.
   If you use Endor Labs with an EU tenant, use https://api.eu.endorlabs.com instead of https://api.endorlabs.com.
   endorAPI: "https://api.endorlabs.com"
   endorNamespace: "<Endor Labs namespace>"
   auth:
     apiKey: "<apiKey>"
     apiSecret: "<apiSecret>"
   scheduler:
     image:
       repository: "endorcipublic.azurecr.io/scheduler"
       tag: "latest"
       pullPolicy: "Always"
     volumes:
       - name: github-cert
         configMap:
           name: github-cert
     volumeMounts:
       - name: github-cert
         mountPath: /etc/ssl/certs/github-CA.pem
         subPath: github-CA.pem
   endorctl:
     image:
       repository: "endorcipublic.azurecr.io/endorctl_bare"
       tag: "latest"
       pullPolicy: "Always"
     volumes:
       - name: github-cert
         configMap:
           name: github-cert
     volumeMounts:
       - name: github-cert
         mountPath: /etc/ssl/certs/github-CA.pem
         subPath: github-CA.pem
    additionalEnvs:
      - name: "GITHUB_USE_APP_TRANSPORT"
        value: "true"
   
7. Install Helm for outpost configuration.
   helm install endorlabsscheduler oci://endorcipublic.azurecr.io/charts/onprem-scheduler \
   -n <namespace> \
   -f endor-outpost-values.yaml
   
8. Verify certificate in Pod and Confirm that the certificate is correctly mounted in the pods:
   kubectl -n onpremschedulertest describe pod $POD | grep -A3 github-cert
   
9. Install the GitHub Enterprise Server App.