diff options
Diffstat (limited to 'doc/development/integrations')
4 files changed, 82 insertions, 8 deletions
diff --git a/doc/development/integrations/elasticsearch_for_paid_tiers_on_gitlabcom.md b/doc/development/integrations/elasticsearch_for_paid_tiers_on_gitlabcom.md new file mode 100644 index 00000000000..8289be47253 --- /dev/null +++ b/doc/development/integrations/elasticsearch_for_paid_tiers_on_gitlabcom.md @@ -0,0 +1,28 @@ +# Elasticsearch for paid tiers on GitLab.com + +> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/220246) in GitLab 13.2 +> - It's deployed behind a feature flag, disabled by default. +> - It's disabled on GitLab.com. +> - It's not recommended for use in GitLab self-managed instances. + +This document describes how to enable Elasticsearch with GitLab for all paid tiers on GitLab.com. Once enabled, +all paid tiers will have access to the [Advanced Global Search feature](../../integration/elasticsearch.md) on GitLab.com. + +## Enable or disable Elasticsearch for all paid tiers on GitLab.com + +Since we're still in the process of rolling this out and want to control the timing this is behind a feature flag +which defaults to off. + +To enable it: + +```ruby +# Instance-wide +Feature.enable(:elasticsearch_index_only_paid_groups) +``` + +To disable it: + +```ruby +# Instance-wide +Feature.disable(:elasticsearch_index_only_paid_groups) +``` diff --git a/doc/development/integrations/jira_connect.md b/doc/development/integrations/jira_connect.md index 8e619c3b0a2..374cc976caa 100644 --- a/doc/development/integrations/jira_connect.md +++ b/doc/development/integrations/jira_connect.md @@ -11,7 +11,7 @@ The following are required to install and test the app: For the app to work, Jira Cloud should be able to connect to the GitLab instance through the internet. To easily expose your local development environment, you can use tools like - [serveo](https://medium.com/@osanda.deshan/how-to-forward-my-local-port-to-public-using-serveo-4979f352a3bf) + [serveo](https://medium.com/testautomator/how-to-forward-my-local-port-to-public-using-serveo-4979f352a3bf) or [ngrok](https://ngrok.com). These also take care of SSL for you because Jira requires all connections to the app host to be over SSL. diff --git a/doc/development/integrations/secure.md b/doc/development/integrations/secure.md index 1737daae0e0..22da57400e0 100644 --- a/doc/development/integrations/secure.md +++ b/doc/development/integrations/secure.md @@ -100,13 +100,12 @@ the project repository contains Java source code and the `dependency_scanning` f ```yaml mysec_dependency_scanning: - except: - variables: - - $DEPENDENCY_SCANNING_DISABLED - only: - variables: - - $GITLAB_FEATURES =~ /\bdependency_scanning\b/ && - $CI_PROJECT_REPOSITORY_LANGUAGES =~ /\bjava\b/ + rules: + - if: $DEPENDENCY_SCANNING_DISABLED + when: never + - if: $GITLAB_FEATURES =~ /\bdependency_scanning\b/ + exists: + - '**/*.java' ``` Any additional job policy should only be configured by users based on their needs. @@ -232,6 +231,32 @@ to colorize the messages they write to the Unix standard output and standard err We recommend using red to report errors, yellow for warnings, and green for notices. Also, we recommend prefixing error messages with `[ERRO]`, warnings with `[WARN]`, and notices with `[INFO]`. +#### Logging level + +The scanner should filter out a log message if its log level is lower than the +one set in the `SECURE_LOG_LEVEL` variable. For instance, `info` and `warn` +messages should be skipped when `SECURE_LOG_LEVEL` is set to `error`. Accepted +values are as follows, listed from highest to lowest: + +- `fatal` +- `error` +- `warn` +- `info` +- `debug` + +It is recommended to use the `debug` level for verbose logging that could be +useful when debugging. The default value for `SECURE_LOG_LEVEL` should be set +to `info`. + +#### common logutil package + +If you are using [go](https://golang.org/) and +[common](https://gitlab.com/gitlab-org/security-products/analyzers/common), +then it is suggested that you use [logrus](https://github.com/Sirupsen/logrus) +and [common's logutil package](https://gitlab.com/gitlab-org/security-products/analyzers/common/-/tree/master/logutil) +to configure the formatter for [logrus](https://github.com/Sirupsen/logrus). +See the [logutil README.md](https://gitlab.com/gitlab-org/security-products/analyzers/common/-/tree/master/logutil/README.md) + ## Report The report is a JSON document that combines vulnerabilities with possible remediations. @@ -547,3 +572,15 @@ remediation. `fixes[].id` contains a fixed vulnerability's [unique identifier](# The `diff` field is a base64-encoded remediation code diff, compatible with [`git apply`](https://git-scm.com/docs/git-format-patch#_discussion). This field is required. + +## Limitations + +### Container Scanning + +Container Scanning currently has these limitations: + +- Although the Security Dashboard can display scan results from multiple images, if multiple + vulnerabilities have the same fingerprint, only the first instance of that vulnerability is + displayed. We're working on removing this limitation. You can follow our progress on the issue + [Change location fingerprint for Container Scanning](https://gitlab.com/gitlab-org/gitlab/-/issues/215466). +- Different scanners may each report the same vulnerability, resulting in duplicate findings. diff --git a/doc/development/integrations/secure_partner_integration.md b/doc/development/integrations/secure_partner_integration.md index 22e1f8bf769..19a497641f9 100644 --- a/doc/development/integrations/secure_partner_integration.md +++ b/doc/development/integrations/secure_partner_integration.md @@ -11,6 +11,15 @@ with [onboarding as a partner](https://about.gitlab.com/partners/integrate/). The steps below are a high-level view of what needs to be done to complete an integration as well as linking to more detailed resources for how to do so. +## Integration Tiers + +GitLab's security offerings are designed for GitLab Gold and GitLab Ultimate users, and the +[DevSecOps](https://about.gitlab.com/handbook/use-cases/#4-devsecops-shift-left-security) +use case. All the features are in those tiers. This includes the APIs and standard reporting +framework needed to provide a consistent experience for users to easily bring their preferred +security tools into GitLab. We ask that our integration partners focus their work on those license +tiers so that we can provide the most value to our mutual customers. + ## What is the GitLab Developer Workflow? This workflow is how GitLab users interact with our product and expect it to |