Welcome#

GitLab Tanuki Shop is a GitLab-branded version of the OWASP Juice Shop, which is probably the most modern and sophisticated intentionally insecure web application! This project will help you gain a practical understanding of how to use GitLab to shift security left — meaning you find and fix security flaws during development rather than after deployment — with greater visibility and control than typical approaches can provide.

This application is brought to you by GitLab Developer Relations.

What is DevSecOps?#

DevSecOps stands for Development, Security, and Operations. It is the practice of integrating security testing and practices into every phase of the software development lifecycle (SDLC), rather than treating security as a separate step at the end.

In a traditional workflow, developers write code, operations teams deploy it, and security teams audit it after the fact. DevSecOps breaks down these silos by:

• Automating security scans directly in your CI/CD pipeline so vulnerabilities are caught early
• Giving developers actionable feedback on security issues in their merge requests, right where they work
• Enforcing security policies as code so that guardrails are consistent and auditable
• Providing visibility to security teams through dashboards, vulnerability reports, and compliance tools

GitLab is a single platform that unifies all of these capabilities — from source code management and CI/CD to security scanning, policy enforcement, and compliance — eliminating the need to stitch together multiple third-party tools.

Prerequisites#

In order to get started with this tutorial, you will need the following:

Knowledge

• Basic familiarity with Git (cloning, branching, merge requests)
• Basic understanding of CI/CD concepts (pipelines, jobs, stages)
• Basic knowledge of Kubernetes (only if deploying the application)

Software/Tools

• GitLab Ultimate Subscription — a free trial is available and includes all security features used in this tutorial
• Google Kubernetes Engine (GKE) Cluster (optional — only required for deployment and DAST scanning)
• Kubectl (optional — only required for deployment)
• Helm (optional — only required for deployment)
• Google Cloud CLI (gcloud) (optional — only required for deployment)

GKE Cluster Requirements#

If you plan to deploy the application, you will need a GKE cluster configured as follows:

To create a compatible cluster with the gcloud CLI:

gcloud container clusters create tanuki-shop-cluster \
    --zone us-central1-a \
    --num-nodes 1 \
    --machine-type e2-medium \
    --gateway-api standard

The --gateway-api standard flag ensures the Gateway API CRDs and the GKE Gateway controller are enabled on the cluster. You can verify this after creation by running kubectl get gatewayclass — you should see gke-l7-global-external-managed in the output.

While other Kubernetes providers (EKS, AKS, self-managed) can work, this tutorial’s instructions and default Helm chart values are written for GKE. If you use a different provider, you will need to install a conformant Gateway API implementation (https://gateway-api.sigs.k8s.io/implementations/) and update the gatewayClassName in chart/values.yaml to match your controller.

Skipping Deployment (Static Scanning Only)#

Deploying the application to a Kubernetes cluster is only required for Dynamic Application Security Testing (DAST) and viewing the running application. If you do not have a Kubernetes cluster or prefer to focus on static security scanning, you can skip all deployment-related steps.

To skip deployment and DAST jobs in the pipeline, add the following CI/CD variable to your project:

1. Navigate to Settings > CI/CD in your GitLab project
2. Expand the Variables section
3. Click Add variable
4. Set the following:
   • Key: SKIP_DEPLOY
   • Value: true
   • Flags: Uncheck Protect variable if you want it to apply to all branches
5. Click Add variable

With this variable set, the deploy-kubernetes and dast jobs will be automatically skipped in your pipeline. You can still complete Lessons 1 through 5 — simply skip any steps that reference deploying or accessing the running application.

You can also set this variable on a per-pipeline basis when running a pipeline manually. On the Run Pipeline page, add SKIP_DEPLOY = true under Variables before clicking Run pipeline.

Lessons#

Learning Outcomes#

After completing the lessons above, you will be able to:

• Set up comprehensive security scanning without adding a collection of new tools and processes
• Use a single platform to improve collaboration between developers and application security (AppSec) teams
• Manage all of your application vulnerabilities in one place
• Enable separation of duties and adhere to compliance requirements
• Prevent insecure code from making it into production using policy-based guardrails
• Use AI to understand, triage, and remediate vulnerabilities

GitLab Solutions#

• Complete DevSecOps Platform
• GitLab Duo AI
• Security and Compliance
• Software Supply Chain Security
• Continuous Software Compliance