Lesson 1: Configuring the Demo Application#

In this lesson you will import the project into your own GitLab namespace and — if you want to run the full DevSecOps workflow including DAST — deploy the application to a Kubernetes cluster.

This lesson covers:

  1. Importing this project to your workspace
  2. Installing the Kubernetes Gateway API on your cluster (optional — deployment only)
  3. Adding the Kubernetes cluster as a deploy target (optional — deployment only)
  4. Deploying the application (optional — deployment only)

Make sure you have the prerequisites listed on the project overview page before proceeding.

Not deploying? If you set the SKIP_DEPLOY variable as described on the project overview page, you can skip the Kubernetes and deployment sections below and proceed directly to Lesson 2. Static scanners (SAST, Dependency Scanning, Container Scanning, Secret Detection, IaC Scanning) all work without a deployed application.

Import this project to your workspace#

First, we will import the Tanuki Shop project into your own GitLab namespace so you have full control over it.

  1. Log in to GitLab.com

  2. On the left sidebar, click Projects (or navigate directly to https://gitlab.com/projects/new)

  3. Select Import project

  4. Click the Repository by URL button

  5. Under Git repository URL, enter the following:

https://gitlab.com/gitlab-da/tutorials/security-and-governance/tanuki-shop.git

  1. Under Project URL, select the group or namespace where you have a GitLab Ultimate license

  2. Under Visibility Level, select Public

Visibility is set to Public so the Kubernetes cluster can pull container images from the project’s container registry without extra authentication. If you are not deploying, Private is fine.

  1. Click Create project

  2. Wait for the import to complete. After a few seconds you will be redirected to the newly imported project with the message The project was successfully imported.

Install the Kubernetes Gateway API on your cluster#

Deployment only — skip this section if you set SKIP_DEPLOY=true.

To access the deployed application, we use the Kubernetes Gateway API — the successor to the older Ingress API, with a more expressive, role-oriented model for traffic routing. See the migration guide for the trade-offs.

  1. Connect to your Kubernetes cluster
gcloud container clusters get-credentials $YOUR_CLUSTER --zone $YOUR_ZONE --project $YOUR_PROJECT
  1. Install the Gateway API Custom Resource Definitions (CRDs)
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/latest/download/standard-install.yaml
  1. Verify the Gateway API CRDs are installed
kubectl get crds | grep gateway

You should see CRDs such as gateways.gateway.networking.k8s.io, httproutes.gateway.networking.k8s.io, and gatewayclasses.gateway.networking.k8s.io.

  1. Verify that a GatewayClass is available
kubectl get gatewayclass

You should see one or more GatewayClass resources from your cluster’s built-in Gateway controller. On GKE you will see classes like gke-l7-global-external-managed.

Most managed Kubernetes platforms (GKE, EKS, AKS) ship with a built-in Gateway API controller. If yours does not, install any conformant implementation (Istio, Cilium, NGINX Gateway Fabric, etc.).

  1. In your imported project, update the gatewayClassName in chart/values.yaml to match the GatewayClass name from the previous step
gateway:
  gatewayClassName: "gke-l7-global-external-managed"  # replace with your GatewayClass name

Adding the Kubernetes cluster as a deploy target#

Deployment only — skip this section if you set SKIP_DEPLOY=true.

In this section we will install the GitLab Agent for Kubernetes onto your cluster. The agent is the trusted channel between GitLab and your cluster — it lets GitLab deploy applications, run DAST scans against them, and (optionally) scan the cluster itself for misconfigurations.

  1. In your project, navigate to Operate > Kubernetes clusters in the left sidebar

  2. Click Connect a cluster (agent)

  3. In the dialog, under Option 2: Create and register an agent with the UI, type tanuki as the agent name and click Create and register

  4. Open a terminal and connect to your cluster (if not already connected)

gcloud container clusters get-credentials $YOUR_CLUSTER --zone $YOUR_ZONE --project $YOUR_PROJECT
  1. Copy and paste the Helm command displayed in the GitLab UI into your terminal. It will look similar to this (with the token already filled in):
helm repo add gitlab https://charts.gitlab.io
helm repo update
helm upgrade --install tanuki gitlab/gitlab-agent \
    --namespace gitlab-agent-tanuki \
    --create-namespace \
    --set config.token=$YOUR_TOKEN_HERE \
    --set config.kasAddress=wss://kas.gitlab.com

The $YOUR_TOKEN_HERE value is unique to your agent registration. Use the exact command from the GitLab UI, which has the token pre-filled.

  1. Verify the agent pod is running
kubectl get pods -n gitlab-agent-tanuki

You should see a pod with a status of Running.

Deploying the application#

Deployment only — skip this section if you set SKIP_DEPLOY=true.

Now let’s trigger a pipeline to build and deploy the application to your Kubernetes cluster.

  1. In your project, navigate to Build > Pipelines in the left sidebar

  2. Click Run pipeline

  3. Ensure the main branch is selected

  4. Click Run pipeline. The page will refresh and the pipeline will start.

  5. Wait for the pipeline to complete. You can watch the progress of each job by clicking on the pipeline.

  6. Once the pipeline succeeds, navigate to Operate > Environments in the left sidebar

  7. Find the tanuki-gitlab environment and click Open to view the deployed application. The Tanuki Shop storefront should load in a new browser tab.

The project is now imported (and, if you chose to, deployed). Next we’ll configure security scanners and policies.

Project Overview Next Lesson

Backward Lessons Lesson 2 Setting Up Security Scanners and Policies Forward