Installation

This page details how to install Port's GitLab integration (powered by the Ocean framework).

This page outlines the following steps:

How to create an access token to give the integration permissions to query your GitLab instance.
How to configure and customize the integration before deploying it.
How to deploy the integration in the configuration that fits your use case.

Prerequisites

A GitLab account with permissions to create access tokens.
If you choose the real time & always on installation method, you will need a kubernetes cluster on which to install the integration.
Your Port user role is set to Admin.

Setup

Configure access token

To allow Port to fetch data from your GitLab instance, you need to create an access token. Port supports two types of tokens for authentication: personal access tokens and group access tokens.

Personal access token (PAT)

A Personal Access Token (PAT) is suitable if you're the only one managing the integration and don't need frequent credential rotation.
To create a personal access token see the GitLab personal access token guide.

The token must belong to a user with access to the relevant GitLab resources (e.g., projects, groups).

Group access token

A Group Access Token is recommended when multiple team members manage the integration or when it's set up at the group level.
To create a group access token, see the GitLab group access token guide.

Create the token in a group that has access to the relevant projects.
Set an appropriate expiration date and store it securely.

Service account token

A service account token is recommended where credentials must remain stable and unaffected by changes in human user membership.

To set up the account and generate a personal access token, see the GitLab service account guide.

Add the service account to the relevant projects or groups with sufficient permissions (e.g., Developer or Maintainer).

Required scopes

The following scopes are required based on your usage.

To enable real-time updates using webhooks, the token must include the api scope (required for managing webhooks).
If you're not using realtime updates, the token needs read_api and read_repository scopes.

Configure Realtime webhook events

tip

The baseUrl parameter is used specifically to enable the real-time functionality of the integration.

If it is not provided, the integration will continue to function correctly. In such a configuration, to retrieve the latest information from the target system, the scheduledResyncInterval parameter has to be set, or a manual resync will need to be triggered through Port's UI.

Deploy the integration

Choose one of the following installation methods:

Hosted by Port
Real-time (self-hosted)
Scheduled (CI)

Using this installation option means that the integration will be hosted by Port, with a customizable resync interval to ingest data into Port.

Live event support

This integration supports live events, allowing real-time updates to your software catalog without waiting for the next scheduled sync.

Supported live event triggers

Groups:

group_create
group_destroy
subgroup_create
subgroup_destroy

Projects:

push

Issues:

issue

Merge Requests:

merge_request

Files and Folders:

push

Members:

user_remove_from_group
user_update_for_group
user_add_to_group

Jobs:

build

Pipelines:

pipeline

Self-hosted installation

Alternatively, you can install the integration using the Real-time (self-hosted) method to update Port in real time using webhooks.

Installation

To install, follow these steps:

Go to the Data sources page of your portal.
Click on the + Data source button in the top-right corner.
Click on the relevant integration in the list.
Under Select your installation method, choose Hosted by Port.
Configure the integration settings and application settings as you wish (see below for details).

Application settings

Every integration hosted by Port has the following customizable application settings, which are configurable after installation:

Resync interval: The frequency at which Port will ingest data from the integration. There are various options available, ranging from every 1 hour to once a day.
Send raw data examples: A boolean toggle (enabled by default). If enabled, raw data examples will be sent from the integration to Port. These examples are used when testing your mapping configuration, they allow you to run your jq expressions against real data and see the results.

Integration settings

Every integration has its own tool-specific settings, under the Integration settings section.
Each of these settings has an ⓘ icon next to it, which you can hover over to see a description of the setting.

Port secrets

Some integration settings require sensitive pieces of data, such as tokens.
For these settings, Port secrets will be used, ensuring that your sensitive data is encrypted and secure.

When filling in such a setting, its value will be obscured (shown as ••••••••).
For each such setting, Port will automatically create a secret in your organization.

To see all secrets in your organization, follow these steps.

Limitations

The maximum time for a full sync to run is based on the configured resync interval. For very large amounts of data where a resync operation is expected to take longer, please use a longer interval.

Port source IP addresses

When using this installation method, Port will make outbound calls to your 3rd-party applications from static IP addresses.
You may need to add these addresses to your allowlist, in order to allow Port to interact with the integrated service:

Europe (EU)
United States (US)

73.167.226  
33.143.237  
76.185.219

234.37.33  
225.172.136  
225.234.99

Using this installation option means that the integration will be able to update Port in real time using webhooks.

Prerequisites

To install the integration, you need a Kubernetes cluster that the integration's container chart will be deployed to.

Please make sure that you have kubectl and helm installed on your machine, and that your kubectl CLI is connected to the Kubernetes cluster where you plan to install the integration.

Troubleshooting

If you are having trouble installing this integration, please refer to these troubleshooting steps.

For details about the available parameters for the installation, see the table below.

Helm
ArgoCD

To install the integration using Helm:

Go to the GitLab_v2 data source page in your portal.
Select the Real-time and always on method:
A helm command will be displayed, with default values already filled out (e.g. your Port client ID, client secret, etc).
Copy the command, replace the placeholders with your values, then run it in your terminal to install the integration.

Selecting a Port API URL by account region

The baseUrl, port_region, port.baseUrl, portBaseUrl, port_base_url and OCEAN__PORT__BASE_URL parameters are used to select which instance or Port API will be used.

Port exposes two API instances, one for the EU region of Port, and one for the US region of Port.

If you use the EU region of Port (https://app.getport.io), your API URL is https://api.getport.io.
If you use the US region of Port (https://app.us.getport.io), your API URL is https://api.us.getport.io.

To install the integration using ArgoCD:

Create a values.yaml file in argocd/my-ocean-gitlab-integration in your git repository with the content:

note

Remember to replace the placeholders for GITLAB_TOKEN and your GitLab URL.

initializePortResources: true
scheduledResyncInterval: 120
integration:
  identifier: my-ocean-gitlab-integration
  type: gitlab-v2
  eventListener:
    type: POLLING
  config:
    gitlabUrl: https://gitlab.com # Or your self-hosted GitLab URL
  secrets:
    gitlabToken: GITLAB_TOKEN

Install the my-ocean-gitlab-integration ArgoCD Application by creating the following my-ocean-gitlab-integration.yaml manifest:

note

Remember to replace the placeholders for YOUR_PORT_CLIENT_ID YOUR_PORT_CLIENT_SECRET and YOUR_GIT_REPO_URL.

Multiple sources ArgoCD documentation can be found here.

ArgoCD Application

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-ocean-gitlab-integration
  namespace: argocd
spec:
  destination:
    namespace: my-ocean-gitlab-integration
    server: https://kubernetes.default.svc
  project: default
  sources:
  - repoURL: 'https://port-labs.github.io/helm-charts/'
    chart: port-ocean
    targetRevision: 0.1.14
    helm:
      valueFiles:
      - $values/argocd/my-ocean-gitlab-integration/values.yaml
      parameters:
        - name: port.clientId
          value: YOUR_PORT_CLIENT_ID
        - name: port.clientSecret
          value: YOUR_PORT_CLIENT_SECRET
        - name: port.baseUrl
          value: https://api.getport.io
  - repoURL: YOUR_GIT_REPO_URL
    targetRevision: main
    ref: values
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

Selecting a Port API URL by account region

The baseUrl, port_region, port.baseUrl, portBaseUrl, port_base_url and OCEAN__PORT__BASE_URL parameters are used to select which instance or Port API will be used.

Port exposes two API instances, one for the EU region of Port, and one for the US region of Port.

If you use the EU region of Port (https://app.getport.io), your API URL is https://api.getport.io.
If you use the US region of Port (https://app.us.getport.io), your API URL is https://api.us.getport.io.

Apply your application manifest with kubectl:

kubectl apply -f my-ocean-gitlab-integration.yaml

This table summarizes the available parameters for the installation.

Parameter	Description	Required
`port.clientId`	Your port client id	✅
`port.clientSecret`	Your port client secret	✅
`port.baseUrl`	Your Port API URL - `https://api.getport.io` for EU, `https://api.us.getport.io` for US	✅
`integration.identifier`	Change the identifier to describe your integration	✅
`integration.type`	The integration type	✅
`integration.eventListener.type`	The event listener type	✅
`integration.config.gitlabUrl`	The GitLab instance URL	✅
`integration.secrets.gitlabToken`	The GitLab access token	✅
`scheduledResyncInterval`	The number of minutes between each resync	❌
`initializePortResources`	Default true, When set to true the integration will create default blueprints and the port App config Mapping	❌
`sendRawDataExamples`	Enable sending raw data examples from the third party API to port for testing and managing the integration mapping. Default is true	❌
`baseUrl`	The base url of the GitLab integration instance, used for real-time updates.	❌

Advanced integration configuration

For advanced configuration such as proxies or self-signed certificates, click here.

This workflow/pipeline will run the GitLab integration once and then exit, this is useful for scheduled ingestion of data.

Real-time updates

If you want the integration to update Port in real time using webhooks you should use the Real-time (self-hosted) installation option.

GitHub
Jenkins
Azure Devops
GitLab

Make sure to configure the following Github Secrets:

Parameter	Description	Required
`OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN`	The GitLab access token used to authenticate with your GitLab instance	✅
`OCEAN__INTEGRATION__CONFIG__GITLAB_URL`	The URL of your GitLab instance (e.g., https://gitlab.com or your self-hosted URL)	✅
`OCEAN__BASE_URL`	The URL of your GitLab integration instance, used for real-time updates	❌
`OCEAN__PORT__CLIENT_ID`	Your Port client (How to get the credentials) id	✅
`OCEAN__PORT__CLIENT_SECRET`	Your Port client (How to get the credentials) secret	✅
`OCEAN__PORT__BASE_URL`	Your Port API URL - `https://api.getport.io` for EU, `https://api.us.getport.io` for US	✅
`OCEAN__INITIALIZE_PORT_RESOURCES`	Default true, When set to true the integration will create default blueprints and the port App config Mapping. Read more about initializePortResources	❌
`OCEAN__INTEGRATION__IDENTIFIER`	The identifier of the integration that will be installed	❌

Here is an example for gitlab-integration.yml workflow file:

name: GitLab Exporter Workflow
on:
  workflow_dispatch:
  schedule:
    - cron: '0 */1 * * *' # Determines the scheduled interval for this workflow. This example runs every hour.
jobs:
  run-integration:
    runs-on: ubuntu-latest
    timeout-minutes: 30 # Set a time limit for the job
    steps:
      - uses: port-labs/ocean-sail@v1
        with:
          type: 'gitlab-v2'
          port_client_id: ${{ secrets.OCEAN__PORT__CLIENT_ID }}
          port_client_secret: ${{ secrets.OCEAN__PORT__CLIENT_SECRET }}
          port_base_url: https://api.getport.io
          config: |
            gitlabUrl: ${{ secrets.OCEAN__INTEGRATION__CONFIG__GITLAB_URL }}
            gitlabToken: ${{ secrets.OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN }}

tip

Your Jenkins agent should be able to run docker commands.

Make sure to configure the following Jenkins Credentials of Secret Text type:

Parameter	Description	Required
`OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN`	The GitLab access token used to authenticate with your GitLab instance	✅
`OCEAN__INTEGRATION__CONFIG__GITLAB_URL`	The URL of your GitLab instance (e.g., https://gitlab.com or your self-hosted URL)	✅
`OCEAN__BASE_URL`	The URL of your GitLab integration instance, used for real-time updates	❌
`OCEAN__PORT__CLIENT_ID`	Your Port client (How to get the credentials) id	✅
`OCEAN__PORT__CLIENT_SECRET`	Your Port client (How to get the credentials) secret	✅
`OCEAN__PORT__BASE_URL`	Your Port API URL - `https://api.getport.io` for EU, `https://api.us.getport.io` for US	✅
`OCEAN__INITIALIZE_PORT_RESOURCES`	Default true, When set to true the integration will create default blueprints and the port App config Mapping. Read more about initializePortResources	❌
`OCEAN__INTEGRATION__IDENTIFIER`	The identifier of the integration that will be installed	❌

Here is an example for Jenkinsfile groovy pipeline file:

pipeline {
    agent any
    stages {
        stage('Run GitLab Integration') {
            steps {
                script {
                    withCredentials([
                        string(credentialsId: 'OCEAN__INTEGRATION__CONFIG__GITLAB_URL', variable: 'OCEAN__INTEGRATION__CONFIG__GITLAB_URL'),
                        string(credentialsId: 'OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN', variable: 'OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN'),
                        string(credentialsId: 'OCEAN__PORT__CLIENT_ID', variable: 'OCEAN__PORT__CLIENT_ID'),
                        string(credentialsId: 'OCEAN__PORT__CLIENT_SECRET', variable: 'OCEAN__PORT__CLIENT_SECRET'),
                    ]) {
                        sh('''
                            #Set Docker image and run the container
                            integration_type="gitlab-v2"
                            version="latest"
                            image_name="ghcr.io/port-labs/port-ocean-${integration_type}:${version}"
                            docker run -i --rm --platform=linux/amd64 \
                                -e OCEAN__EVENT_LISTENER='{"type":"ONCE"}' \
                                -e OCEAN__INITIALIZE_PORT_RESOURCES=true \
                                -e OCEAN__SEND_RAW_DATA_EXAMPLES=true \
                                -e OCEAN__INTEGRATION__CONFIG__GITLAB_URL=$OCEAN__INTEGRATION__CONFIG__GITLAB_URL \
                                -e OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN=$OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN \
                                -e OCEAN__PORT__CLIENT_ID=$OCEAN__PORT__CLIENT_ID \
                                -e OCEAN__PORT__CLIENT_SECRET=$OCEAN__PORT__CLIENT_SECRET \
                                -e OCEAN__PORT__BASE_URL='https://api.getport.io' \
                                $image_name
                            exit $?
                        ''')
                    }
                }
            }
        }
    }
}

Make sure to configure the following Azure DevOps pipeline variables:

Parameter	Description	Required
`OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN`	The GitLab access token used to authenticate with your GitLab instance	✅
`OCEAN__INTEGRATION__CONFIG__GITLAB_URL`	The URL of your GitLab instance (e.g., https://gitlab.com or your self-hosted URL)	✅
`OCEAN__BASE_URL`	The URL of your GitLab integration instance, used for real-time updates	❌
`OCEAN__PORT__CLIENT_ID`	Your Port client (How to get the credentials) id	✅
`OCEAN__PORT__CLIENT_SECRET`	Your Port client (How to get the credentials) secret	✅
`OCEAN__PORT__BASE_URL`	Your Port API URL - `https://api.getport.io` for EU, `https://api.us.getport.io` for US	✅
`OCEAN__INITIALIZE_PORT_RESOURCES`	Default true, When set to true the integration will create default blueprints and the port App config Mapping. Read more about initializePortResources	❌
`OCEAN__INTEGRATION__IDENTIFIER`	The identifier of the integration that will be installed	❌

Here is an example for gitlab-integration.yml pipeline file:

trigger:
- main
pool:
  vmImage: "ubuntu-latest"
variables:
  - group: port-ocean-credentials
steps:
- script: |
    # Set Docker image and run the container
    integration_type="gitlab-v2"
    version="latest"
    image_name="ghcr.io/port-labs/port-ocean-$integration_type:$version"
    
    docker run -i --rm --platform=linux/amd64 \
        -e OCEAN__EVENT_LISTENER='{"type":"ONCE"}' \
        -e OCEAN__INITIALIZE_PORT_RESOURCES=true \
        -e OCEAN__SEND_RAW_DATA_EXAMPLES=true \
        -e OCEAN__INTEGRATION__CONFIG__GITLAB_URL=$(OCEAN__INTEGRATION__CONFIG__GITLAB_URL) \
        -e OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN=$(OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN) \
        -e OCEAN__PORT__CLIENT_ID=$(OCEAN__PORT__CLIENT_ID) \
        -e OCEAN__PORT__CLIENT_SECRET=$(OCEAN__PORT__CLIENT_SECRET) \
        -e OCEAN__PORT__BASE_URL='https://api.getport.io' \
        $image_name
    exit $?
  displayName: 'Ingest Data into Port'

Make sure to configure the following GitLab variables:

Parameter	Description	Required
`OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN`	The GitLab access token used to authenticate with your GitLab instance	✅
`OCEAN__INTEGRATION__CONFIG__GITLAB_URL`	The URL of your GitLab instance (e.g., https://gitlab.com or your self-hosted URL)	✅
`OCEAN__BASE_URL`	The URL of your GitLab integration instance, used for real-time updates	❌
`OCEAN__PORT__CLIENT_ID`	Your Port client (How to get the credentials) id	✅
`OCEAN__PORT__CLIENT_SECRET`	Your Port client (How to get the credentials) secret	✅
`OCEAN__PORT__BASE_URL`	Your Port API URL - `https://api.getport.io` for EU, `https://api.us.getport.io` for US	✅
`OCEAN__INITIALIZE_PORT_RESOURCES`	Default true, When set to true the integration will create default blueprints and the port App config Mapping. Read more about initializePortResources	❌
`OCEAN__INTEGRATION__IDENTIFIER`	The identifier of the integration that will be installed	❌

Here is an example for .gitlab-ci.yml pipeline file:

default:
  image: docker:24.0.5
  services:
    - docker:24.0.5-dind
  before_script:
    - docker info
    
variables:
  INTEGRATION_TYPE: gitlab-v2
  VERSION: latest
stages:
  - ingest
ingest_data:
  stage: ingest
  variables:
    IMAGE_NAME: ghcr.io/port-labs/port-ocean-$INTEGRATION_TYPE:$VERSION
  script:
    - |
      docker run -i --rm --platform=linux/amd64 \
        -e OCEAN__EVENT_LISTENER='{"type":"ONCE"}' \
        -e OCEAN__INITIALIZE_PORT_RESOURCES=true \
        -e OCEAN__SEND_RAW_DATA_EXAMPLES=true  \
        -e OCEAN__INTEGRATION__CONFIG__GITLAB_URL=$OCEAN__INTEGRATION__CONFIG__GITLAB_URL \
        -e OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN=$OCEAN__INTEGRATION__CONFIG__GITLAB_TOKEN \
        -e OCEAN__PORT__CLIENT_ID=$OCEAN__PORT__CLIENT_ID \
        -e OCEAN__PORT__CLIENT_SECRET=$OCEAN__PORT__CLIENT_SECRET \
        -e OCEAN__PORT__BASE_URL='https://api.getport.io' \
        $IMAGE_NAME
  rules: # Run only when changes are made to the main branch
    - if: '$CI_COMMIT_BRANCH == "main"'
  schedule: # Run according to a schedule
    - cron: '0 */3 * * *' # Run every 3 hours

Selecting a Port API URL by account region

The baseUrl, port_region, port.baseUrl, portBaseUrl, port_base_url and OCEAN__PORT__BASE_URL parameters are used to select which instance or Port API will be used.

Port exposes two API instances, one for the EU region of Port, and one for the US region of Port.

If you use the EU region of Port (https://app.getport.io), your API URL is https://api.getport.io.
If you use the US region of Port (https://app.us.getport.io), your API URL is https://api.us.getport.io.

Advanced integration configuration

For advanced configuration such as proxies or self-signed certificates, click here.

Prerequisites​

Setup​

Configure access token​

Personal access token (PAT)​

Group access token​

Service account token​

Configure Realtime webhook events​

Deploy the integration​

Live event support

Installation

Application settings

Integration settings

Port secrets

Limitations

Port source IP addresses

Prerequisites

Prerequisites

Setup

Configure access token

Personal access token (PAT)

Group access token

Service account token

Configure Realtime webhook events

Deploy the integration