Context

Endor has customers working within compliance controls that limits where source code is processed - a large estate means they may require the plug-and-play automation to discover and scan repositories that do not have a managed CI/CD process and may require a wide degree of coverage.

Example: A healthcare data archival company has PHI and FedRAMP limitations for a set of their applications but are managing an estate of tens of thousands of repositories. The vast majority of the repositories no longer see dedicated feature buildouts but are still required to be scanned regularly for Security concerns. Building CI pipelines is not possible to write individually yet using the Endor Labs' App-based integrations violates data governance.

Answer:

Option #1: Endor Labs Outpost (The "On-Prem Scanner" Model)

• Role: Local Scheduler & Scanner.

• Architecture: Internal SCM <--> Outpost (Customer K8s) --(Results Only)--> Endor Cloud

• Data Flow: Outpost clones the repo inside your K8s cluster, runs the scan (using endorctl engines), and sends only the findings to the Endor platform.

• Pros:

  • Data Sovereignty (Source code never leaves the network), highly secure for strict compliance (e.g., banking/defense).

• Cons:

  • Duplicate compute between Endor Scans & self-hosted runners for CI.

  • Requires a K8s cluster with significant resources (e.g., 32GB RAM nodes) to handle the analysis workload locally.

• Use Case: "I cannot let my source code leave my network under any circumstances, or I have a monorepo that is too large to clone into Endor Cloud."

2. Endor Labs "Static IP" Method (The Middle Ground)

• Role: Standard Networking flows to connect Endor to resources within customer premises.

• Architecture: Endor Cloud <--> Customer Firewall <--> Internal SCM

• Data Flow: Same as normal App-based scans

  • Method: Ask Endor Support for their NAT (Static) IP to allow-list this specific IP for ingress in edge firewalls (Inbound Port 443).

• Pros: No management of any Endor-owned software within Customer Premises

• Cons: Trades Container/Cluster management for Network Management.

• Use Case:  "I don't have the resources to host a full K8s cluster, my resources are self-hosted and I don't mind sending my code through the internet."