Bamboo

This guide walks you through setting up Endura pipeline security for Atlassian Bamboo. You will learn how to install the Runtime Sensor on Bamboo agent hosts, configure the Bamboo integration for automatic pipeline discovery, instrument your Bamboo plans to use the Sensor, and apply security policies to your pipelines.

Prerequisites

Before proceeding, ensure you have:

• Team Server installed and running with valid credentials for accessing the web interface. If you have not deployed Team Server yet, see the Team Server documentation for deployment options.
• Administrative access to your Bamboo instance for creating access tokens and configuring plan tasks.
• Root or sudo access to the hosts where Bamboo agents are installed (for installing the Runtime Sensor).

Configure the Bamboo Integration

The Bamboo integration enables Team Server to discover and ingest your Bamboo projects as pipelines. This section covers creating a Bamboo personal access token and configuring the integration in Team Server.

Create a Bamboo Personal Access Token

Bamboo personal access tokens allow Team Server to authenticate with the Bamboo REST API to discover projects and builds.

Setup Instructions:

1. Log in to your Bamboo instance
2. Click your profile icon in the top-right corner and click Profile
3. Navigate to Personal access tokens in the left sidebar
4. Click Create token
5. Configure the token:
   • Token name: Enter a descriptive name (e.g., “Endura Team Server”)
   • Expiry: Select an appropriate expiration period based on your security requirements. For production use, consider setting a reasonable expiration (e.g., 1 year) and documenting a token rotation schedule.
6. Click Create
7. Copy the token value immediately; it will not be shown again

Add the Integration in Team Server

With the Bamboo personal access token created, configure the integration in Team Server.

Setup Instructions:

1. Log in to Team Server
2. Click Integrations in the main navigation menu
3. Click Bamboo under the Discover sub-navigation menu
4. Click Get Started (if no Bamboo integration exists) or Create (if you already have one or more Bamboo integrations configured)
5. Configure the integration:
   • URL: Enter the base URL of your Bamboo instance (e.g., https://bamboo.example.com)
   • Token: Paste the personal access token you created in Bamboo
6. Click Test to verify the connection to your Bamboo instance
7. If the test succeeds, click Save to create the integration

Once the integration is created, Team Server immediately begins discovering and ingesting all Bamboo projects as pipelines. View the discovered pipelines by clicking Pipelines in the main navigation menu.

Enable Scheduled Discovery

The initial integration setup performs a one-time discovery of Bamboo projects. To automatically discover new projects and builds on an ongoing basis, configure the scheduled discovery jobs in your Team Server configuration.

Add the discover_bamboo_pipelines and discover_bamboo_builds jobs to the scheduler section of your Team Server configuration file (config/production.yaml):

scheduler:
  jobs:
    discover_bamboo_pipelines:
      run: "discover_bamboo_pipelines"
      schedule: "0 0 * * * * *"
    discover_bamboo_builds:
      run: "discover_bamboo_builds"
      schedule: "0 */15 * * * * *"

The schedule field uses a 7-field cron format: second minute hour day month day-of-week year. The examples above run pipeline discovery every hour and build discovery every 15 minutes.

A complete scheduler configuration including the Bamboo discovery jobs alongside the required Team Server jobs:

scheduler:
  output: stdout
  jobs:
    discover_bamboo_pipelines:
      run: "discover_bamboo_pipelines"
      schedule: "0 0 * * * * *"
    discover_bamboo_builds:
      run: "discover_bamboo_builds"
      schedule: "0 */15 * * * * *"
    calculate_statistics:
      run: "calculate_statistics"
      schedule: "0 0 5 * * * *"
    update_status:
      run: "update_status"
      schedule: "0 */5 * * * * *"

After updating the configuration, restart Team Server for the changes to take effect. For restart procedures specific to your deployment method, see:

• Docker Deployment
• Podman Deployment
• Kubernetes Deployment

For additional configuration details, see the Team Server Configuration Guide.

Install the Runtime Sensor

The Runtime Sensor must be installed on the same hosts where your Bamboo agents run. The Sensor monitors build execution and enforces security policies at runtime.

Installation Overview

Install the Runtime Sensor on each host running a Bamboo agent:

1. Identify all hosts running Bamboo agents (both local agents on the Bamboo server and remote agents)
2. Install the appropriate Runtime Sensor package for each host’s Linux distribution
3. Configure the Sensor to communicate with Team Server

For detailed installation instructions specific to your Linux distribution, see the Runtime Sensor documentation.

Remote Agents

Bamboo distributes build work across remote agents (and local agents running on the Bamboo server). When deploying the Runtime Sensor:

• Identify all agents that run builds you want to monitor
• Install the Sensor on every agent host that executes those builds
• When provisioning new remote agents, include Sensor installation in your agent setup process

Bamboo uses agent capabilities and dedicated agents to control which agents run which plans. If you dedicate specific agents to the plans you want to monitor, ensure the Sensor is installed on exactly those agents. For elastic or auto-scaling agents, bake Sensor installation into the agent image or provisioning scripts so new agents automatically receive the Sensor.

Configure Bamboo Plans

With the integration configured and the Runtime Sensor installed, you need to instrument your Bamboo plans to communicate with the Sensor. A Bamboo plan is organized into stages, which contain jobs, which contain tasks. You instrument each job by adding a task that starts the Endura job before the build work and a final task that stops it afterward.

Add Plan Variables

Bamboo exposes built-in variables that the Runtime Sensor can use to enrich build metadata. Map the relevant values into the environment variables the Sensor reads.

Setup Instructions:

1. Log in to Bamboo
2. Decide on the scope for your variables:
   • To apply a variable to all plans: Navigate to Bamboo administration > Global variables
   • To apply a variable to a single plan: Navigate to the plan, click Actions > Configure plan, and open the Variables tab
3. Reference the following Bamboo variable in the Endura tasks (described below) so it is exported as an environment variable for the build:

Add the Start Endura Job Task

The “Start Endura Job” task notifies the Sensor that a build is beginning. This task must execute before all other tasks in the job.

Setup Instructions:

1. Navigate to your plan and click Actions > Configure plan
2. Select the job you want to instrument
3. Under the Tasks tab, click Add task
4. Select the Script task type
5. Configure the task:
   • Task description: Start Endura Job
   • Interpreter: Shell
   • Script body:

     export BUILD_BRANCH="${bamboo.planRepository.branchName}"
     endura job start
6. Click Save
7. Drag the task so it appears first in the job’s task list

Add the Stop Endura Job Final Task

The “Stop Endura Job” task notifies the Sensor that the build has completed. Add it as a final task so that Bamboo runs it after all other tasks, even if a preceding task failed.

Setup Instructions:

1. In the same job, scroll to the Final tasks section (below the regular task list)
2. Click Add task
3. Select the Script task type
4. Configure the task:
   • Task description: Stop Endura Job
   • Interpreter: Shell
   • Script body:

     endura job stop
5. Click Save

Verify the Configuration

Run a build to verify your configuration is working correctly.

Setup Instructions:

1. Navigate to your plan in Bamboo
2. Click Run > Run plan to trigger a build
3. Wait for the build to complete
4. Log in to Team Server
5. Click Pipelines in the main navigation menu
6. Locate your Bamboo project in the pipeline list
7. Click the Edit (pencil icon) button for the pipeline
8. Click the Builds tab
9. Verify that a new build entry appears for the build you just triggered

If the build appears in Team Server, your configuration is working correctly. Proceed to create and assign security policies.

Standardize Plans with Bamboo Specs

For organizations managing many plans, manually adding the Endura tasks to every job does not scale. Bamboo Specs let you define plans as code (in YAML or Java) and store them in a repository (Repository-Stored Specs). With Specs, you can include the Endura start task and stop final task in every plan programmatically, ensuring consistent instrumentation across your build infrastructure.

The following YAML Specs excerpt shows a job with the Endura start task as the first task and the stop task as a final task:

---
version: 2
plan:
  project-key: PROJ
  key: BUILD
  name: Example Build
stages:
  - Build:
      jobs:
        - Build
Build:
  tasks:
    - script:
        description: Start Endura Job
        interpreter: SHELL
        scripts:
          - |
            export BUILD_BRANCH="${bamboo.planRepository.branchName}"
            endura job start
    # ... your existing build tasks ...
  final-tasks:
    - script:
        description: Stop Endura Job
        interpreter: SHELL
        scripts:
          - endura job stop

Setup Instructions:

1. Define your plans using Bamboo Specs in YAML or Java
2. Include the Endura start task as the first entry under tasks and the stop task under final-tasks for each job
3. Store the Specs in a linked repository and enable Repository-Stored Specs for the project
4. Bamboo applies the Specs automatically, instrumenting every plan defined by them

This approach centralizes the definition of your Endura instrumentation: update the Specs once, and the change propagates to all plans on the next Specs scan.

Container-Based Builds

Bamboo supports running jobs inside Docker containers using the Docker runner configuration on a job. When using container-based builds, the Sensor configuration requires additional steps since the container does not have the Sensor pre-installed.

Requirements for Container Builds

For container-based builds to work with Endura:

1. The Runtime Sensor must be installed on the agent host (the machine running the Bamboo agent and Docker daemon)
2. The Sensor socket must be mounted into the build container to enable communication between the containerized build and the host Sensor
3. The Endura CLI must be installed inside the container at the start of each build

Configure the Container Socket Mount

When configuring your Bamboo job to run inside a container, you must mount the Sensor’s communication socket. In the job’s Docker configuration, add the following volume argument:

--volume /run/endura/sensor.sock:/run/endura/sensor.sock

Setup Instructions:

1. Navigate to your plan and click Actions > Configure plan
2. Select the job and open its Docker configuration (the “Run in Docker container” settings)
3. Enable running the job in a container and specify your image
4. In the container’s additional arguments / volumes, add: --volume /run/endura/sensor.sock:/run/endura/sensor.sock
5. Click Save

Modify the Start Endura Job Task

For container-based builds, the “Start Endura Job” task must first install the Endura CLI inside the container before signaling the job start.

Setup Instructions:

1. Edit the Start Endura Job task for the job
2. Update the Script body to:

   curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh
   export BUILD_BRANCH="${bamboo.planRepository.branchName}"
   endura job start
3. Click Save

The installation script downloads and installs the Endura CLI, which then communicates with the Runtime Sensor on the host via the mounted socket.

Multi-Stage and Multi-Job Plans

Bamboo plans can contain multiple stages and jobs, and jobs within a stage run independently (often on different agents). When instrumenting these plans with Endura:

• Add the “Start Endura Job” task and “Stop Endura Job” final task to each job that performs build work
• Each job operates independently from Endura’s perspective and can have its own security policy
• Create separate policies for jobs that perform different types of work (e.g., compile vs. test vs. deploy)
• When deriving policies, run the full plan so that every job is exercised

Create and Assign Security Policies

With your builds reporting to Team Server, you can now create security policies tailored to your pipeline’s behavior. Endura’s derive mode makes this process straightforward by automatically generating a policy based on observed runtime behavior.

Understand Policy Modes

Security policies operate in one of three modes:

The recommended workflow is: derive → observe → enforce.

Derive a Baseline Policy

When the Runtime Sensor runs without an assigned policy (or with a policy in derive mode), it monitors all runtime behavior and outputs a derived policy when the build completes.

Setup Instructions:

1. Run a build in Bamboo that exercises your pipeline’s typical behavior
2. Navigate to the completed build result in Bamboo
3. Open the Logs tab for the job
4. Locate the output of the Stop Endura Job final task
5. Look for the text # ENDURA DERIVED POLICY in the logs
6. Copy the entire policy that follows this marker; this is your baseline policy derived from actual runtime behavior

The derived policy contains rules based on what your pipeline actually did during execution: processes spawned, files accessed, network connections made, and more.

Create the Policy in Team Server

With the derived policy copied, create a formal policy in Team Server.

Setup Instructions:

1. Log in to Team Server
2. Click Policies in the main navigation menu
3. Click the Create button
4. Fill in the policy details:
   • Name: Enter a descriptive name (e.g., “Bamboo - MyProject Build Policy”)
   • Description: Enter a brief description (e.g., “Security policy for the MyProject CI/CD pipeline”)
   • Version: Enter 1.0
   • Policy: Paste the derived policy you copied from the Bamboo build log
5. Review the policy and make any necessary adjustments (see the section below on refining policies)
6. Change the mode from derive to observe
7. Click Create

Assign the Policy to Your Pipeline

Link the policy to your Bamboo pipeline so the Sensor enforces it during builds.

Setup Instructions:

1. In Team Server, navigate to Policies in the main navigation menu
2. Locate your policy in the policy list
3. Click the Assign Policy button (link icon) in the Actions column
4. Search for your Bamboo project by name
5. Select the pipeline by clicking its checkbox
6. Click Assign to 1 Pipeline (or the appropriate count if assigning to multiple pipelines)

Refine the Policy

Derived policies capture exact behavior, which may be overly specific. Before moving to enforce mode, review and refine the policy:

Common refinements:

• Consolidate file paths: If a process writes many files to a directory (e.g., /home/user/workspace/build/), replace individual file entries with a directory pattern using wildcards
• Remove ephemeral paths: Build artifacts in temporary directories may have unique names per build. Use patterns like /tmp/* instead of specific paths
• Group similar operations: Multiple similar rules can often be consolidated into more general patterns
• Remove redundant entries: The derived policy may include duplicate or overlapping rules

Testing in observe mode:

1. Run several builds with the policy in observe mode
2. After each build, check for violations in Team Server:
   • Navigate to Pipelines and select your Bamboo project
   • Click Edit (pencil icon)
   • Click the Builds tab and select the latest build
   • Click Violations to see any policy violations
3. For each violation, determine whether it represents:
   • Legitimate behavior: Update the policy to allow it
   • Unexpected behavior: Investigate the cause before deciding
4. Iterate until builds complete without unexpected violations

Enable Policy Enforcement

Once your policy is refined and builds run cleanly in observe mode, enable enforcement.

Setup Instructions:

1. In Team Server, click Policies in the main navigation menu
2. Locate your Bamboo policy
3. Click the Edit Policy (pencil icon) button
4. Update the policy:
   • Change Version from 1.0 to 1.1 (or your next version number)
   • Change mode from observe to enforce
5. Click Save
6. Enter a description of your change when prompted (e.g., “Enabled enforcement after observe mode testing”). Team Server maintains policy version history for audit purposes
7. Click Save to confirm

When a violation occurs in enforce mode:

• The Sensor takes immediate action (blocks the operation or terminates the offending process)
• The Bamboo build fails
• Violation details are reported to Team Server for review
• Notifications are sent via configured channels (e.g., Slack)

Next Steps

With Bamboo pipeline security configured, consider the following:

• Configure additional pipelines: Apply the same process to other Bamboo projects and plans
• Explore policy capabilities: See the Security Policies documentation for detailed information on policy syntax, advanced rules, and best practices
• Set up notifications: Configure Slack integration to receive real-time alerts on policy violations
• Review audit history: Use Team Server’s policy version history to track changes and maintain compliance documentation