> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-mintlify-ce853e25.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a GitHub Enterprise Cloud connector

> C1 provides identity governance and just-in-time provisioning for GitHub Enterprise Cloud. Integrate your GitHub Enterprise Cloud instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

## Capabilities

| Resource      | Sync                                                          | Provision                                                     |
| ------------- | ------------------------------------------------------------- | ------------------------------------------------------------- |
| Enterprise    | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |                                                               |
| Organizations | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Users         | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |                                                               |
| Teams         | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Repositories  | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |

**Additional functionality:**
The GitHub Enterprise Cloud connector supports account provisioning by inviting
new users directly to the enterprise as unaffiliated members.

## Gather GitHub Enterprise Cloud credentials

<Warning>
  Use a GitHub App, not a personal access token. The app must be installed on
  the enterprise and on each organization and repository set that C1 will sync or
  manage. Enterprise installation alone does not grant organization or repository
  API access.
</Warning>

<Steps>
  <Step>
    Copy the GitHub Enterprise Cloud enterprise slug.
  </Step>

  <Step>
    Create or select a GitHub App that is installed on the enterprise.
  </Step>

  <Step>
    Grant the enterprise installation read access for enterprise members and
    organizations. If C1 should discover organization installations, also grant
    read access for enterprise organization installations. To invite new
    members through C1, also grant **Enterprise people management** write
    access on the enterprise installation.
  </Step>

  <Step>
    Install the same GitHub App on each organization that C1 should sync. Grant
    **Members** read access for sync, or **Members** write access if C1 should
    invite users or manage organization and team membership.
  </Step>

  <Step>
    Grant repository **Metadata** read access and **Administration** read access
    for repository access sync. Use **Administration** write access if C1 should
    manage repository collaborators or team repository access.
  </Step>

  <Step>
    Copy the GitHub App ID.
  </Step>

  <Step>
    Download the GitHub App private key.
  </Step>

  <Step>
    Copy the enterprise installation ID for the GitHub App.
  </Step>
</Steps>

## Configuration fields

| Field                 | Required | Description                                         |
| --------------------- | -------- | --------------------------------------------------- |
| `enterprise-slug`     | Yes      | The slug of the GitHub Enterprise Cloud enterprise. |
| `app-id`              | Yes      | The App ID of the GitHub App.                       |
| `app-privatekey-path` | Yes      | The GitHub App private key file.                    |
| `installation-id`     | Yes      | The GitHub App installation ID on the enterprise.   |

## Synced resource types

* **Enterprise**: the configured enterprise, with member and owner grants.
* **Organizations**: organizations in the enterprise, with member and admin
  grants.
* **Users**: organization members discovered across synced organizations.
* **Teams**: organization teams, with member and maintainer grants.
* **Repositories**: organization repositories, with pull, triage, push,
  maintain, and admin grants for users and teams.

## Special notes

* Team maintainers are also emitted as team members.
* Repository team grants are expandable through the corresponding team member
  and maintainer entitlements.
* Organization provisioning currently supports revocation. Revoking an
  organization member removes that user from the organization; revoking an
  organization admin demotes the user to member.
* Account provisioning invites the user as an unaffiliated enterprise member
  via the `inviteEnterpriseMember` GraphQL mutation; no org is required. The
  account profile must include an email or a GitHub login.

## Configure the GitHub Enterprise Cloud connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **GitHub Enterprise Cloud** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new GitHub Enterprise Cloud connector.
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Paste the GitHub Enterprise Cloud credentials into the relevant fields:

        * **Enterprise slug**: The GitHub enterprise slug.
        * **GitHub App ID**: The GitHub App ID.
        * **GitHub App private key**: The private key file for the GitHub App.
        * **GitHub App installation ID**: The enterprise installation ID.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by
        **Connected**. You can view the logs to ensure that information is
        syncing.
      </Step>
    </Steps>

    **Done.** Your GitHub Enterprise Cloud connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the GitHub Enterprise Cloud connector in
    your own environment.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Baton** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new GitHub Enterprise Cloud connector, set the
        owner, and click **Next**.
      </Step>

      <Step>
        In the **Settings** area, click **Edit**, then click **Rotate** to
        generate a new Client ID and Client Secret. Store these values
        securely for your deployment.
      </Step>
    </Steps>

    ### Step 2: Create Kubernetes configuration files

    Create two Kubernetes manifest files for your GitHub Enterprise Cloud connector deployment:

    #### Secrets configuration

    ```yaml expandable theme={null}
    # baton-github-enterprise-cloud-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-github-enterprise-cloud-secrets
    type: Opaque
    stringData:
      # C1 credentials
      BATON_CLIENT_ID: <C1 client ID>
      BATON_CLIENT_SECRET: <C1 client secret>

      # GitHub Enterprise Cloud credentials
      BATON_ENTERPRISE_SLUG: <GitHub enterprise slug>
      BATON_APP_ID: <GitHub App ID>
      BATON_INSTALLATION_ID: <GitHub App enterprise installation ID>
      BATON_APP_PRIVATEKEY_PATH: /etc/baton-github-enterprise-cloud/keys/private-key.pem

    ---
    # baton-github-enterprise-cloud-app-key-secret.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-github-enterprise-cloud-app-key
    type: Opaque
    stringData:
      private-key.pem: |
        <Contents of the GitHub app's private key (.pem) file>
    ```

    The private key must be mounted into the container as a file rather than passed as an environment variable. The manifest above stores the key in its own Secret so it can be mounted as a volume in the deployment configuration below. Set `BATON_APP_PRIVATEKEY_PATH` to the path where the key will be mounted.

    See the connector's README or run `--help` to see all available configuration flags and environment variables.

    #### Deployment configuration

    ```yaml expandable theme={null}
    # baton-github-enterprise-cloud.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baton-github-enterprise-cloud
      labels:
        app: baton-github-enterprise-cloud
    spec:
      selector:
        matchLabels:
          app: baton-github-enterprise-cloud
      template:
        metadata:
          labels:
            app: baton-github-enterprise-cloud
            baton: true
            baton-app: github-enterprise-cloud
        spec:
          containers:
          - name: baton-github-enterprise-cloud
            image: public.ecr.aws/conductorone/baton-github-enterprise-cloud:latest
            imagePullPolicy: IfNotPresent
            env:
            - name: BATON_HOST_ID
              value: baton-github-enterprise-cloud
            envFrom:
            - secretRef:
                name: baton-github-enterprise-cloud-secrets
            volumeMounts:
            - name: github-app-key
              mountPath: /etc/baton-github-enterprise-cloud/keys
              readOnly: true
          volumes:
          - name: github-app-key
            secret:
              secretName: baton-github-enterprise-cloud-app-key
    ```

    Use a version tag without the leading `v`, such as `0.0.3`, in place of `latest` if you want to pin to a specific release.

    ### Step 3: Deploy the connector

    <Steps>
      <Step>
        Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
      </Step>

      <Step>
        Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the GitHub Enterprise Cloud connector to.
      </Step>
    </Steps>

    **Done.** Your GitHub Enterprise Cloud connector is now pulling access data into C1.
  </Tab>
</Tabs>