December 2018 Summaries

GitLab is an open-core project featuring both open-source and source-available code, with feature tiers determined by the likely type of buyer; individual contributor-targeted features are promised to be open-sourced. An example is GitLab ChatOps, which allows users to execute commands from chat platforms like Slack and Mattermost, enhancing transparency by allowing everyone to track actions in real-time. Initially misclassified, ChatOps is now set to be open-sourced in GitLab version 11.9, as individual contributors are its primary users. Despite its potential, ChatOps has not gained the expected traction, and its first client, Hubot, has seen a decline in popularity. Essential elements for ChatOps' success include monitoring, queryability, permissions, zero-config functionality, and consistency. GitLab enhances these elements with features such as zero-config and consistency, leveraging its integrated DevOps lifecycle application. The current version of ChatOps lacks default deployment and metric commands, but open-sourcing aims to boost utilization and community contributions, as evidenced by over 150 contributions in the latest release.

GitLab has updated its support page with a new Statement of Support to clarify and enforce its support policies, aiming to provide the best possible service to both customers and the community. The document outlines the scope of support, emphasizing the importance of defining what is supported to maintain a high quality of service without increasing costs. For paid users, detailed support pages for GitLab.com and GitLab Self-managed Licenses are available, while free users are encouraged to utilize community-first resources like documentation and forums. GitLab draws inspiration from the support model of WordPress.com and aims to foster a strong community where users can assist each other, although priority support is reserved for paid users. The initiative underscores GitLab's commitment to enhancing the user experience and actively engaging with its community to improve forums and resources.

In a keynote at Drupal Europe, project founder Dries Buytaert showcased a visual prototype of Drupal's forthcoming integration with GitLab, marking a significant step in their announced transition to GitLab. This transition involves multiple phases, with Phase 1 slated for early January and Phase 2 anticipated in early 2019. The integration necessitated extensive collaboration with GitLab's engineering team to address various technical issues, such as API enhancements and data deduplication. On Drupal's side, a versioncontrol_gitlab module was developed to facilitate integration, accompanied by rigorous migration testing and data cleanup to prevent namespace conflicts. The project anticipates enhanced efficiency and collaboration once the migration progresses past Phase 1. The Drupal community remains vibrant, offering resources like the Getting Involved Guide and hosting events such as DrupalCon Seattle in April 2019, underscoring their enduring motto, "Come for the code, stay for the community." Tim Lehnen, Executive Director at the Drupal Association, originally published this update on the Drupal blog.

Alexis Reigel, a significant contributor to GitLab and a Siemens employee, shares insights and experiences from his involvement with the open-source community. He started contributing to GitLab in 2017, with his first successful merge request being a feature to add a custom brand header logo in emails. Reigel emphasizes the importance of reviewing existing merge requests and issues before contributing and recommends starting with a "Minimum Viable Change" to facilitate collaboration and refinement. He highlights the supportive and respectful nature of the GitLab community, which helps in navigating complex discussions and lengthy processes for more complicated contributions. Reigel also mentions that several of his Siemens colleagues are active contributors, prioritizing feature requests based on internal discussions and needs. Outside of his work with GitLab, Reigel enjoys working on other open-source projects and spending time with family and friends. He encourages potential contributors to explore the "Contributing to GitLab" page and assures them that their efforts will be valued by the community.

GitLab has been recognized as a December 2018 Gartner Peer Insights Customers' Choice for Application Release Orchestration (ARO), highlighting its commitment to customer feedback in shaping its products and services. This distinction is based on verified end-user reviews, requiring a minimum of 50 reviews with an average rating of 4.2 stars or higher, and GitLab achieved 66 reviews with a 4.4 rating. The company emphasizes that its ARO tooling empowers release managers by enhancing effectiveness without imposing limitations, especially in regulated environments like large enterprises. GitLab is focused on solving release orchestration challenges from a modern, cloud-native perspective and is introducing new features such as release pages to improve software delivery processes. The recognition reflects customers' positive experiences, with testimonials praising GitLab's vision and impact on the future of software development and DevOps lifecycle.

GitLab announced that, in line with the PCI Security Standards Council mandate, they discontinued support for TLS 1.0 and 1.1 on GitLab.com and their GitLab API as of December 15, 2018, requiring clients to use TLS 1.2 for enhanced security. This change, aimed at evolving their security posture and complying with the Payment Card Industry Data Security Standard (PCI DSS) 3.1, is part of their broader strategy to eliminate outdated protocols prone to attacks. While most traffic to GitLab.com uses up-to-date clients supporting TLS 1.2, some users with older systems, such as Git-Credential-Manager-for-Windows versions before 1.14.0, Red Hat versions before 6.8 and 7.2, JDK 6 or earlier, and older versions of Visual Studio 2017, may need updates to maintain compatibility. Self-managed installations will see these changes in the upcoming major release 12.0, scheduled for March 22, 2019, and GitLab encourages users experiencing disruptions to contact their support or security teams for assistance.

The GitLab Configure group, part of the broader GitLab engineering function, focuses on improving Auto DevOps, Kubernetes integration, and related applications, benefiting from a recent restructuring into stable devops stage groups. Each group comprises a product manager, UX designer, engineers, and other contributors, fostering a collaborative environment where roles are dedicated to specific product lifecycle stages. This structure enhances focus, communication, and shared learning, mitigating previous challenges of siloed work and cross-group communication barriers. Group members, including Staff UX Designer Taurie Davis and Product Manager Daniel Gruesso, report increased productivity and learning opportunities due to the stable groups, which facilitate direct collaboration across different roles. Positive impacts include more effective problem-solving, clearer ownership of tasks, and a reduction in scope creep and communication issues, as evidenced by deeper interactions between backend engineers and UX designers. The Configure group is excited about future initiatives such as improving Auto DevOps and expanding features like group-level Kubernetes clusters, aiming to create a more engaged user base and improve overall user experience.

The announcement highlights the transition of a bug bounty program to a public format on HackerOne, following its initial private inception in December 2017. Over $200,000 in bounties have been awarded for nearly 200 reported vulnerabilities, and security automation has significantly reduced the first response time to new findings from over 48 hours to just seven. The program has achieved a mean time to mitigation of under 30 days for critical security issues, with goals to reduce this metric for medium-high issues to under 60 days. The public program aims to engage the hacker community by rewarding them directly for reporting security vulnerabilities, and it acknowledges the contributions of top community members like ngalog, jobert, and fransrosen. The announcement also mentions plans for further expansion in 2019 and beyond, inviting more participation from the public.

As 2019 approaches, the excitement for predictions on emerging technology trends is palpable, particularly in the realm of cloud native technologies, which have evolved beyond being just a fad to delivering tangible benefits for enterprises. GitLab, along with industry experts, has identified key trends for the upcoming year, including the adoption of multi-cloud strategies, the maturation of cloud native tools such as Kubernetes and Prometheus, increased focus on serverless technologies like Lambda and Knative, and advancements in artificial intelligence and machine learning applications. Additionally, GitLab is collaborating with DevOps.com for the Predict 2019 virtual conference, which will cover predictions related to cloud security, DevOps, and quality testing, featuring a range of speakers aiming to inform and inspire participants as they prepare for the new year.

Serverless computing, the latest innovation in cloud computing, offers a cost-effective execution model where the cloud provider manages machine resources dynamically, charging based on actual resource consumption rather than pre-purchased capacity, a concept popularized by AWS Lambda in 2014. GitLab is launching GitLab Serverless on December 22, as part of its comprehensive DevOps application, to allow enterprises to manage serverless workloads alongside their existing code within the same interface, leveraging Knative for autoscaling on Kubernetes, thus supporting multi-cloud strategies. This initiative, developed in partnership with TriggerMesh founder Sebastien Goasguen, aims to integrate serverless computing into developers' workflows while providing cost savings and flexibility, and will be available as an alpha offering in GitLab 11.6, with further insights to be shared at KubeCon Seattle.

GitLab has integrated Git Protocol v2 over SSH on GitLab.com, enhancing its previous support for Protocol v2 over HTTP introduced in GitLab 11.4. Protocol v2, available from Git version 2.18.0 and requiring opt-in activation, optimizes the performance of clone, fetch, and push operations between clients and servers by reducing network traffic and allowing for future enhancements. Users can globally enable this protocol by executing a specific git config command, and the impact of this upgrade is demonstrable through a significant reduction in the number of packets sent during operations, as evidenced by a comparison of network traffic using Protocol v0 and Protocol v2.

In software development, while the addition of optional features in applications may seem beneficial for catering to individual user needs, it often leads to increased complexity and workload for developers, and can burden users with decision-making. These options require extra code, testing, and documentation, complicating the user interface and making future development and error diagnosis more challenging due to exponential growth in application states. At GitLab, the preferred approach is to iterate based on user feedback, delivering core features without options unless users specifically request them. This iterative process helps avoid unnecessary features, reduces development scope, and ensures solutions are broadly applicable, focusing on solving user problems without relying on optional features.

GitLab is implementing a significant update to the Static Application Security Testing (SAST) job definition with the release of GitLab 11.6 on December 22, which may cause SAST jobs to fail if they are run by a GitLab Runner version older than 11.5. Although these failures will not block pipelines, SAST results will no longer appear in merge requests or at the pipeline level, impacting users utilizing Auto DevOps with outdated runners who value security reports. This update, which employs a new reports syntax essential for displaying SAST results in the Group Security Dashboard, is not compatible with GitLab Runner versions prior to 11.5. To mitigate the issue, affected users are advised to upgrade their GitLab Runners to at least version 11.5 to restore functionality, while those using shared runners on GitLab.com or newer versions are not affected. The change is set to be part of GitLab 11.6's release and may be included in an early release candidate version, affecting self-managed instances upon upgrading to the new version or users on GitLab.com when the RC version is deployed.

GitLab's presence at AWS re:Invent 2018 highlighted its emergence as a leader in the DevOps space, showcasing its single application that covers the entire software development lifecycle. The event, which took over much of the Las Vegas strip with over 50,000 attendees, provided a platform for GitLab to demonstrate its capabilities in reinventing CI/CD pipelines using GitLab, Kubernetes, and AWS's EKS, emphasizing its potential to improve cycle times by over 200 percent. This led to GitLab receiving the AWS Partner DevOps Competency Certification, underscoring its excellence as a DevOps solution. The company's participation included a well-attended talk by CEO Sid Sijbrandij, a live demo, and representation on a podcast discussing GitOps, NoOps, and the toolchain crisis, reinforcing the critical role of open source in cloud computing. GitLab's efforts and vision were validated by the enthusiastic reception from users familiar with its expanded role beyond version control, marking a significant step in its growth trajectory.

GitLab.com planned a two-phase maintenance schedule to deploy Patroni as the Postgres Failover Manager, with a dry run on December 8, 2018, and the actual deployment on December 15, 2018, each starting at 13:00 UTC and expected to last 30 minutes. During these windows, several services, including the SaaS website, Git ssh, Git https, registry, CI/CD, and Pages, would be unavailable, while about.gitlab.com and docs.gitlab.com would remain accessible. The dry run aimed to test and validate migration procedures and tools, ensuring readiness for the actual cutover. Updates regarding any changes to the schedule were to be communicated via the GitLab Status page and GitLab Status Twitter.

Cloud computing is now the dominant IT paradigm, with multi-cloud strategies being adopted by 81 percent of enterprises to avoid vendor lock-in, especially as AWS, GCP, and Azure dominate the market. Despite its advantages, implementing a multi-cloud strategy remains complex due to the lack of standardized workload portability across managed services. Crossplane, an open-source multi-cloud control plane sponsored by Upbound, aims to address this challenge by introducing workload resource abstractions that enable greater portability across cloud providers. This project aspires to be a universal API for cloud computing, allowing developers to consume resources independently of the underlying provisioning and management details. Unlike existing tools such as Terraform and AWS Service Operator, Crossplane offers flexibility for workload portability across multiple clouds. GitLab has been chosen as the first complex application to be deployed using Crossplane, aligning with its commitment to multi-cloud DevOps and offering customers simplified toolchains and diverse deployment environments. The collaboration between GitLab and Crossplane is expected to simplify cloud orchestration, with future plans to deploy applications from GitLab using Crossplane.