February 2020 Summaries

In October 2019, GitLab launched an improved free trial signup flow that significantly enhanced user experience by reducing the number of interactions needed from approximately 35 to 15 and cutting the signup time from over five minutes to about 2.5 minutes. This overhaul was driven by a team of designers who identified and addressed issues in the previous user journey that stemmed from disjointed and confusing processes across two separate applications with inconsistent visual styles. By unifying the signup flow into a single application and streamlining the user journey, the team managed to more than double the weekly free trial signups, improving average signups from 330 to 794 per week. This transformation highlighted the importance of a holistic design approach over organically grown experiences, demonstrating how strategic design improvements can lead to substantial increases in user engagement and satisfaction. Despite these successes, further enhancements are anticipated, including reducing the signup process time to one minute and tailoring the flow based on user type.

GitLab's all-remote working model is celebrated through its Contribute events, which occur every nine months at various global locations, fostering company culture and enhancing team bonds. These gatherings allow employees from diverse backgrounds to meet in person, share experiences, and learn from one another through workshops, discussions, and activities, all while maintaining the company's values of transparency, collaboration, and inclusivity. The events, characterized by a mix of professional development and social interaction, are crucial for building trust and camaraderie among team members, contributing to GitLab's rapid growth and success in the tech industry. The emphasis on vulnerability and human connection underscores the importance of physical proximity in a remote-first company, making Contribute an integral part of GitLab's strategy to strengthen remote work dynamics.

The strategy for deprecating features in a product involves removing those that are widespread in the codebase but lack significant usage, as they can hinder user and development experiences. Deprecation is necessary not just to improve user experience but also to manage technical debt, which can obstruct the integration of future features and affect the quality of existing code. Like many companies, features are phased out if they do not generate revenue or see substantial use. The overarching mission is to ensure that every new feature provides a robust foundation for future development, aligning with the principle that everyone can contribute effectively.

In the automation-driven landscape of CI/CD pipelines, manual jobs, when properly configured, offer significant advantages in controlling deployments and meeting compliance requirements. Manual jobs, particularly in projects not fully configured for continuous deployment (CD), can limit deployment access to specified users or groups through protected environments, thereby preventing unauthorized production deployments. By defining roles, groups, or users who can deploy, such environments ensure only authorized personnel can execute these critical tasks. Additionally, compliance often necessitates approval steps in workflows, which can be integrated as a blocking manual job in the pipeline, requiring an authorized user to approve before proceeding with deployment. This structured approach using manual jobs and protected environments provides effective control over production deployments and compliance adherence, as illustrated by YAML configuration examples.

GitLab's recent blog post discusses the company's ongoing efforts to implement a Zero Trust security model, sharing insights from security conferences and addressing questions about data classification challenges. The issue of data fluidity is highlighted, where access controls can be problematic if data classification changes after initial authentication. GitLab is exploring solutions like data zones to manage access but aims to eliminate them for more granular control. The company has chosen Okta as a key vendor for identity management due to its flexibility and support for multi-factor authentication, though concerns about relying on a single vendor were noted. GitLab's Zero Trust strategy involves integrating multiple products with Okta, focusing on user identity, authentication, device identity, and auditing capabilities, while acknowledging that the implementation is still a work in progress with updates anticipated as milestones are reached.

GitLab has developed a new tool called the GitLab Performance Tool (GPT) to enhance the performance testing of its platform, leveraging the open-source k6 framework. This initiative is part of a broader effort to scale and standardize performance testing through the creation of GitLab Reference Architectures, designed to support large user bases. GPT allows for comprehensive load testing, offering out-of-the-box test suites, customizable test runs, and enhanced reporting. It is integrated into automated CI pipelines, providing regular feedback and facilitating performance improvements with each release, as demonstrated by significant enhancements in the 12.6 release. The tool is open source, encouraging community use and feedback, which aids in refining recommended specifications and usability for various environments, including private clouds. GitLab aims to further expand GPT's coverage and improve user experience, inviting community contributions and suggestions to guide future developments.

At GitLab, the role of a Staff Engineer transcends the traditional boundaries of technical expertise, requiring a blend of leadership, collaboration, and strategic vision. While Senior Engineers focus on complex challenges within their teams, Staff Engineers engage in cross-team collaboration, process improvement, and knowledge sharing to drive the broader technical and cultural impact. Drawing from interviews with various Staff Backend Engineers, it is evident that the role requires a systemic understanding of GitLab's enterprise-scale product and an ability to influence product and technical strategy. Staff Engineers are tasked with identifying systemic improvements, championing niche areas without oversight, and fostering an environment of continuous learning and dynamic process iteration. They are expected to leverage their technical and human skills to empower others, address cross-team issues, and align technical efforts with product vision, ultimately bridging the gap between management's strategic planning and the execution of individual contributors.

GitLab recently participated in FOSDEM and is gearing up to join SCaLE 18x in Southern California, the largest volunteer-organized open-source and free software event in North America, where they are offering a 40% discount for GitLab community members using the code GIT. GitLab will host a Community Day on March 6th at the Pasadena Convention Center, featuring discussions, workshops, and tutorials on contributing to and using GitLab, with several Developer Relations team members present. Additionally, GitLab will sponsor DevOpsDay LA, with a booth offering discussions on DevOps, GitLab swag, and a raffle for a Nintendo Switch. GitLab team members will also present at the conference: Francis Potter will discuss DevOps on March 6th, and Ray Paik will talk about building communities in for-profit open-source projects on March 7th.

In the realm of software development, managing secrets efficiently is crucial, particularly when integrating secure data access for CI/CD jobs. GitLab has explored how to streamline access to stored variables using HashiCorp's Vault, a leading solution for secret storage. During a discussion with GitLab's CEO Sid Sijbrandij and senior product managers, two options were considered: utilizing GitLab Runner to fetch Vault tokens or integrating directly with Rails. The conversation emphasized the importance of rotating and updating secrets to maintain security, as traditional methods of hiding secrets are no longer viable. Sijbrandij advocates for using Vault due to its capability in rotation and access control, and suggests that a simple runner managed by Rails is the most effective minimum viable change (MVC) for managing secrets. This approach keeps the complexity within the Rails app and simplifies the runner, aligning with the company's value of iteration and ensuring a safer, more streamlined integration with Vault.

An internal Red Team at GitLab has focused on understanding the potential security pitfalls within Google Cloud Platform (GCP) environments, especially concerning privilege escalation and data compromise tactics. This effort led to the creation of tools and insights shared with the security community, including a deep dive into vulnerabilities that can arise from misconfigured GCP setups. The blog details a simulation of an attack beginning with low-privilege access on a Linux virtual machine and explores methods for escalating privileges, moving laterally across systems, and exfiltrating sensitive data without any new vulnerabilities being discovered. It discusses tools such as gcp_firewall_enum for port scanning and gcp_enum for consolidating enumeration commands, and it provides insights into GCP's IAM permissions, resource hierarchy, and the potential risks of default service accounts. Additionally, the blog explores techniques for interacting with Google's cloud services to hunt for secrets and how leveraging existing permissions can lead to further access within a GCP environment and additional projects.

The blog post recounts the author's experience as the manager of the Data team at GitLab and the lessons learned during a period of rapid company growth. It highlights the challenges of balancing managerial duties with individual contributor roles, emphasizing the need to choose one path to avoid burnout. The author stresses the importance of strategic hiring, process investment, and the use of effective tools like dbt to enhance team productivity. The piece also underscores the significance of executive support for a data function, advocating for a dedicated data leadership role to promote data literacy organization-wide. The narrative reflects on the necessity of financial investment in building a data team and cautions against reinventing existing solutions. Finally, the author discusses the personal decision to return to an individual contributor role for better mental health and professional fit, illustrating that career paths in management and individual contribution are distinct and reversible.

In November 2019, MulticloudCon was co-hosted by partners including Upbound and featured experts discussing the evolving role of multicloud environments and Kubernetes in streamlining workflows for developers and operations experts. As the adoption of multicloud and hybrid IT strategies grows, organizations face challenges such as inconsistencies between cloud environments, particularly in networking, storage, and lifecycle management. Google Cloud's Ian Chakeres and Tim Hockin highlighted how Kubernetes addresses these challenges by providing abstractions that offer a consistent platform across different cloud providers, reducing complexity for developers. While Kubernetes offers a solution for managing multicloud operations, it's acknowledged that not all abstractions are perfect, and the integration of multicloud technologies is still developing. The open-source nature of Kubernetes fosters an extensive ecosystem that can support businesses by filling infrastructural gaps, positioning Kubernetes as a pivotal element in the future of multicloud strategies.

At GitLab, iteration is a fundamental practice embedded in the company's culture and operations, enabling rapid progress and innovation by breaking tasks into smaller, manageable steps. This approach, championed by CEO Sid Sijbrandij since the company's early days, allows for faster development and problem-solving, as demonstrated in projects like error tracking enhancement and cloud migration. Employees across various departments, including communications, marketing, and user experience, attest to the benefits of iteration, highlighting its role in fostering creativity, learning, and adaptability. This iterative process encourages team collaboration, experimentation, and the ability to pivot when necessary, which not only accelerates growth but also empowers individuals to take risks and contribute more effectively without fear of premature judgment.

In 2019, a survey of over 4,000 software professionals revealed significant insights into their industry, highlighting a disconnect between developers and security experts, with nearly half of respondents identifying testing as a major bottleneck. Continuous delivery and DevOps were gaining traction, particularly in smaller companies, with many planning to invest heavily in infrastructure to enhance integration and deployment. GitLab, recognizing the evolving landscape of development practices due to technological advancements and maturing DevOps methodologies, has launched the 2020 Global DevSecOps Survey to gather updated insights. Participants are incentivized with a sweepstakes offering prizes like Apple products and GitLab swag, with the survey designed to take less than 10 minutes for most, extending to 20 minutes for senior management. The survey aims to capture the current state of software development and is open until February 29, 2020, with results expected in May.