April 2020 Summaries

Auto DevOps is a feature designed to streamline the adoption of Continuous Integration and Continuous Deployment (CI/CD) by incorporating best practices and automation within the software development lifecycle. It requires a Kubernetes cluster to function and includes various automated stages such as Auto Build, Auto Test, Auto Code Quality, and Auto Deploy, among others, which facilitate different aspects of the development process from building and testing code to security analysis and deployment. Recent improvements include compatibility with Kubernetes 1.16, while upcoming enhancements aim to integrate cloud-native buildpacks, support for air-gapped networks, and an upgrade to Helm 3. Additionally, future updates will introduce features like NGINX alerts and Merge Train support, alongside a shift towards a Directed Acyclic Graph (DAG) approach to improve pipeline efficiency. The platform is evolving to align with modern DevOps best practices, offering a robust solution for users to efficiently manage and monitor their applications.

Remote work is portrayed as a transformative opportunity to balance personal and professional life, allowing individuals to live according to their own terms rather than being bound by the constraints of traditional office environments. The narrator, having experienced the demanding schedules of previous corporate roles, particularly highlights the negative impact on family life and personal well-being, leading to a pivotal decision to seek a more flexible work arrangement. Despite initial skepticism about GitLab's remote-first culture, which emphasizes results and work-life integration, the narrator finds it offers a supportive environment that values employee autonomy and mental health. This shift to remote work has enabled the narrator to enjoy a more fulfilling life, with ample quality time for family and personal pursuits, illustrating the profound benefits of a work model that prioritizes human needs over physical presence in an office.

GitLab has developed a Status Page tool to enhance incident management for its internal team and customers, available to GitLab Ultimate users with a frontend accessible to all. The tool aims to streamline incident updates by eliminating the need for responders to switch between tools and manage information duplication, addressing the drawbacks of the previous system where updates were manually published by engineers every 15 minutes. The Status Page allows for controlled visibility of incident updates to protect sensitive information, and it displays comprehensive data from GitLab incident descriptions and comments. Built with VueJS for the frontend and hosted separately under an MIT license, the Status Page utilizes a background job to convert incident issues into JSON, which is then published, supporting storage on Amazon S3 to ensure availability even if Google Cloud experiences downtime. The development process, driven by GitLab's Monitor:Health team, involved a Spike exercise to determine the best implementation approach, leading to the creation of a stand-alone application that integrates seamlessly with GitLab's ecosystem.

The 2019 Cloud Native Computing Foundation survey revealed that 41% of respondents utilize serverless technology, with AWS Lambda being the most popular hosted platform choice for 53% of users. To showcase the synergy between AWS Lambda and GitLab CI/CD, AWS and GitLab hosted a webcast demonstrating the use of the AWS Serverless Application Model (SAM) for creating, testing, and deploying serverless applications. The webcast highlighted the advantages of SAM, an open-source framework that simplifies defining and deploying AWS resources, making it a valuable tool for enterprise teams seeking efficient serverless solutions. By offering templates in multiple programming languages like Python and Node.js, SAM aids diverse teams in streamlining backend work and automating infrastructure management. The webcast underscored best practices for serverless and microservices development, emphasizing scalable, pay-as-you-go models, and the importance of monitoring and observability. Participants were encouraged to treat infrastructure like code, set up automated pipelines, and integrate monitoring from the start, with the full webcast available for further insights into leveraging GitLab and AWS for serverless applications.

GitLab is enhancing its collaboration with Red Hat to streamline software development and deployment processes by leveraging both companies' technologies. GitLab provides an integrated platform that supports DevOps practices, offering tools like CI/CD, AutoDevOps, and a container registry to facilitate efficient application lifecycle management. Red Hat's Enterprise Linux (RHEL) and OpenShift technologies complement GitLab by providing a secure, scalable operating system and a robust Kubernetes platform for deploying containerized applications across hybrid cloud environments. The partnership aims to improve organizational DevSecOps capabilities and reduce compliance risks, with future plans to introduce the GitLab Runner Operator for OpenShift to further enhance integration and developer productivity.

The GitLab for Education Program announced its first global virtual meetup, aimed at fostering a community around education and DevOps, on May 6th. GitLab meetups, which traditionally have been in-person events, are now successfully being held virtually, allowing for more diverse and inclusive participation. The event, organized by the Developer Relations team, seeks to build relationships and share knowledge about the use of GitLab in educational settings by providing free licenses to qualifying institutions. The program has already issued 1.486 million seats to 800 institutions across 65 countries. During the meetup, team members such as John Coghlan and Christina Hupy will introduce themselves and discuss various aspects of the GitLab for Education Program, including how institutions can benefit from it, share use cases, discuss challenges, and explore useful resources. The event is open to anyone interested, regardless of whether they are a current Education Program member, and aims to increase networking and skill-building opportunities related to DevOps and GitLab.

GitLab emphasizes transparency as a core value, which significantly impacts its approach to compliance and audits, notably the SOC 2 Type 1 audit. By making most company information publicly accessible, GitLab reduces barriers to collaboration and simplifies the audit process. This openness allows auditors to self-serve much of the necessary information, thereby saving time for GitLab employees and minimizing the traditional burdens associated with audits. Despite potential challenges such as documentation gaps, the transparent approach led to valuable insights and improvements in GitLab's documentation, ultimately enhancing audit efficiency and clarity. GitLab's commitment to transparency not only facilitates compliance but also fosters accountability and enables external contributions to its processes. Following their first audit, GitLab is working on refining their handbook documentation in preparation for further audits and assessments, such as the SOC 2 Type 2 audit and the Cloud Security Alliance CAIQ self-assessment, to continue improving their security compliance program.

Research indicates a growing preference for GitLab as a version control system among developers, as evidenced by an increase in users choosing GitLab over GitHub and Bitbucket between 2018 and 2019. A significant challenge in transitioning to GitLab from other systems is the data migration process, which AppsFlyer successfully undertook by moving from Bitbucket to GitLab. AppsFlyer, a large engineering firm with over 300 developers, needed to switch due to issues like public repository access and latency problems with Bitbucket. They opted for GitLab due to its open-source nature, transparency, and better alignment with their growth needs. The transition required converting repositories from Mercurial to Git using tools like Fast-Export and developing a self-service wrapper for scalability. Additional benefits from the migration included improved repository management and developer trust. AppsFlyer also leveraged open-source capabilities by creating tools and API wrappers to streamline processes and increase codebase visibility. Despite some minor bugs post-migration, the switch to GitLab has been beneficial for AppsFlyer's growth and operational efficiency.

The complexity of managing a .gitlab-ci.yml file in large, monorepo-style repositories can pose challenges, such as merge conflicts and productivity slowdowns when multiple teams work on interconnected services. GitLab addresses these issues by introducing Parent-child pipelines and dynamic pipeline configuration features in version 12.7. Parent-child pipelines allow separate components to run concurrently, improving performance and compartmentalizing configurations into different files and views. A parent pipeline can trigger child pipelines using the trigger key, with configurations specified in separate YAML files. These child pipelines can be activated based on conditions, such as changes in specific folders. Furthermore, GitLab enables the dynamic generation of pipeline configuration files, which keeps repositories organized and reduces clutter. This is achieved by running scripts within the parent pipeline to create and use configuration files as artifacts. These enhancements provide developers with greater flexibility and efficiency when building CI/CD workflows, facilitating the management of complex projects within a single repository.

A shortage of COBOL developers is causing delays in processing unemployment benefits and small business loans, highlighting the ongoing reliance on this aging programming language despite the rapid advancement of technology. While COBOL is primarily used in government and financial sectors, its presence is significant, with IBM reporting 240 billion lines still active and 5 billion more written annually. However, interest in learning COBOL is low compared to modern languages like Ruby, Go, and Java, as evidenced by job market trends. Educational resources such as courses from Udemy, LinkedIn, and GitHub's openmainframeproject are available, but the community is seeking additional solutions to bridge the skills gap, with suggestions like integrating COBOL knowledge into university curricula for Java programmers.

Git, a widely renowned open-source source code management tool, celebrated its 15th anniversary in April 2020, sparking reflections and insights from the GitLab team on its evolution and significance. The tool was created by Linus Torvalds and has become integral to software development, with many developers seeking to optimize their workflow with features like Git blame and .gitignore. Challenges such as the complexities of Git flow and handling large files have prompted solutions like Git Partial Clone. Git's impact is discussed through perspectives from GitLab's Brendan O'Leary and GitHub's Jeff King, highlighting its past achievements and future potential. The concept of GitOps is explored, offering insights into its role in facilitating continuous delivery to production environments.

Dotfiles are hidden configuration files on Unix-based systems that begin with a dot (.) and play a crucial role in enhancing software developers' productivity by managing the functionality of various programs. Typically stored in a user's home directory, these files configure environment variables, shell aliases, and command-line tools, loading upon user login or shell initiation. The author shares personal experiences of managing dotfiles across different operating systems like Linux and macOS, emphasizing how dotfiles enable seamless software installations, runtime configurations, and facilitate sharing best practices via a Git repository. Tools such as OhMyZSH for ZSH shell configuration, Git for version control, and Homebrew for package management on macOS are highlighted as integral to the author's workflow. Additionally, the summary explains how custom workflows using Alfred, trackpad automation, and keyboard shortcuts enhance productivity. The author encourages collaboration and sharing of configurations through an open-source repository, inviting others to contribute and customize their work environments.

In 2006, Amazon's launch of AWS Elastic Compute initiated a transformation in how developers manage compute resources, leading to the evolution of infrastructure-as-code (IaC) with tools like Puppet, Ansible, and Terraform. As software development practices advanced, the need for faster DevOps cycles became evident, popularizing continuous delivery and necessitating new solutions such as Kubernetes and serverless architectures. GitOps emerged as a convergence of IaC and continuous delivery, providing a unified approach where developers and operations teams manage applications and infrastructure through a shared code repository. GitOps leverages version control and continuous integration to make the repository the central source of truth, allowing changes to infrastructure and applications to be committed together and deployed automatically through CI/CD once approved. This integration promotes collaboration and streamlines the production pipeline, aligning with business needs for faster and more efficient software delivery. As organizations continue to prioritize adaptive software development, GitOps offers a pathway to enhance operational excellence by embedding governance within the development workflow, minimizing external dependencies, and expediting the path to production.

GitLab is rigorously testing its Geo feature at scale on GitLab.com to ensure it functions effectively for distributed teams by replicating data across geo-nodes, enhancing user experience regardless of location. This testing, conducted in the staging environment, is crucial for validating the feature's performance and reliability before deployment. Geo not only aims to improve data accessibility but also serves as a vital component in disaster recovery by providing data redundancy and failover capability. The testing process has revealed challenges, such as the complexity of installing Geo and inefficiencies in PostgreSQL queries, leading to ongoing improvements and bug fixes. The initiative has already benefited customers by easing the validation of Geo at scale and plans to further enhance its infrastructure with automated testing and high-availability configurations. This endeavor is poised to support a broader rollout of Geo for GitLab.com, aligning with their disaster recovery strategies and global data replication needs.

GitLab, a fully remote company, transitioned its board meetings to an all-remote format in April 2019, aligning them with its existing remote work practices to enhance participation and efficiency. This change eliminated the hybrid setup, which combined in-person and remote attendance, and facilitated easier access for board members, observers, and executives. The meetings are structured with a clear agenda, distributed a week in advance, to ensure time-efficient discussions rather than presentations. A moderator, often the chief of staff, manages the flow and timing of the meeting, while Zoom is used as the platform, with participants provided headsets for quality audio. GitLab emphasizes the importance of preparation, structured agendas, and having a dedicated moderator to maintain the meeting's pace and focus, offering these practices as a guide for other companies transitioning to remote board meetings.

GitHub's recent announcement of offering free private repositories with unlimited collaborators and a reduced price for their paid Team product to match GitLab's Bronze/Starter offering has sparked interest in the developer community. GitLab, which has always provided free private repositories as part of its Core/Free product, highlights its advantage by listing features like protected branches and draft pull requests that remain free, contrasting with GitHub's limitations on its Free plan. GitLab also underscores its value proposition by showcasing features available in its Bronze/Starter plan, such as code owners and multiple issue assignees, which they claim offer more than GitHub's Team plan. As GitLab continues to gain market share in the version control space, it encourages users to compare their DevOps platform with GitHub through the #GitChallenge, offering incentives for reviews posted on social media.

Git, an open-source source code management tool developed by Linus Torvalds, is renowned for its ability to handle collaborative software projects by tracking changes across multiple files without causing conflicts. Celebrating its 15th anniversary, Git's creation is attributed to Torvalds' desire to address common software development challenges and promote open source contributions, leading to its widespread adoption and the broader acceptance of the open-source movement. Although there are humorous legends about the name "Git," its functionality is likened to a time machine, allowing users to view and manage the entire history of changes without fear of causing irreparable damage. Torvalds, also known for creating the Linux kernel, views Git as potentially more significant over time, and he is credited as a key figure in the rise of open-source software, which was initially met with skepticism by many companies.

Laura Montemayor, a Frontend Engineer at GitLab, shares insights from her experience shadowing Site Reliability Engineers (SREs), highlighting the challenges and strategies of monitoring and incident management within the company. While SREs are tasked with maintaining the smooth operation of GitLab's user-facing services, Montemayor notes that the frequency of alerts does not necessarily correlate with incidents, as many alerts are warnings and not all become critical issues. She emphasizes the importance of communication, particularly in GitLab's all-remote, asynchronous environment, which ensures that help is always available across different time zones. The company uses a streamlined set of tools like GitLab issues, Slack, and Zoom for communication and incident resolution, and Montemayor appreciates the simplicity in tooling. Despite the noise from frequent alerts, the structured use of issues for documenting and analyzing incidents helps maintain stability and facilitates continuous improvement. The dynamic nature of monitoring is acknowledged, with GitLab's establishment of a Scalability team aimed at refining alert criteria and enhancing the SRE workflow to better manage the evolving challenges in the field.

In a discussion on open source software security, a report by Harvard University and the Linux Foundation highlights the risks associated with its widespread adoption, emphasizing the need for comprehensive security strategies. Mark Loveless, a senior security engineer at GitLab, shares insights into how GitLab addresses these challenges through transparency, dedicated security teams, and a commitment to DevSecOps—an approach that integrates security into rapid development cycles. GitLab's approach includes openly disclosing security vulnerabilities, even in non-core products, to maintain user trust and improve overall security. Loveless underscores the importance of implementation in mitigating vulnerabilities, as well as the need for upper management support and a culture that encourages security as an integral part of the development process, rather than a source of shame or punishment.

There is ongoing research to enhance the process of importing issues from Jira into GitLab, aimed at making it easier for users to transfer existing issues beyond current CSV export capabilities. The goal is to understand what would provide the most value and meet user expectations in this import process. Feedback is sought from a diverse group of users, including Systems Admins and DevOps Engineers, who might be responsible for facilitating the transition from Jira to GitLab, particularly through an API.

The text outlines the recent updates and contributions to a software package designed for managing Snowflake spend using Periscope and dbt. It highlights the addition of Snowflake's Query History Model and a restructuring to incorporate Sources, acknowledging contributors like @nehiljain, @m_walker, and @mpeychet_ for their roles in the release. Users of the package are encouraged to provide feedback and participate in its development by creating issues, emphasizing the community-driven nature of the project.

Celebrating Git's 15th anniversary, this text delves into various methods to enhance Git-based workflows, offering insights for both beginners and seasoned users. It highlights the importance of creating aliases for frequently used commands, utilizing git-prompt.sh for visualizing repository status, and leveraging git diff and difftool for commit comparisons. The article emphasizes efficient practices such as stashing uncommitted changes, frequently pulling updates to avoid conflicts, and using completion scripts for faster command execution. It also discusses setting up a global .gitignore, enabling autosquash for rebasing, and pruning stale branches during fetch/pull operations. Advanced tips include using Git blame with specific flags, creating aliases for checking out merge requests, and resetting files to previous states. Additionally, the text introduces plugins like git-open and git-extras to further augment Git's functionality. To commemorate the anniversary, a series of instructional videos by Brendan O'Leary is announced, covering key topics like rebasing, merging, and branching.

In response to the cancellation of the Contribute event, a virtual scavenger hunt was organized by the Customer Success team at GitLab as a team-building activity. The event was planned through a GitLab issue, and participants were asked to vote on a suitable weekend and join a dedicated Slack channel. The scavenger hunt, designed to be social distancing-friendly, consisted of 40 creative tasks that encouraged teamwork and ingenuity without requiring public outings. Participants were divided into 11 teams of two, considering time zones and unfamiliarity among members, with the hunt officially commencing at midnight in each participant's local timezone. Tasks varied, including taking specific photos and solving riddles, and points were awarded based on creativity and task completion, with a final enigmatic task worth extra points. Team "Candy Corn Skeleton" emerged victorious with 200 points, but the primary goal was to foster fun, camaraderie, and joy amidst challenging times. All participants received special edition GitLab stickers as a token of appreciation, and there is enthusiasm for organizing similar events in the future with greater automation and participation.

GitLab Incident Management aims to streamline and simplify the process of managing incidents by integrating incident response capabilities directly into the GitLab DevOps platform. This integration allows response teams to reduce context switching and manage incidents within the same tool used for development, improving efficiency and minimizing Mean Time to Recovery (MTTR). Key features include centralized incident issues for data capture, Slack integration for communication, Zoom call linkage, and embedding of GitLab-managed Kubernetes and Grafana metrics for real-time monitoring. Incident issues can be created manually or automatically from alerts, with customizable templates to ensure consistent information availability. The system also supports Prometheus recovery alerts to automatically close incidents, encouraging documentation of interactions for audit trails and retrospectives. GitLab continues to develop and enhance this functionality, encouraging user feedback to prioritize improvements.

GitLab's inaugural security trends report identifies six prevalent vulnerabilities in more than 5% of GitLab-hosted projects over a six-month period, aiming to provide biannual updates on these trends. The report, based on anonymized data from GitLab.com-hosted projects, highlights vulnerabilities such as components with known issues, cross-site scripting (XSS), inadequate secret management, and lack of content security protection (CSP), which have seen significant increases, while cross-site request forgery (CSRF) and SQL injection (SQLi) have decreased. GitLab leverages various scanning tools, such as SAST, DAST, dependency, and container scanning, to identify these vulnerabilities early in the CI/CD process, allowing developers to address security risks before deployment. The report emphasizes best practices for mitigating these vulnerabilities, such as regularly updating dependencies, implementing CSP, using CSRF tokens, and employing parameterized queries for SQL. By shifting security left in the development lifecycle, GitLab aims to enhance application security, improve developer productivity, and foster a proactive approach to threat mitigation.

GitLab designers navigate remote work by fostering intentional and synchronous collaboration across global time zones while maintaining asynchronous communication as a core value. They utilize structured pairings, regular one-on-one meetings, and larger team syncs to facilitate both design-specific feedback and broader project alignment. Tools like Zoom and collaborative platforms such as Mural and Google Docs are essential for maintaining communication and facilitating design review and feedback sessions. The team prioritizes relationship-building with Product Managers and Engineers through scheduled syncs, emphasizing the importance of visual collaboration and shared agendas. They also integrate user insights with the UX Research team to enhance product development, employing both synchronous and asynchronous methods for comprehensive research synthesis. GitLab's approach balances the benefits of both types of communication, allowing for flexibility, inclusivity, and a strong sense of community among designers, evidenced by their creative use of digital spaces to express personal and professional identities.