June 2020 Summaries

Multicloud is a term with varied interpretations across the tech industry, generally referring to the use of multiple cloud providers such as AWS, Azure, and Google Cloud, either by deploying different applications on different platforms or by enabling easy migration of applications across them. A 2020 survey revealed that while many organizations are still in the early stages of multicloud adoption, often using a single cloud provider, some companies are exploring more advanced multicloud strategies to avoid vendor lock-in and enhance flexibility. The concept is not static but rather a progression through stages of maturity, from using a single cloud to achieving true data portability and workload distribution across multiple clouds, which requires significant engineering resources. While the goal of seamless multicloud operations offers potential benefits such as cost leverage and backup coverage, it also presents challenges, including increased complexity and resource demands. As DevOps practices evolve, the definition of multicloud continues to adapt, with organizations encouraged to weigh the trade-offs and implement a level of multicloud that aligns with their specific needs and capabilities.

KDE, an international community known for creating open-source software across various platforms, has completed the first phase of its migration to GitLab, a move initiated to enhance the onboarding experience for new contributors and improve collaboration within its vast ecosystem of over 2,600 projects. This transition aims to simplify the contributors' journey by leveraging GitLab’s familiar interface and robust support, thus enabling easier participation in software testing and delivery. The migration involved careful planning, including forming a migration team, evaluating GitLab's features, and running test cycles with smaller teams before scaling to larger ones. Despite challenges such as managing over 1,000 repositories and integrating existing tools, KDE utilized custom tools for efficient bulk updates and maintained strict access policies. The community's involvement was crucial throughout the process, ensuring transparency and consensus. Moving to GitLab aligns with KDE's goals of streamlined onboarding and scalability, and the use of GitLab's Community Edition underscores their commitment to open source. The collaboration with GitLab has been positive, with mutual benefits through the GitLab for Open Source program. As the migration continues, KDE remains open to new contributors and actively encourages participation in its diverse community.

Participating in the Monitor:Health group's SRE shadow program provides valuable insights into the daily operations and decision-making processes of Site Reliability Engineers, which is crucial for developing effective Incident Management tools at GitLab. Initially skeptical, the author found the experience enlightening, gaining a deeper understanding of infrastructure management, such as the importance of proactive resource planning and effective responses to incidents. The experience highlighted the interconnectedness of systems, the strategic allocation of resources like CPUs, and the critical role visualization tools play in incident prediction and management. It was revealed that most incidents are reported internally rather than by customers, emphasizing the proactive nature of SRE work, which includes not just incident response but also the continuous development and support of GitLab's infrastructure. This experience reassured the author of the reliability of GitLab's infrastructure, thanks to the proficient handling by SREs.

GitLab's GPG key used for signing Omnibus packages, initially set to expire on July 1, 2020, has had its expiration extended to July 1, 2021, as part of GitLab's security practices to minimize risk in case of key compromise. Users who verify package signatures must update their copy of the signing key, though most users will not need to take any action unless they have configured their package manager to verify these signatures. Information on verifying package signatures is available in the Omnibus documentation, and the public key can be refreshed from GPG keyservers or directly downloaded from GitLab's package repository. If issues arise, users are advised to open an issue in the omnibus-gitlab issue tracker for assistance.

GitLab, a Ruby-on-Rails application, utilizes Sidekiq, a background-processing framework for Ruby, to handle asynchronous data processing efficiently. Initially, GitLab faced challenges with queue management, leading to incidents in 2019 that necessitated a restructuring of the Sidekiq job and role relationship to improve scalability and performance. This involved transitioning from a many-to-many to a one-to-one relationship between jobs and roles, allowing for more efficient use of resources and reducing job processing delays. Additionally, GitLab implemented queue selectors to classify and manage workloads, improving processing predictability and resource allocation. A significant reduction in Sidekiq nodes and CPUs resulted in cost savings and better resource utilization. The adoption of Sidekiq Cluster as a default and compatibility with Kubernetes further enhanced infrastructure management, setting the stage for future optimizations in queue management and resource scaling.

GitLab emphasizes its commitment to security and transparency by pursuing various programs and accreditations to assure customers of its security posture. As a rapidly expanding company, GitLab provides information on its security maturity through SOC 2 reports, with a SOC 2 Type 2 attestation received in 2021 after undergoing a Type 1 audit. Customers can access these reports under specific confidentiality agreements, while the Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CAIQ) is publicly available without such agreements. The GitLab Control Framework outlines prioritized security controls for compliance with standards like PCI, SOX, and SOC 2, covering areas such as asset management, incident response, and risk management. GitLab is a Level 4 merchant under PCI compliance, requiring an annual self-attestation questionnaire and quarterly scans. The company continues to iterate and improve its security controls, aligning them with industry standards to enhance the transparency and effectiveness of its security program.

DevSecOps is a methodology that integrates security practices within the DevOps process, aiming to address the challenges of security in rapidly accelerating software release cycles. The approach emphasizes "shifting left," which involves incorporating security measures early in the software development lifecycle (SDLC) to prevent vulnerabilities and improve code quality. Despite ongoing changes in security roles, with more professionals becoming part of cross-functional teams and focusing on compliance, security testing often occurs too late, leading to friction between development and security teams. Collaboration and clear communication are crucial, as they can reduce inefficiencies and enhance the visibility of security measures. The integration of tools like static application security testing (SAST) into developers' workflows is essential for proactive security management. Effective DevSecOps practices require organizations to not only use automated security tools but also foster a culture where security is a shared responsibility, ensuring all team members are equipped with the necessary resources and understanding to maintain robust security protocols.

GitLab recently celebrated surpassing 3,000 community contributors, marking a milestone in its growth despite challenges posed by the COVID-19 pandemic. The pandemic initially caused a decline in contributions, but the community quickly rebounded, as demonstrated by a surge of merge requests during a recent Hackathon. The GitLab community's strength lies not only in the number of contributions but also in the valuable feedback and insights provided by its members, which help improve the product. The community's expansion is further evidenced by the addition of new members to the GitLab Core Team, including Lee Tickett, known for his active participation and assistance on Gitter, and Natalia Tepluhina, the first female member and an experienced contributor to Vue.js and other open-source projects. GitLab encourages new contributors to join by providing resources on how to contribute to various aspects of the project, such as code, documentation, and UX design.

GitLab announced changes to its platform, effective June 22, 2020, aimed at improving performance and reliability by adjusting the retention and expiration policies for job artifacts and metadata. New job artifacts will default to a 30-day expiration period, while existing artifacts created after October 22, 2019, will expire one year from their creation date, and those created before this date will expire by April 22, 2021. Additionally, job data older than 12 months will be archived starting June 22, 2020, with the archiving period reducing to 3 months by September 22, 2020. These adjustments aim to reduce storage use and operational costs, offering users an enhanced experience on GitLab.com. Users can override the default expiration settings using the 'expire_in' keyword if they wish to retain their artifacts for longer periods.

GitLab has introduced a new notification feature that alerts users when a pipeline has been fixed, in addition to the existing notifications for pipeline failures. This innovation aims to save developers time by reducing the need for constant monitoring of pipeline statuses. The feature is being gradually rolled out during a testing phase, during which users will begin receiving these notifications. Users can customize their notification settings, either for specific projects or globally, to disable the fixed pipeline alerts if desired. If the testing phase proves successful, the feature will be enabled by default, although users will retain the option to turn off the notifications if they find them unnecessary.

The GitLab Education Program invites students, professors, and researchers to apply for the GitLab Student Spotlights, a platform designed to showcase projects utilizing GitLab for educational purposes. Since its inception in 2018, the program has provided free Gold subscriptions and Ultimate licenses to over 800 educational institutions, engaging over 1.6 million participants globally. The Student Spotlights aim to highlight innovative projects through video-recorded interviews, which will be featured on GitLab’s YouTube channel and main education webpage, with the goal of inspiring others and fostering connections within the education community. Eligible participants include those using GitLab for hosting blogs, managing projects, or any creative educational application, and can apply via a Google Form, with selected projects receiving an interview hosted by GitLab representatives.

GitLab has developed Pajamas, its living design system, to streamline operations by creating a unified visual language and documentation that spans various departments and teams. A design system is a comprehensive set of guidelines and documentation that includes design practices and frontend coding standards, allowing for the reuse of styles and components across products. The benefits of such systems include increased efficiency, consistency, and improved communication, as they enable product designers and engineers to work more effectively, maintain consistent user interfaces, and align on project goals. However, integrating a design system into an organization presents challenges, such as the need for upfront planning and securing executive buy-in. GitLab is exploring ways to assist other organizations in developing their own design systems and is seeking community feedback on their experiences and challenges in implementing these systems.

The blog post reflects on the significance of feedback, particularly within the context of software development at GitLab, emphasizing the value of effective code reviews. It underscores the importance of self-reviews and anticipates potential concerns before assigning merge requests (MRs) to reviewers, aiming to maintain a balance between delivery speed and feedback quality. The post introduces the concept of conventional comments to enhance communication during reviews, advocating for empathy and clarity by distinguishing between blocking and non-blocking suggestions. It also highlights the use of patch files to signify collaboration and commitment in the review process. Additionally, the post explores the theme of fairness in reviews and suggests strategies to manage large merge requests by promoting iteration and follow-ups. The inclusion of nonverbal communication tools like GIFs is encouraged to foster a positive review environment. Overall, the post aims to acknowledge the efforts of GitLab contributors and provide practical advice for refining the code review process.

In the CI/CD sub-department at GitLab, efforts are focused on enhancing collaboration among internal teams such as Design, Product, Writing, Quality, and Engineering to improve the product process. Key strategies include understanding the problem early, involving all team members in defining and solving issues, and leveraging each person's expertise while ensuring collective support. Product Managers should clarify priorities but not solely drive product advancement, as every team member is seen as a manager of one, contributing actively. This approach fosters trust, encourages thorough analysis, and enables the team to achieve more collectively than individually.

The Ecosystem group at GitLab is responsible for the Pajamas Design System and the GitLab Development Kit, supporting contributors in various development tasks. Recent updates include enhancements to Pajamas with semantic releases and conventional commits, updates to the component status table, and initial usage guidelines for Progress Bars and File Uploaders. GitLab UI saw the introduction of UX Reviewers, new markdown typescale features, and various component updates, alongside efforts to improve documentation aesthetics. Figma migration involved transitioning from Sketch to the Pajamas UI Kit, while new icons were added to GitLab SVG. The GitLab Development Kit (GDK) introduced a quiet mode and improved Ruby gem checks, alongside documentation restructuring for better navigation. Additional improvements include automatic YARD documentation generation, new commands for troubleshooting GDK errors, and various CI enhancements, such as making CI jobs interruptible and implementing JSON logging in Sidekiq.