February 2021 Summaries

Lauren, commonly known as Barker, reflects on her transformative experience in GitLab's CEO Shadow program, which required her to step away from her role as a Full Stack Engineer to observe the daily workings of Sid, GitLab's CEO. Initially finding the shift challenging due to her comfort with coding and routine, she gradually adapted and learned to appreciate new processes, experiencing firsthand how GitLab's strategic directions are communicated internally and externally. The program highlighted the importance of stepping out of comfort zones, trying new tools like Visual Studio, and embracing different forms of communication, such as writing instead of video content. Through Sid's meetings, she observed a leadership style characterized by compassion, respect, transparency, and a clear vision for GitLab's future. This program not only enhanced her professional understanding of GitLab’s strategic direction but also inspired personal growth, leaving her excited to return to her role with renewed enthusiasm for contributing to GitLab’s ongoing success as a leading DevOps platform.

GKE Autopilot, a managed Kubernetes service by Google Cloud, addresses the challenge of appropriate node sizing by automatically provisioning nodes based on workload requirements, eliminating the need for manual management. This service facilitates seamless integration with GitLab, allowing users to install GitLab and GitLab Runners on GKE Autopilot clusters using official Helm Charts, while leveraging Google Cloud Workload Identity for resource access. Despite its advantages, GKE Autopilot is less configurable than GKE Standard, lacking support for certain node-level features and administrative access. It is designed to streamline operations by implementing Google Cloud's best practices, enabling users to focus on application delivery and scaling without operational concerns. However, there are limitations, such as the inability to use Docker in Docker or privileged pods, and restrictions on certain configurations like node selectors and cert-manager installations.

The Five Minute Production App, developed by Sri Rangan and GitLab co-founder DZ, offers a streamlined approach to achieving production-grade infrastructure and DevSecOps in under five minutes by leveraging AWS, Hashicorp Terraform, and GitLab. This application facilitates the rapid deployment of web applications by integrating a seamless GitOps workflow, where infrastructure as code, CI/CD pipelines, and application code coexist within a GitLab project. The process involves three key stages: the Build stage, where web applications are packaged as container images using GitLab's Auto DevOps pipeline; the Provision stage, where Terraform scripts provision secure AWS infrastructure resources like EC2 VMs, PostgreSQL databases, and Redis clusters; and the Deploy stage, which retrieves and deploys the application package, configuring SSL certificates using Letsencrypt. By tying infrastructure resources to Git branching workflows, the app supports both long-lived and short-lived environments, offering scalability and flexibility for developers. This solution exemplifies a comprehensive GitOps model, positioning the GitLab project as a single source of truth for application source code, infrastructure definitions, CI/CD pipelines, and environment configurations.

GitLab utilizes a maturity rating system to evaluate the readiness of its product categories, declaring its Continuous Integration (CI) capabilities as "Lovable" in 2017 due to its leadership in feature functionality. However, recent research through interviews and data collection revealed that while GitLab is widely appreciated by developers for enhancing job satisfaction, it faces challenges with delivering polished features for enterprise clients and managing visibility of job performance at scale. Enterprises demand comprehensive solutions with minimal tolerance for experimentation, highlighting the need for GitLab to improve its offerings. The company plans to address these issues by focusing on improving artifacts and variables in its CI processes and enhancing visibility for diagnosing job performance to future-proof its services and maintain its competitive edge in the Verify stage.

GitLab introduced the Pipeline Editor in version 13.8 as a dedicated tool for authoring CI/CD pipelines, addressing the complexity of GitLab's advanced syntax by consolidating all CI authoring features into one location. The editor facilitates the creation and validation of pipeline configurations through features like continuous validation using linting APIs and a visualization tab that outlines the pipeline's structure before execution. Users start by creating a .gitlab-ci.yml file, which the editor helps simplify by merging 'include' and 'extends' configurations for better readability and debugging. This development emerged from GitLab's strategic decision to separate continuous integration into distinct teams, with the Pipeline Authoring team focusing on enhancing the authoring experience for both advanced and novice users. The Pipeline Editor aims to streamline the CI/CD process, making it accessible and efficient, and GitLab encourages user feedback to inform future enhancements.

The GitLab Agent for Kubernetes establishes a secure connection between a GitLab instance and a Kubernetes cluster, facilitating pull-based deployments and offering enhanced network security alerts. Initially released for self-managed GitLab instances, the Agent is now available on GitLab SaaS with plans for further feature expansions. It addresses previous security concerns by allowing more controlled access rights, thereby appealing to security-focused users and experienced engineers. The Agent operates through two components: agentk, the cluster-side component, and kas, the GitLab server-side component, ensuring minimal impact on cluster resources and maintaining a secure, persistent connection. It supports GitOps workflows by automatically syncing GitLab repositories with cluster resources and is built on the gitops-engine, sharing codebase elements with ArgoCD. While currently supporting pull-based deployments, future developments aim to integrate with GitLab CI for push-based deployment support. The integration with Cilium in GitLab 13.9 enables easy generation and display of network policy alerts. Ongoing efforts focus on making the Agent generally available on GitLab.com SaaS and enhancing its integration capabilities for improved usability and performance.

GitLab's Learning & Development team undertook the significant task of creating a management training program in FY21 to equip managers with skills for remote leadership and management best practices, due to the company's rapid growth. The program, called the Manager Challenge, was developed after a thorough learning needs analysis involving various stakeholders from the company to identify skill gaps and management needs, emphasizing foundational management skills for recently promoted leaders. Designed to fit GitLab's fast-paced culture, the program featured daily asynchronous learning activities and weekly live sessions, allowing managers to learn at their own pace and engage in social learning during live discussions. The training utilized GitLab's own platform to facilitate learning, promote transparency, and enable managers to learn from each other. Supported by executive reviews, the program incorporated key principles from Andrew Grove's book, "High Output Management," and GitLab's core values. The iterative approach allowed for continuous feedback and improvements, leading to a three-week blended learning program that included leadership assessments, networking, and digital learning, ultimately receiving positive feedback from participants for its practical resources and emphasis on remote management excellence.

GitLab's Dependency Scanning tool, which uses the GitLab Vulnerability Database for the latest advisory data, experienced a bug affecting versions between v2.8.1 and v2.28.0 of the gemnasium analyzer, resulting in outdated scan results as the vulnerability database was not updating at scan time. This issue impacted advisories identified only up to the release date of the analyzer image, potentially leaving users with outdated security information for several weeks. While most customers will automatically receive a fix and update to the latest advisory database, users with customized setups or specific pull policies may need to manually update their docker images to a non-affected version. The specific analyzers affected include gemnasium, gemnasium-python, and gemnasium-maven, with updates required to versions v2.28.1, v2.17.3, and v2.20.4, respectively, to ensure that Dependency Scanning jobs are synchronized with the most recent advisories.

A vulnerability in GitLab's CI system exposed masked CI variables during specific periods in February 2023, affecting users who ran pipelines with certain runner versions. The issue primarily impacted users on GitLab.com using shared runners and self-managed customers who deployed runner version 13.9.0-rc1. The vulnerability allowed masked variables to be printed in build logs, compromising their secrecy. GitLab recommends affected users review their jobs for printed variables and rotate any exposed secrets, with specific guidance for both GitLab.com and self-managed users about upgrading or downgrading their runner versions. The company has communicated directly with potentially affected users via email and advises users to subscribe to security alerts for future updates.

GitLab's efficiency can be significantly enhanced through the use of quick actions, as demonstrated by two GitLab team members, Roman, an engineering manager, and Michael, a developer evangelist. Roman uses quick actions for capacity planning, creating issues, assigning tasks, and organizing epics, all while staying within the text box and enhancing workflow speed. Michael focuses on coding tasks, using quick actions for managing merge requests, assigning reviewers, rebasing branches, and ultimately merging code changes efficiently. Both emphasize the benefits of integrating quick actions into description templates, which streamline processes by automatically setting labels and assignees. GitLab's quick actions allow users to efficiently complete tasks without manual intervention, optimizing project management and development workflows. The blog post also invites users to explore other quick actions and share how these tools improve productivity.

The Crucial Conversations training, attended by a member of GitLab's Learning and Development team, aims to equip team members with the skills needed to navigate difficult discussions effectively, especially in a remote work environment. These conversations, which can arise unexpectedly or be planned, typically address issues of content, patterns, or relationships, and are not synonymous with conflict but rather focus on collaboration to reach desired outcomes. The training emphasizes the importance of psychological safety and open communication, encouraging the use of strategies like regular 1:1 meetings, clear agendas, and attention to non-verbal cues to foster trust even in virtual settings. Crucial conversations align with GitLab's CREDIT values by prioritizing results and enhancing team dynamics, ultimately contributing to individual and organizational success. The training prepares team members to handle these interactions constructively, ensuring quality work and reducing stress, and it is set to be integrated into GitLab's internal development programs.

GitLab emphasizes the importance of giving and receiving feedback as a means of personal and organizational growth, advocating for kindness and Radical Candor to alleviate fears of damaging relationships or causing discomfort. The company employs the Situation-Behavior-Impact (S-B-I) Model to structure effective feedback, which involves clearly defining the context, describing the observable behavior, and explaining the impact of the behavior on others. As a global, all-remote company, GitLab acknowledges cultural differences and individual preferences in feedback exchange, promoting a Cross-Cultural Collaboration Guide to enhance understanding and communication. Strategies such as avoiding interruptions, asking clarifying questions, enforcing a no-retaliation policy, and following up are recommended to foster an environment conducive to constructive feedback. Additionally, GitLab leaders, including CEO Sid Sijbrandij, actively engage in discussions about feedback through live-streamed Q&A sessions to further support this culture.

Kali Linux, a Debian-based distribution for penetration testing and security auditing, transitioned to GitLab in April 2019 to enhance community contributions and streamline its tool stack. The move from Gitolite to GitLab was driven by GitLab's comprehensive DevOps capabilities, feature-rich API, and open-source nature, enabling improved automation, project management, and security features. This transition allowed the Kali team to fully automate workflows and efficiently manage 564 active repositories while encouraging public contributions and simplifying infrastructure maintenance. GitLab's user-friendly interface and project management tools have facilitated increased community engagement, with initiatives like the "Kali Summer of Code" aimed at boosting contributions. Challenges during the migration included importing numerous repositories and reconfiguring tools, but these were mitigated through automation and careful planning. The Kali Linux team values GitLab's open-source ethos and transparency and advises other open-source communities to consider GitLab for its robust feature set and ease of maintenance. Future plans for Kali include utilizing GitLab Pages for their website, launching KaBoxer for container management, and enhancing community involvement.

As the professional world increasingly accepts hybrid-remote work as the new norm, companies must navigate the complexities of this model to avoid potential pitfalls like a two-tier work environment. Key considerations include maintaining flexibility in living arrangements by minimizing mandatory office days, ensuring that informal meetings are documented to prevent miscommunication, and redesigning office spaces to support remote-first collaboration. Leaders should foster an environment where remote and onsite employees have equitable access to benefits and social interactions while prioritizing transparency and documentation of all work-related conversations. Moreover, it is crucial for executives to model remote-first practices to prevent inconsistencies and reinforce that the office is not the center of power. As organizations embrace hybrid work, they may experience changes like reduced office use, which can signify successful adaptation to remote-first workflows and present opportunities for real estate savings or community engagement.

GitLab's design system, Pajamas, has significantly evolved since its inception, helping streamline workflows for its UX department, which has grown to over 60 designers, researchers, and tech writers. Initially a basic framework, Pajamas now encompasses design principles, guidelines, accessibility audits, and live-coded components, enabling efficient collaboration among product designers, engineers, and product managers. The system's maturity has led to increased utility in daily tasks, with designers spending more time on problem-solving rather than fielding questions, thanks to comprehensive documentation and robust components. Surveys conducted in 2018 and more recently highlight the system's impact on efficiency and autonomy, noting that designers now devote a larger portion of their time to tackling real user issues. Although Pajamas has made considerable progress, GitLab acknowledges ongoing opportunities for enhancement, aiming to further support cross-functional product teams and improve engineering and product workflows.

In February 2021, the UX department focused on several initiatives to improve user experience and efficiency in GitLab. These included simplifying the configuration of API fuzzing scanners by generating code snippets for easier integration into .yaml files, and enhancing visibility into the GitLab Agent for Kubernetes by offering a detailed activity page to help troubleshoot deployments. Efforts were made to improve in-page search for settings, streamline the process for managing vulnerabilities with required comments and threaded discussions, and prioritize compliance violations by assigning severity levels. Additionally, the team aimed to make it easier for new users to adopt CI/CD by introducing templates, simplify SaaS purchase flows by integrating them directly into GitLab, and enhance feature flag management by validating them as an issue type. Other improvements included better messaging for managing merge requests in the merge train and addressing UX issues in the merging process to expedite shipping.

Focusing on minor refinements, often overlooked in favor of larger feature improvements, can significantly enhance user experience, as demonstrated by the GitLab UI Polish Gallery created by Nicolas Dular. This gallery showcases small but impactful contributions like adjustments in alignment, spacing, and type scale, highlighting the collective effort of developers, designers, and the GitLab community in refining the product. Examples include improvements to the Jira Connect app by Libor Vanc and Justin Ho, alignment fixes in the merge request widget by Pedro Moreira da Silva and Jacques Erasmus, and subtle vertical alignment corrections in card headers by Annabel Dunstone Gray and Paul Gascou Vaillancourt. These changes, though minor, cumulatively contribute to a more seamless and visually coherent user experience, underscoring the importance of attention to detail in software development.

GitLab emphasizes the importance of well-crafted documentation for its DevOps platform, recognizing it as essential for aiding users in efficiently utilizing its comprehensive tools and features. Over the past year, GitLab has undertaken a significant effort to improve its documentation by assessing the vast content available on its site and conducting user research, which revealed issues with usability and information discoverability despite the perceived usefulness of the content by 96% of participants. This has led to an ongoing process of refining their documentation, starting with a major homepage redesign to enhance search functionality, simplify design, and align navigation with accessibility standards. They have also been updating their type scale for better readability, improving the visual presentation of alert boxes, enhancing topic scanning through better use of fonts and white space, and reducing visual noise in images. GitLab continues to pursue further improvements based on user feedback, guided by a Documentation Roadmap that outlines future back- and front-end changes to enhance the documentation experience.

In a discussion on enhancing remote work practices, GitLab shares insights on transitioning from traditional synchronous communication to more efficient asynchronous methods, which have proven beneficial for maintaining work-life balance and delivering business value. The challenges of coordinating across time zones are addressed by recommendations such as varying meeting times and ensuring all team members feel included. GitLab emphasizes the importance of structured meetings with agendas, notes, and optional attendance, alongside maintaining a sense of community through tools like Slack for recognition and social interaction. A six-step framework for empathetic onboarding is presented, focusing on relationships, documentation, and feedback. Additionally, strategies for releasing software remotely and fostering team spirit are highlighted, including leveraging tools like Jira and informal communication programs such as coffee chats and Slack channels. To support managers in adapting to remote work, GitLab offers a free Coursera course packed with strategies for effective team management in a distributed environment.

GitLab recently concluded another successful hackathon, celebrating significant community contributions despite initial scheduling changes and a bug in their metrics platform that required a post-release update on participation metrics. Participants submitted 167 Merge Requests (MRs), with 139 already merged across various projects, including GitLab and Omnibus. The event featured tutorial sessions on different GitLab products, available on GitLab's YouTube channel, and saw notable participation from the Tokyo community, led by Core Team member Takuya Noguchi. Prizes were awarded to contributors with the most MRs merged, with Kev and Jonston Chan each receiving the grand prize for their outstanding contributions. The next GitLab hackathon is scheduled for March 31st to April 1st, 2021, with detailed information to be provided on the Hackathon page by March 1st.

During the 14.0 release, the Composition Analysis group, part of the Secure stage, will implement both deprecations and removals related to the Dependency Scanning and License Compliance features. Users affected by these changes should take necessary actions. The License-Management CI template, deprecated in version 13.0 and renamed to License-Scanning, will be removed in 14.0, with more details available in issue #216261. For Dependency Scanning, users who utilize a subset of analyzers must switch to using DS_EXCLUDED_ANALYZERS in version 14.0 instead of the current DS_DEFAULT_ANALYZERS, which required listing every analyzer to be run. The new DS_EXCLUDED_ANALYZERS will allow users to specify which analyzers to skip, addressing the limitation of DS_DEFAULT_ANALYZERS that did not automatically include new analyzers added to GitLab. More information on this change can be found in the relevant issue documentation.

This post outlines a success story of managing a simple news portal using GitLab CI/CD for deploying HTML files to Amazon S3, demonstrating how to implement continuous integration and deployment processes in a technology-agnostic manner. It begins with automating the deployment of static HTML files using GitLab CI, emphasizing the importance of setting environment variables securely and using Docker images for dependencies like awscli. As the fictional scenario evolves with a growing team, it discusses best practices for handling multiple developers, such as creating separate branches for development and using GitLab Pages for staging environments to preview changes before merging. The narrative progresses to handling larger teams by introducing Review Apps for per-branch deployment, integrating Slack for deployment notifications, and transitioning to manual production deployments to handle emergencies. Finally, it suggests using the dpl gem for deploying to various platforms, showcasing how GitLab CI/CD can maintain a uniform deployment process across different systems while ensuring secure and efficient management of secret keys and deployment histories.

As remote work becomes more prevalent, pair programming is highlighted as an effective collaborative method that translates well to remote settings. This practice involves two developers working together, with one acting as the driver who writes the code and the other as the navigator who reviews and guides the process. The article emphasizes the social and professional benefits of pair programming, such as improved problem-solving, knowledge sharing, and enhanced code quality through the "four-eyes principle." Support engineers at GitLab illustrate how pair programming helps in tackling complex issues and improving user experience by pooling diverse expertise and perspectives. Remote pair programming is considered advantageous due to tools like screen sharing, which offer better visibility and control than in-person interactions. The article also provides tips for effective remote pair programming, including having a clear agenda, tackling one issue at a time, and the importance of open communication. At GitLab, both scheduled and ad hoc pairing sessions are encouraged to maintain team connectivity and problem-solving efficiency.

Ruby 3.0 introduced changes separating positional and keyword arguments, and in preparation for this, GitLab aimed to upgrade from Ruby 2.6 to 2.7, encountering thousands of warnings due to deprecated syntax. To address these, GitLab initially applied a manual fix, adding '**' to last keyword arguments, and developed a RuboCop check to automate the detection and correction of these warnings. After researching, they utilized the Deprecation Toolkit gem, integrated with their RSpec test suite, to log and manage deprecation warnings efficiently. A new RuboCop check, Lint/LastKeywordArgument, was created to work with the generated YAML files, allowing them to automatically correct the codebase and significantly reduce the number of warnings. This process was further automated by integrating into GitLab CI pipelines, resulting in a reduction from 30,000 warnings to around 800, primarily due to dependencies. GitLab continues to address the remaining warnings and invites contributions to resolve them fully.