April 2021 Summaries

The blog post discusses the evolution of GitLab's Growth team's approach to software development, highlighting the importance of iterative experimentation. Initially, the team struggled with predicting timelines and implementing experiments effectively, as seen in the "Suggest a pipeline" project. This experiment, aimed at guiding users through setting up a CI/CD pipeline, was more complex and time-consuming than anticipated. The team learned that smaller, iterative changes, or minimal viable changes (MVCs), could have expedited the process and improved outcomes. By embracing MVCs, the team realized they could deliver value faster, decrease risks, and learn from early iterations to optimize solutions. The post also describes how learnings from the pipeline experiment informed the design of the "invite members" experiment, where a painted door test was used to validate user interest before investing in full development. This iterative approach helps mitigate risks and ensures that development efforts align with user needs and GitLab's growth objectives.

In early 2020, replicating a new data type in GitLab's Geo system took 3.5 months, but by implementing a new framework, the process was reduced to one month. Geo, a solution for distributed development teams, replicates GitLab instances to local, read-only ones for disaster recovery and faster data access. To address challenges with supporting various data types, GitLab introduced a new replication and verification framework that reduces code duplication and allows engineers, even those outside the Geo team, to efficiently add new data types. This framework uses a Replicator class and strategies to simplify the process, resulting in increased reliability and maintainability. The changes led to significant improvements, with Geo now supporting and verifying a higher percentage of data types more quickly, and the framework has already paid for itself in time savings. Looking forward, existing data types will be migrated to the framework, and new features will be added more efficiently, further reducing duplication.

GitLab's recent update to Puma version 5, a multi-threaded Rack application server for the Ruby platform, introduced features like nakayoshi_fork and heap compaction to improve memory management by reducing fragmentation. The nakayoshi_fork feature leverages tenuring objects and compaction to optimize memory usage, with Ruby's GC.compact method compacting the heap to reclaim unused memory. However, when GitLab deployed these changes, they encountered production issues due to a segmentation fault caused by Hamlit's C-extension, which was not compaction-aware. This incident underscored the challenges of updating large applications with memory optimization techniques, highlighting the need for more reliable detection of compaction issues in CI environments and improved system configuration rollout capabilities. As a result, GitLab decided against using heap compaction in production until its benefits outweigh the associated risks.

The Solarwinds supply chain attack has heightened concerns over software development security, particularly within DevOps and cloud-native applications, as traditional application security (AppSec) tools struggle to integrate effectively with modern DevOps practices. This challenge underscores the importance of embedding security directly into the development process, a concept known as DevSecOps, which aims to ensure security is considered throughout all DevOps practices. GitLab, recognized for its leadership in source code management (SCM) and continuous integration (CI), enhances application security by incorporating security features into its DevOps platform, offering comprehensive scanning, policy automation, and infrastructure protection. The platform facilitates end-to-end visibility, policy consistency, and more intelligent responses to security threats, positioning itself as a viable solution for the growing demands of software supply chain security. As the need for robust security measures becomes a point of national concern, guidelines from organizations like NIST and the CNCF seek to provide frameworks for integrating security into DevOps. Despite these advancements, no single tool can guarantee complete protection, emphasizing the need for a Defense-in-Depth strategy that leverages a DevSecOps platform to streamline efforts, enhance visibility, and apply consistent security controls.

GitOps, initially emerging from the Kubernetes community to enhance the speed and efficiency of Ops teams, is increasingly favored for infrastructure automation due to its improved automation and reduced risk attributes. GitLab's approach to GitOps extends beyond Kubernetes, applying its principles to various infrastructure types such as physical servers, virtual machines, and containers. It supports both push-based and pull-based GitOps methods, with the former utilizing CI/CD tools to apply changes across diverse environments and the latter requiring a Kubernetes agent to manage configurations within Kubernetes clusters. GitLab offers integrations with tools like Terraform to streamline GitOps workflows, and its Kubernetes agent enables secure management of infrastructure changes. GitOps principles in GitLab cater to different environments and deployment targets, reflecting an understanding of the mixed IT landscapes prevalent in organizations.

In early 2020, as COVID-19 began spreading globally, the author planned to visit family in New Zealand later that year, unaware that international borders would soon close, complicating travel plans. While Germany initially managed the pandemic well, by October, a second wave led to renewed lockdowns, whereas New Zealand maintained strict quarantine measures. Health concerns for grandparents motivated the author to seek a quarantine slot and make the journey from Berlin, supported by a manager at GitLab who facilitated the transition with understanding and flexibility. Successfully traveling to New Zealand in February 2021 allowed the author to reconnect with family and friends, participate in large public events, and enjoy life in a COVID-free environment. This experience highlighted the company's commitment to its values, placing family and personal well-being above work, and left the author feeling grateful for their circumstances.

JSON linting is a process that involves checking and analyzing JSON code for errors, enhancing its quality and readability, and ensuring its compatibility across various browsers and applications. JSON, a human-readable format for structured data, is widely used for data exchange in web applications due to its simplicity and efficiency over XML. Linting tools play a crucial role in identifying and correcting errors in JSON code, such as parsing issues, incorrect data types, and structural inconsistencies, thereby streamlining development processes and reducing costs. Common errors include unexpected characters during parsing and incorrect data formats, which can be addressed by ensuring proper syntax and file extensions. To further improve JSON code quality, best practices such as using double quotes for key-value pairs, avoiding hyphens in key fields, and creating root elements are recommended. Additionally, tools like curl and jq can be utilized for parsing and validating JSON data, enabling efficient data manipulation and filtering, which is especially useful in handling API responses and automating tasks like CI/CD YAML validation.

GitLab has expanded its learning and certification offerings through GitLab Learn, providing resources for both GitLab team members and the broader community. These offerings include free certification pathways like GitLab 101 and 201, Diversity, Inclusion, and Belonging training, and several technical certifications focused on areas such as CI/CD, security, and project management. GitLab has also introduced a self-service, asynchronous learning option for the GitLab Certified Associate certification, priced at $650, which includes a self-study course, a knowledge exam, and a hands-on exam in a GitLab sandbox environment. The recent promotion of these certifications received an enthusiastic response, quickly reaching the user limit for a discount code. GitLab Learn encourages users to create accounts to stay updated on future offerings and provides guidance for enrolling in courses, highlighting the use of Google Chrome and the Edcast mobile app for an optimal experience.

GitLab's involvement in the Outreachy technology internships program underscores its commitment to fostering diversity and inclusion within the open source community by providing opportunities for women and underrepresented groups. Outreachy, initially launched as the Open Source Program for Women at GNOME, has evolved into a global initiative offering internships in programming, user experience, documentation, and more, allowing participants to work with mentors from prominent FOSS communities. GitLab sponsors Outreachy internships, specifically within the Git project, to empower individuals like Charvi Mendiratta and Joey Salazar, who have utilized this opportunity to enhance their technical skills and gain valuable industry experience. This initiative aligns with GitLab's broader mission to support underrepresented groups in tech and cultivate a diverse workforce, further exemplified by its participation in Google Summer of Code and its own engineering internship program. Through these efforts, GitLab aims to encourage more tech organizations to join as corporate sponsors, thereby expanding the impact and reach of programs like Outreachy.

The second post in a series on GitLab and Jira integration discusses the benefits and detailed steps for successfully linking GitLab projects with Jira to streamline project management. The integration allows seamless navigation between GitLab and Jira, automatic logging of GitLab events in Jira issues, and the automatic transition of Jira issues based on GitLab commits and merge requests. Users can choose between using a service template for default integration values or configuring settings at an individual project level. The guide outlines how to configure both Jira Server, which requires basic authentication, and Jira Cloud, which uses an API token, for integration. It also covers setting up GitLab to interact with Jira, including creating API tokens and configuring service templates or individual project settings. The integration supports referencing and closing Jira issues directly from GitLab using specific trigger words in commits and merge requests. Additionally, the document describes the Development Panel Integration setup via Jira DVCS configuration, which involves creating an application in GitLab and connecting through the DVCS accounts in Jira settings, allowing for data synchronization between the platforms.

GitLab CI/CD offers a flexible approach to defining and using variables, enabling developers to control jobs and pipelines without hard-coding values in configuration files. These variables can be stored in different scopes, such as project, group, or instance levels, to facilitate customization and maintainability. Variables help configure third-party services across various deployment environments like testing, staging, and production by modifying API endpoints. They also support the dynamic configuration of CI/CD jobs and can be used as environment variables during job execution. GitLab provides predefined variables for easy access to commit, project, or pipeline details and allows users to create custom variables with specific settings, such as environment scope and protection for sensitive data. Additionally, GitLab is advancing its support for secrets management through integration with external secret managers and the development of a native solution to enhance security within its ecosystem.

Open source software is designed to be accessible to all users, including those with disabilities, promoting inclusivity and diversity by incorporating feedback from a broad user base. This collaboration between the open source community and accessibility-focused technologists enhances the quality and usability of software, as seen in GitLab's approach, which emphasizes community contributions to improve accessibility features. However, open source projects sometimes overlook accessibility in their early stages, highlighting the need for prioritizing user experience and integrating accessibility into the development process early, such as in DevOps. The open source community, exemplified by GitLab, benefits from the input of its diverse contributors, which helps to address accessibility issues effectively. Accessibility is not only about legal compliance but also about fostering a more adaptable and inclusive software environment that benefits all users, similar to how physical accessibility features have become beneficial for everyone.

In an effort to improve GitLab's user invitation process, the author collaborated with the Growth:Expansion team to explore challenges faced by various users, including non-admins, when inviting team members to the platform. Initially, the focus was on enhancing the single-user experience, but it soon expanded to mapping a multi-user journey, revealing significant interruptions and delays, especially for non-admin users. To address these issues, a minimal viable change experiment was conducted by adding an "Invite members" link to the Assignee dropdown, resulting in a 2% increase in namespaces with multiple users. Encouraged by these results, a subsequent experiment involved non-admin users, showing promising preliminary outcomes. Further improvements include developing an "Invite members" modal to streamline the invitation process within the user's workflow, highlighting a demand for non-admins to have more capabilities typically restricted to admins. These experiments demonstrate that even minimal changes can yield significant insights and improvements, with ongoing plans to explore additional user empowerment features.

The collaboration between William Arias from GitLab and Vincent D. Warmerdam from Rasa illustrates how to leverage the GitLab DevOps Platform to streamline the deployment of custom action containers to Rasa X using Kubernetes. Virtual assistants built with Rasa can perform a variety of tasks beyond simple conversations, offering significant user convenience, and these functionalities are often implemented through custom actions. The blog post details a workflow that automates the deployment of these custom actions by using GitLab's CI/CD pipelines, which build and update Docker container images whenever changes are made. This approach facilitates the deployment process by automating steps that are traditionally manual and error-prone, thereby allowing developers to focus more on enhancing the virtual assistant based on user feedback. The article also emphasizes the potential to further extend this pipeline by integrating additional stages for code quality checks, security audits, and unit testing, enhancing the overall efficiency and reliability of the deployment process.

Organizing projects into groups within GitLab proved more challenging for new users than initially assumed, as revealed by a Category Maturity Scorecard validation. During testing, most participants struggled to accurately create an organizational structure due to difficulty in discovering the subgroup creation button, which was hidden within a dropdown menu. Participants also faced confusion differentiating between "Groups" and "Projects" and expected a more intuitive, graphical interface or command-line option. To address these issues, the "New project" and "New group" buttons were separated, significantly improving task completion times and user understanding. Future improvements are aimed at enhancing the information architecture by simplifying the relationship between groups and projects, thereby facilitating better cross-team sharing and navigation.