July 2021 Summaries

Implementing Continuous Integration and Continuous Deployment (CI/CD) is crucial for modern software development but presents challenges, especially for large enterprises, due to the need for DevOps expertise, evolving DevSecOps tools, and a lack of standardization. At Orange, the introduction of GitLab's "include" feature in 2019 enabled the creation and sharing of standardized CI/CD pipeline templates, overcoming these obstacles. This initiative, named "to be continuous," has grown into a community-driven project with over 30 templates covering various development needs from build and test to deployment, ultimately fostering CI/CD standardization within Orange. The project, open-sourced to benefit broader IT communities, provides documented templates and an interactive configuration tool, illustrating the potential to streamline and unify CI/CD processes across different teams and projects. This effort highlights the importance of standardization in CI/CD platforms, akin to the adoption of Maven and Gradle in Java development, aiming to simplify and harmonize the pipeline creation process for developers.

The evolution of DevOps and its parallels with the "Need For Speed" (NFS) video game franchise highlight the transformative power of innovation in both gaming and software development. NFS revolutionized the racing game market by enhancing realism and setting new standards, similar to how continuous integration (CI), introduced by Grady Booch in 1994, reshaped software development processes by leveraging automation. This evolution paved the way for modern DevOps practices, emphasizing continuous integration and delivery (CI/CD) to enhance collaboration and speed without sacrificing quality. GitLab 14 exemplifies this modern approach, offering a platform-driven solution that simplifies the software development lifecycle with features like a unified interface, embedded security, and a GitLab pipeline editor that lowers the entry barrier for CI/CD novices while accelerating advanced users. Additionally, the GitLab Agent for Kubernetes supports secure, cloud-native GitOps deployments, furthering the efficiency and integration capabilities of DevOps. By addressing both technological needs and user experience, GitLab 14 aims to empower developers to ship software faster and with greater confidence, adapting to market changes without compromising on quality or peace of mind.

GitLab is deprecating support for the Grype scanner in its Container Scanning analyzer by version 17.0, encouraging users to switch to the Trivy scanner as the default. However, users preferring Grype can integrate it themselves using GitLab's Security Scanner Integration documentation. The shift to containerization has heightened the need for robust security solutions due to the increased risk of deploying software with known vulnerabilities. Grype, developed by Anchore and integrated into GitLab 14.0, offers deep inspections and detailed vulnerability matches, making it a powerful tool for security engineers. GitLab's integration with Grype involves adding a snippet to a project's .gitlab-ci.yml file, allowing customization through various variables. Once set up, users can view vulnerability analysis results in GitLab's Vulnerability Report, which provides insights into the severity and specifics of vulnerabilities. The process of integrating Grype into GitLab pipelines is straightforward, enhancing visibility into container image security, and is supported by an active open-source community.

Cloud native application architectures leverage containerization, microservices, and Kubernetes to achieve scalability and reliability, with GitLab offering integrated tools for developing and deploying these applications. GitLab version 14.1 introduces a Helm registry, facilitating the publication, installation, and sharing of Helm charts, which are packages that manage application definitions in Kubernetes clusters. While Helm charts can be stored in Git repositories, this approach can become unwieldy for large-scale projects, making a dedicated Helm registry preferable due to its centralized management, security, and ease of distribution. The Helm registry in GitLab enables systematic vulnerability scanning and streamlined user access control, providing a more efficient way to manage complex applications across large organizations. Although the Helm registry feature is still maturing, organizations can use it for testing and planning, contributing feedback and code to further its development.

In the modern programming environment, the ease of code reuse via public registries like rubygems.org or npmjs.com simplifies development but introduces challenges, including the risk of malicious code. Past incidents, such as the event-stream compromise, highlight how threat actors exploit these registries. A notable technique, Dependency Confusion, manipulates package managers to install malicious dependencies, posing risks to production systems. Existing scanners often fail to detect such threats, prompting GitLab to develop Package Hunter, a tool that analyzes dependencies in a sandbox environment, monitoring system calls for suspicious activity. Utilizing Falco, Package Hunter supports NodeJS and Ruby Gems, offering a solution for enhancing supply chain security. Integrated with GitLab, the tool is open-source and aims to bolster trust in open-source supply chains by enabling projects to identify and address malicious code proactively.

The second part of the GitOps series explores the use of a push-based, or agentless, approach for managing infrastructure as code using GitLab's scripting capabilities. This method is beneficial for scenarios involving non-Kubernetes infrastructure components or where maintaining agents is not desirable. GitLab automates updates and drift detection for infrastructure components without requiring agents, leveraging its CI/CD capabilities to enable scripting with tools like Docker, Helm, Ansible, and SSH commands. This approach allows users to create resilient infrastructure with reduced downtime risk by integrating Infrastructure as Code (IaC) tools into GitOps workflows. Additionally, GitLab's built-in variables enable users to modify infrastructure components, such as adjusting the number of production pods in a Kubernetes cluster or provisioning PostgreSQL databases. The series will conclude with a discussion on integrating Terraform for agentless infrastructure management and examples of GitOps flows for AWS ECS and EC2.

DevOps enhances team efficiency and productivity, but its effectiveness often hinges on measuring workflow and removing blockers, which DIY toolchains struggle to achieve due to poor visibility and siloed data. GitLab 14 addresses these challenges by offering a comprehensive DevOps platform that enhances visibility and provides actionable insights without the complexity of maintaining disparate tools. By surfacing key operational metrics such as Lead Time for Changes and Deployment Frequency, GitLab 14 helps organizations monitor and improve their DevOps processes, leading to positive business outcomes. The platform's Value Stream Analytics allows teams to identify and address value blockers efficiently, making insights actionable and promoting streamlined workflows. GitLab 14's integration of visibility and operational analytics facilitates better decision-making and aligns team efforts with business goals, offering a significant advancement over traditional DIY DevOps approaches.

GitLab has announced updates to enhance its billing and subscription management, including a shift from annual true-ups to quarterly subscription reconciliation, along with the introduction of cloud licensing and auto-renewals aimed at improving license management for self-managed customers. These changes, effective from August 1, 2021, for new customers and at the next renewal for existing ones, exclude free tier users and community program participants, but promise substantial savings on add-on users for paid customers by charging only for the remaining quarters of the subscription term. The updates also require self-managed customers to share aggregated operational data to optimize customer success services, which helps in understanding usage patterns and adoption issues. While these modifications are not immediately available to those purchasing GitLab through resellers, they are designed to maintain the efficiency of self-managed deployments, ensuring that customers can choose between GitLab SaaS and self-managed options based on their deployment preferences.

GitLab 14 enhances modern DevOps by embedding security throughout the software development lifecycle (SDLC), offering a platform-driven solution with a unified data store that integrates security into the workflow seamlessly, enabling developers to identify and fix vulnerabilities early without distraction. As organizations strive to improve development velocity and manage security risks, many find traditional toolchains cumbersome, leading them to adopt GitLab for its streamlined DevSecOps process, which supports collaboration by removing siloed tools and automates security policies. Customers of GitLab report improved application security programs due to its comprehensive scanning capabilities and vulnerability management tools, which provide earlier risk visibility and simplified remediation. GitLab emphasizes the necessity of integrating security into the DevOps platform, particularly in safeguarding software supply chains, by promoting end-to-end visibility, compliance management, and securing infrastructure as code (IaC), which are crucial aspects of evolving to DevSecOps 2.0. The GitLab Commit conference further explores these developments, highlighting the importance of security in modern application development and the need for continuous improvement in response to increasing security threats.

The text explores the intricacies of setting up development environments and the challenges associated with onboarding new developers, particularly in diverse operating systems environments. It emphasizes the importance of using CI/CD pipelines to streamline processes and reduce friction, highlighting the roles of Vagrant, Docker, and cloud-based solutions like Gitpod in simplifying development setups. The document further elaborates on Gitpod's integration with GitLab, demonstrating how it facilitates rapid environment provisioning, consistent development experiences, and seamless collaboration through cloud IDEs like Visual Studio Code. By using Gitpod, developers can efficiently manage dependencies, deploy applications, and contribute to projects without the need for extensive local setups. The text also includes practical guidance on initiating projects with Gitpod, such as creating VueJS applications, utilizing Dockerfiles for custom environments, and leveraging GitLab's CI/CD capabilities for continuous integration. Additionally, it showcases Gitpod's application in learning new programming languages like Rust and contributing to complex projects such as GitLab itself, thereby promoting the notion that anyone can contribute to open-source software development.

GitOps is portrayed as a culmination of best practices in operations rather than a novel change, reflecting the evolution of IT operations over the past two decades. Initially, operations were handled by System Administrators using shell scripts and graphical user interfaces, but the shift towards cloud-native environments has necessitated advanced coding skills and the use of APIs for infrastructure management. The introduction of Site Reliability Engineering (SRE) at Google in 2003 marked a significant milestone, applying software engineering practices to operations to enhance reliability and scalability. The advent of Amazon Web Services in 2006 further transformed operations by promoting infrastructure as code (IaC) practices, enabling companies to manage cloud services more efficiently. DevOps emerged in 2009, advocating cultural changes for high-quality service delivery, while containerization technologies like Docker and Kubernetes in the early 2010s standardized software packaging and introduced self-healing systems. By 2017, GitOps was coined to encapsulate these developments, emphasizing the automation and self-healing capabilities of modern operations systems. GitLab's vision supports this evolution by offering CI automation tools and infrastructure management solutions, acknowledging that while GitOps provides value, its successful implementation depends on a robust DevOps culture.

GitLab has adopted and adapted the PASTA framework for threat modeling to enhance its security processes across various departments while maintaining the simplicity and scalability needed in a remote, asynchronous work environment. Traditionally managed by security departments, threat modeling at GitLab now involves project teams directly, enabling them to create their own models using a customizable template, which they document in markdown files for later review by the security team. This approach empowers engineers to identify and address security issues early in the development process, thereby minimizing security team intervention and leading to more secure code. The integration of this modified framework has improved communication with non-security personnel and external stakeholders by using a common language, ensuring that discussions about security and risk are more accessible. This method not only streamlines the threat modeling process but also makes it more efficient, less time-consuming, and scalable, ultimately enhancing the overall security posture of GitLab's projects.

A security researcher identified two significant vulnerabilities in Gitpod, a cloud-based development environment, during its integration with GitLab. The first vulnerability involved cross-origin WebSocket access, allowing unauthorized access to a user's GitHub access token, which could then be exploited to impersonate them on GitLab, GitHub, or BitBucket after social engineering. The second issue allowed a user to log in as any account by manipulating OAuth tokens with a self-managed GitLab instance, potentially spoofing any email address. Both vulnerabilities were quickly addressed by the Gitpod team, who deployed fixes within five hours of the initial report, earning commendation for their swift response. The incident highlights the importance of robust security practices, as vulnerabilities in a service like Gitpod can have cascading effects on linked services such as GitLab, GitHub, and Bitbucket.