May 2022 Summaries

KubeCon EU 2022 in Valencia, Spain, marked GitLab's return to in-person events after two years of virtual participation, where key takeaways were shared that will influence GitLab's roadmap. The event highlighted the importance of internal platforms and GitOps for simplifying operations for developers, with emphasis on secrets management as a critical DevOps issue, particularly in cloud-native contexts. GitLab aims to enhance its secrets management by improving existing solutions and leveraging tools like Hashicorp Vault, while infrastructure integrations were discussed, noting the potential of WebAssembly (WASM) in simplifying runtime environments. Although GitLab does not plan to directly support WASM yet, the company remains open to future integrations as demand grows. The positive feedback from users at KubeCon underscored GitLab's stability, reliability, and user-friendly documentation, with some expressing interest in migrating from Jenkins to GitLab. The blog post concludes by inviting feedback and noting that the information is subject to change as GitLab continues to validate its direction based on user insights and industry trends.

Domain Specific Languages (DSLs) are specialized programming languages designed to efficiently handle tasks within a narrow domain, allowing domain experts to formalize their ideas more expressively compared to general-purpose languages. An example of a DSL is AWK, which excels in text-processing tasks, demonstrated by its ability to succinctly sum bank account balances with less boilerplate code than Ruby. Designing DSLs involves challenges such as prototyping and evolving the language, where tools like parser generators and DSL frameworks can assist but often come with steep learning curves. GitLab's Lingo, a micro language framework for Go, exemplifies a solution to these challenges by providing a simple, extensible core for building DSLs that can be easily incorporated into Go applications. Lingo allows developers to integrate new concepts through a plug-in mechanism without altering the core parser or language processor, facilitating the creation of custom DSLs like the Random Text Generator (RTG), which can generate CSV data for testing purposes. This flexibility and simplicity make Lingo a powerful tool for developing efficient, domain-focused languages.

Product operations have become a recognized and crucial function within organizations like GitLab, especially as companies navigate rapid growth and complex global collaboration. Initially undefined, product operations at GitLab have evolved into a distinct function that operates alongside other critical roles, ensuring alignment with the product and business needs. The role emphasizes tools, data, experimentation, strategy, and acting as a trusted advisor. Key strategies for successful implementation include empowering product operations as an independent entity with significant influence, focusing on people-first approaches to build trust and understanding across teams, and encouraging team ownership in adopting product operations strategies to foster collaboration and innovation. These principles, if introduced early, can significantly enhance the value and effectiveness of product operations within an organization.

The text explores the concept of simplicity and complexity management, using the acronym SHE (shrink, hide, embody) from "The Laws of Simplicity" as a framework to discuss how simplicity often involves creating the illusion of simplicity rather than eliminating complexity. This illusion is prevalent in various fields, including technology, where tools like Docker containers aim to embody complexity, yet can inadvertently lead to increased complexity and reduced efficiency if not managed properly. The discussion highlights how leveraging specialized containers for CI/CD processes can sometimes reverse intended efficiency gains by necessitating more complex coding practices due to stripped-down environments, lack of package managers, and the need for multiple job-specific configurations. The author argues that indiscriminately applying microservices heuristics to container-based CI pipelines can create antipatterns by mismanaging complexity, suggesting a more flexible approach to balance the benefits of containers with real-world, generalized compute needs. The text encourages examining the net complexity of processes to ensure that simplicity efforts do not inadvertently increase the workload and decrease productivity.

GitLab is set to replace its existing Web IDE with a new version built on the widely-used VS Code, integrating it into the GitLab interface to enhance functionality and user experience, particularly for more complex tasks. Introduced in 2018, the original Web IDE was designed to make coding accessible to all, but it is primarily used for small, straightforward changes. The new Web IDE will leverage the extensive library of VS Code extensions and is expected to support features like merge request comments, aiming to provide a more powerful and customizable development environment. However, this shift may increase complexity, prompting GitLab to also improve its core editing components to maintain simplicity for basic editing tasks. The transition is expected to occur in the 15.x release cycle, and GitLab is actively seeking early user feedback. While the new IDE will enhance coding capabilities, challenges remain in providing a runtime environment for tasks like real-time previews and testing, which GitLab plans to address in the future with its Remote Development category.

Blonk, a leader in environmental and sustainability research in the agri-food sector, faced challenges in delivering professional software with limited resources, prompting them to adopt GitLab for its integrated project management, version control, and CI/CD capabilities. Initially relying on an external setup involving Amazon and multiple disparate systems, Blonk found GitLab's cohesive platform more suitable as it offered a user-friendly, all-in-one solution that allowed them to streamline their development processes without needing extensive manual configurations. The transition facilitated the creation of a professional software environment, enabling faster build times, improved operational efficiency, and enhanced collaboration among their teams, including software developers, data scientists, and project managers. GitLab's features, such as automation, Docker integration, and agile project planning tools, have supported Blonk's scaling efforts from a single team to multiple teams, contributing to improved transparency and productivity across the organization. By utilizing GitLab's One DevOps Platform, Blonk can manage its software and infrastructure deployment effectively, maintain high-quality standards, and foster an attractive environment for new software developers, thereby supporting its mission to enhance sustainability performance analysis through reliable and quality tools.

The Association Française pour le Nommage Internet en Coopération (Afnic), a French nonprofit responsible for managing .fr domain names, has embraced GitLab as a fundamental part of its modernization efforts to ensure reliability and security in its software development processes. Afnic, which has been managing the .fr country code top-level domain for two decades, aims to create a secure and innovative Internet environment by integrating GitLab to automate and streamline its Shared Registry System (SRS) operations. This transition to a DevSecOps approach involves using modern technologies like Kubernetes, Angular, and Docker, and moving away from older tools such as Java and Perl, supported by private cloud infrastructure across its data centers worldwide. GitLab, alongside tools like Jira and Ansible, has improved compliance, monitoring, and onboarding processes, enabling developers to focus on strategic tasks rather than manual updates. The integration of GitLab with other tools has led to significant cost savings, time efficiency, and community-driven feature enhancements, positioning Afnic to continue leveraging GitLab for future projects while maintaining its commitment to reliability and innovation in the digital space.

GitLab is set to introduce pull-based deployment in its Free tier, enhancing flexibility, security, and scalability in cloud-native environments by allowing DevOps teams to use the GitLab agent for Kubernetes to automatically detect and implement application changes. Pull-based deployment, a GitOps strategy, contrasts with push-based deployment by using an agent in each Kubernetes cluster to pull changes when deviations from the desired configuration are identified, enhancing security by eliminating the need to open firewalls or grant external admin access. While push-based deployment is versatile, allowing for deployment on both physical and virtual containers, it requires adjusting CI/CD pipelines and potentially opening security vulnerabilities. By integrating pull-based deployment into its Free tier, GitLab offers smaller organizations an opportunity to automate infrastructure management securely and scalably, without needing multiple tools, thereby modernizing application development processes.

The blog post discusses a technical issue encountered by GitLab's Site Reliability Engineering (SRE) team where GitLab Pages were consistently returning 502 errors, causing alert fatigue and impacting users. The problem was traced to GitLab Workhorse, a Go service that was not handling shutdown signals properly due to a misconfiguration in the Dockerfile CMD instruction, which used shell form instead of exec form. This oversight prevented GitLab Workhorse from terminating gracefully, leading Kubernetes to forcibly kill the process after 30 seconds, during which time 502 errors were generated. The team resolved the issue by updating the Dockerfile to ensure GitLab Workhorse received the termination signals correctly and implemented a progressive rollout with a feature flag to prevent disruption. The post highlights the importance of using the correct CMD syntax in Dockerfiles to manage processes effectively and prevent similar issues.

GitLab's success is largely attributed to its active community of contributors known as "GitLab Heroes," who play a crucial role in enhancing the platform's functionality and outreach. Among them is Lee Tickett, who has been instrumental in integrating GitLab into his company, Tickett Enterprises Limited, by utilizing it for version control, CI/CD, helpdesk migration, CRM development, and more. Tickett documented his journey of transitioning his company's bespoke helpdesk system to GitLab, employing tools like C# for data migration and collaborating with the GitLab community to refine workflow processes. Despite challenges such as limited instance-level functionality and reporting hurdles, Tickett has made significant strides, including moving to Linux/Docker for CI/CD pipelines and exploring GitLab Pages for intranet use. His efforts highlight the flexibility and potential of GitLab's One DevOps Platform in streamlining operations and fostering innovation within an organization.

President Joe Biden's Executive Order 14028, signed on May 12th, 2021, aims to bolster the nation's cybersecurity by urging both public and private organizations to make significant investments and changes, moving beyond incremental improvements. This has heightened the focus on software supply chain security, emphasizing the need for transparency in code sourcing and development practices due to complex cyber threats like the SolarWinds attack and vulnerabilities such as log4j and Spring4Shell. The administration, along with bodies like the National Institute of Standards and Technology (NIST) and the Cybersecurity & Infrastructure Software Agency (CISA), is pushing for organizations to adopt frameworks such as the Software Security Development Framework (SSDF) 1.1 to ensure safer software development lifecycles. This involves practices like reviewing permissions, securing software from tampering, minimizing vulnerabilities, and ensuring quick responses to security threats. Companies are required to justify their software development decisions, particularly when using open source code, and may have to provide a Software Bill of Materials (SBOM) to demonstrate transparency in their software components. GitLab supports these initiatives by offering tools for visibility, compliance, and security automation, enabling organizations to meet the growing regulatory demands while modernizing their infrastructure without compromising security.

GitLab's Red Team conducts security exercises to simulate real-world threats, allowing the assessment and enhancement of their cyber attack response capabilities. Unlike traditional methods that require in-person collaboration, GitLab's remote workforce, spread across various time zones, necessitates an asynchronous approach, documented in their public handbook for clarity and consistency. They utilize a "Purple Teaming" process, consisting of nine defined stages supported by issue templates on GitLab, where emulated attacks are openly coordinated with all participants aware of the details. This structured, transparent method not only focuses on efficiency but invites community contributions for continuous improvement, making their process open source and accessible for others to adapt and enhance.

GitLab promptly addressed the critical vulnerability CVE-2022-29176 related to unauthorized gem takeovers on Rubygems.org by conducting an immediate investigation and collaborating with Rubygems to ensure a swift patch was applied. Following comprehensive testing, GitLab confirmed that gems from Rubygems.org used within their products and across the company were no longer vulnerable, with no evidence of malicious activity, exploitation, or data compromise detected on GitLab.com or in customer data. No action is required from GitLab.com or self-managed users at this time, but ongoing monitoring continues to safeguard products and customers. Updates will be communicated through a GitLab security alert and further information can be accessed via Rubygems.org's security advisory, along with additional resources on GitLab's recommended security practices and support contact options.

Nobl9's integration with GitLab's CI facilitates the seamless publishing of Service Level Objectives (SLO) definitions from GitLab to Nobl9, streamlining the SLO-as-Code process for DevOps teams. This integration is crucial in an era where 100% system uptime is impractical due to complex architectures, allowing teams to define realistic uptime targets and manage error budgets effectively. Traditionally, maintaining synchronized SLO definitions required manual command-line tool operations or custom integrations, but Nobl9's CI configuration automates this process. By using GitLab to version SLO definitions, teams ensure consistency and eliminate discrepancies, providing a definitive source of truth for SLO definitions in their code repositories. The integration also enables continuous updates to SLO definitions through GitLab's CI/CD pipeline, enhancing operational efficiency without the need for separate products. Nobl9 encourages existing users to explore this integration and offers a 30-day trial for new users to experience its benefits.

Application security testing (AST) is increasingly essential in software development, particularly within the DevOps framework, as demonstrated by GitLab's approach of embedding security and compliance throughout the DevOps lifecycle from planning to production. Recognized as a Challenger in the 2022 Gartner Magic Quadrant for AST, GitLab emphasizes integrating comprehensive security scans directly into the CI pipeline to provide developers with immediate feedback on vulnerabilities as they arise, enhancing efficiency and compliance. This method contrasts with traditional standalone AST technologies by offering a holistic platform that streamlines security processes, automates policy enforcement, and provides timely educational resources for developers. Partnerships with Kontra and Secure Code Warrior further support GitLab's mission by delivering targeted training to address specific vulnerabilities, fostering a proactive learning environment. GitLab also prioritizes continuous software compliance by enabling organizations to create and enforce policies that align with their regulatory standards, simplifying audits and accelerating deployments.

The fourth installment of the "Learn Python with Pj!" series explores the concept of dictionaries in Python, highlighting their structure as collections of key-value pairs stored within curly braces. The text discusses how dictionaries differ from lists, allowing the connection of keys to values for easy data retrieval. The blog demonstrates creating dictionaries from arrays and illustrates accessing and manipulating dictionary data, including using immutable types as keys and flexible types as values. Additionally, it outlines methods for dictionary creation, such as using the dict() and zip() functions or employing dictionary comprehension for more complex logic. The article also covers Python's capabilities in reading and writing files, specifically .txt and .csv formats, explaining how to manipulate file contents using the open() function and detailing how to handle .csv files with the csv module to ensure structured data representation.

In 2021, GitLab conducted its second annual DevOps in Education Survey, gathering insights from over 460 global respondents about the impact of DevOps and GitLab on higher education. The survey revealed significant growth in the adoption and enthusiasm for GitLab's single DevOps platform, with a notable increase in the appreciation of its ability to integrate culture with operations and enhance student portfolio management. GitLab's CI/CD features have seen widespread adoption in academic settings, with deployment flexibility and security being critical advantages for institutions. Many departments across campuses are now utilizing GitLab, with 21% of respondents highlighting the benefit of installing multiple instances. The most common educational use of GitLab involves source control management, followed by continuous integration and issue tracking. The survey also identified key skills taught using GitLab, such as CI/CD, collaboration, and application development. Participants were primarily from universities, with a strong representation from computer science and information technology departments, and respondents included faculty, staff, and students from various regions worldwide. GitLab emphasizes its commitment to providing free, high-tier licenses to educational institutions to facilitate teaching and research in DevOps.

GitLab is experiencing a dynamic period of growth, emphasizing the importance of customer and partner relationships in establishing a strong workplace culture and achieving market leadership in DevOps. The company's strategy involves hiring top-tier talent and integrating sales and channel partner roles to capitalize on the high demand for DevOps solutions, leveraging GitLab's reputation for being a beloved product among developers. Key figures in the organization highlight GitLab's unique cultural values, which include collaboration, results, efficiency, diversity, inclusion, belonging, iteration, and transparency, making it an attractive workplace that fosters innovation and teamwork. GitLab's internal practices, such as using their own platform for all business processes and providing ample training opportunities, support employee success and empowerment. The company seeks individuals who are curious, customer-focused, and technologically enthusiastic to join its team, as they continue to expand their market presence and enhance their offerings.

GitLab addresses the challenges of burnout in the demanding environment of a startup by promoting strategies for its team members to manage stress effectively. Co-founder and CEO Sid Sijbrandij, along with Michelle Hodges, vice president of Global Channels, highlighted the importance of early identification of burnout symptoms like exhaustion and reduced enthusiasm, which are harder to detect in remote settings. They discussed several managerial strategies to counter burnout, including encouraging time off, reducing pressure, fostering positivity, and increasing headcount when necessary. Managers are advised to show gratitude, celebrate progress, and provide access to mental health resources, like GitLab's ModernHealth, to support employees. Additional recommendations include setting clear boundaries for work hours, helping team members prioritize tasks, and facilitating open discussions about workload and stress. By sharing burnout concerns appropriately with others, managers can create a more supportive and sustainable work environment.

DevOps professionals often prioritize technical skills like learning new programming languages and machine learning, but the importance of soft skills such as communication and collaboration should not be underestimated in a DevOps environment. At its core, DevOps is about teamwork and breaking down silos, which leads to more efficient and innovative software development and deployment. A culture of collaboration allows for diverse perspectives, resulting in better, well-rounded products and services that meet market demands and customer needs. This collaborative approach not only enhances software quality but also boosts career prospects for DevOps professionals by making them more valuable to their organizations. Furthermore, involving various departments such as marketing, finance, and customer service in the development process enriches the overall expertise and fosters a more secure and responsive business environment.

GitLab is preparing for the official support of Amazon Linux 2, with its Distribution Engineering team developing distro-specific packages available for x86 and Graviton ARM architectures starting with GitLab Version 15.0. Amazon Linux 2 offers a modern application environment with long-term support, and GitLab's move to support it aligns with this by enabling specific packages for easier development and testing. Previously, users employing Amazon Linux 2 had to use a workaround to access EL7 packages, which will be phased out with the release of GitLab 15.3.0. This update ensures that future Amazon Linux 2 yum requests will automatically receive the correct packages, with GitLab also providing a transitional script to help users align their automation with the new packages. The release of GitLab 15.3.0 marks a significant shift as users can test and migrate to these updates, ensuring seamless integration without disrupting existing systems. As GitLab transitions to Amazon Linux 2 specific packages, automated systems requiring older versions must be adjusted to prevent disruptions, with GitLab offering scripts to aid in the transition.