October 2022 Summaries

Modern DevOps practices are increasingly integrating business objectives with technical achievements, marking a maturity stage where metrics like user experience and customer satisfaction are prioritized alongside performance and quality. This shift is accompanied by a growing focus on value stream management and the integration of security practices, though DevSecOps adoption remains limited. DevOps platforms are essential for scaling and streamlining toolchains, with modern iterations emphasizing automation, continuous improvement, and cloud deployments. Cultural transformation remains crucial, as organizations must foster collaboration and communication to avoid toxic attitudes. Future trends include the adoption of AI/ML, GitOps, and low-code/no-code tools, as well as the need to support edge computing and cross-functional teams organized around products to deliver business value.

Despite its long-standing presence and success in the software industry, DevOps collaboration remains a critical focus, according to the 2022 Global DevSecOps Survey and industry experts. The survey highlighted that programming languages and soft skills, particularly collaboration, are seen as vital for future career development by both developers and operations professionals. This ongoing emphasis on collaboration reflects a broader trend as DevOps evolves from merely a technological objective to encompassing business goals such as customer satisfaction and profitability. As the scope of DevOps expands, involving more cross-functional teams, the necessity for effective collaboration increases. Thought leaders suggest that future success in DevOps will depend heavily on integrating business metrics and achieving unprecedented levels of cross-functional teamwork.

GitLab plans to redirect requests for CI artifact downloads to Google Cloud CDN instead of Google Cloud Storage, potentially enhancing download speeds through edge caches, with a gradual rollout starting in late October 2022. During this transition, users should ensure their GitLab Runner is updated to at least version 13.1.0 to utilize the CDN effectively, and those with firewalls limiting access to storage.googleapis.com will need to add the CDN's IP address to their allow list. Users may encounter errors such as connection resets, certificate issues, or authentication failures due to these changes, and solutions include checking firewall settings, updating runners to newer versions, and configuring HTTP clients to drop Authorization headers on redirects. GitLab emphasizes that these modifications are subject to change, and users can track the progress and raise questions through a specified issue link.

In the current digital landscape, the importance of application security in the software supply chain is paramount, with a Software Bill of Materials (SBOM) playing a crucial role in ensuring transparency and security. An SBOM acts as a detailed inventory of software components, including libraries, tools, and processes, providing insight into potential vulnerabilities and aiding in risk mitigation. As part of the U.S. government's push for secure software practices, SBOMs are increasingly recommended for both public and private sectors. GitLab exemplifies industry efforts by integrating SBOM generation into its DevSecOps platform, utilizing standards like CycloneDX for automating SBOM creation, merging, and vulnerability analysis. This integration supports enhanced security measures by allowing continuous monitoring and management of software vulnerabilities. The platform also enables dynamic SBOMs, ensuring that applications remain secure and compliant with emerging regulations. As the demand for SBOMs grows, they become a cornerstone of cybersecurity strategies, emphasizing the need for organizations to adopt robust SBOM practices to protect against supply chain threats.

The shift from DIY DevOps to a unified platform approach is driven by the need to address inefficiencies and costs associated with toolchain sprawl, along with the pressures of digital transformation and economic uncertainty. GitLab's Ultimate Plan, highlighted in a Forrester Consulting study, showcases substantial benefits such as a 427% three-year ROI, a 12x increase in annual releases, and an 87% improvement in development efficiency. The platform simplifies development by integrating tools, enhancing security management, and improving code quality, thus fostering more efficient and collaborative work environments. This approach not only helps organizations maintain resilience during economic downturns but also enhances market competitiveness by accelerating development and release cycles.

Astro is a framework for creating static, content-focused websites, and GitLab Pages provides an efficient method to deploy these sites. The process begins with creating an Astro project locally using the Astro CLI, which ensures the latest defaults are applied. The configuration involves altering the default directory settings in the `astro.config.mjs` file to align with GitLab Pages' requirements, where the static build output is placed in a "public" folder and static assets in a "static" folder. After setting up a remote repository on GitLab without initializing it with a README, the local code is synced with GitLab. A Pages pipeline is then created, using "node:lts" as the build image and specifying build commands such as `npm ci` for installation and `npm run build` for building the project. The pipeline ensures that deployments are triggered by commits to the default branch, and once the pipeline succeeds, the site is published with GitLab Pages. For private projects, settings can be adjusted to make the deployed site public while keeping the source code private.

GitLab has partnered with Oracle to facilitate the deployment of its DevOps platform on Oracle Cloud Infrastructure (OCI), offering enhanced performance, reliability, and the ability to manage workloads across hybrid and multi-cloud environments. This collaboration allows organizations to accelerate migrations and create a high-performance, resilient DevOps environment that supports automatic operating system patching and zero trust architecture, aligning with GitLab's emphasis on application security. OCI's platform offers a wide array of services, including Kubernetes integration, AI/ML hardware acceleration, and serverless functions, enabling customers to build applications without managing infrastructure. Both companies focus on security, with OCI offering a redesigned secure cloud architecture and GitLab providing integration with various identity providers for single sign-on capabilities. The partnership also targets mission-critical workloads in regulated industries and supports government customers with stringent security standards, while facilitating cloud adoption through strategic partnerships like the Oracle Cloud VMware solution.

GitLab's DAST and Vulnerability Research teams have fully integrated passive checks into their new browser-based DAST analyzer, enhancing their ability to detect application vulnerabilities by monitoring network traffic during automated website crawls without disruptive requests. This development is part of a transition from the existing OWASP Zed Attack Proxy-based system to a more controlled and integrated browser-based tool written in Go, designed to handle modern web applications, including Single Page Applications and complex sign-in processes. By continuing to use ZAP as a proxy while processing logic within their engine, GitLab aims to reduce alert fatigue by eliminating irrelevant checks and false positives, ensuring more accurate findings. By employing a configuration-file-based system similar to SAST tools, they streamline vulnerability checks, allowing aggregation of true positives for a clearer overview of application security. This transition represents a significant step forward in providing efficient and reliable DAST scans, tailored to today's complex web environments.

The concept of NoOps, which predicted the complete automation of operations roles, has proven unrealistic as modern DevOps practices have significantly expanded the responsibilities of operations professionals. According to the 2022 Global DevSecOps Survey, operations roles have evolved to include managing cloud and hardware infrastructure, maintaining toolchains, overseeing compliance and audits, and engaging in platform engineering and DevOps coaching. With developers increasingly taking on operational tasks such as environment provisioning and infrastructure monitoring, the traditional lines between roles are blurring. The focus on automation has increased, with a notable portion of operations now being fully automated, yet the overwhelming amount of DevOps data poses a challenge in terms of management. The new responsibilities, especially in security and data handling, highlight the dynamic nature of the modern DevOps landscape, where both operations and development teams are adapting to more complex and integrated roles.

Embarking on an open-source software (OSS) project involves more than just writing code; it's about fostering a community where contributors can thrive. Essential elements for a successful OSS project include creating a comprehensive and inviting README.md file to guide users and potential contributors, and a clear CONTRIBUTING.md file that outlines how to engage with the project. Clear installation instructions, links to external documentation, and a code of conduct are vital for setting the right tone and expectations. Efficiently managing contributions is facilitated by using templates for common tasks such as bug reporting and feature requests, and automation through CI/CD pipelines helps maintain consistency and quality as the project scales. Choosing an appropriate license and maintaining a welcoming environment further ensure the project's longevity and inclusivity. Tools like GitLab offer resources to support these efforts, emphasizing that thriving OSS projects are as much about community and collaboration as they are about the code itself.

Incident timelines in GitLab serve as a crucial tool for managing and documenting key updates and events during an incident, acting as a single source of truth (SSoT) that includes details such as when the incident was declared and who is working on it. These timelines help maintain focus and efficiency by allowing team members to quickly update events using GitLab quick actions or by adding comments, thus minimizing interruptions. They ensure a seamless handoff between shifts and provide a comprehensive record for post-incident reviews, aiding in the analysis of the incident's origin and resolution, and ensuring adherence to Service Level Agreements (SLAs). By keeping detailed timelines, teams can reduce time spent on paperwork, focus on resolving issues, and use the information to prevent future occurrences. The GitLab Infrastructure Team has embraced this tool and encourages feedback to improve its functionality further.

Modern software development increasingly relies on code reuse through libraries, but this introduces potential security vulnerabilities that can compromise entire applications and software supply chains. To address these risks, generating a software bill of materials (SBOM) is crucial, particularly after high-profile incidents like the SolarWinds attack, which prompted governmental requirements for SBOMs in software offers. GitLab, in partnership with Rezilion, provides tools to enhance software supply chain security by implementing security scanners in CI/CD pipelines, managing vulnerabilities through a centralized GitLab interface, and generating comprehensive SBOMs. The integration of Rezilion with GitLab further streamlines vulnerability management by distinguishing exploitable vulnerabilities, thus reducing unnecessary developer workload and fostering efficient delivery of secure products. This combined approach allows for proactive security measures without hindering development speed, ensuring applications are safeguarded before deployment.

GitLab's IPO journey, as shared in a comprehensive blog post, highlights the innovative and efficient approach the company adopted during its public listing process. One year post-IPO, GitLab celebrated by sharing insights from its experience, including the importance of addressing "cheap stock" issues, the benefits of operating as a remote-first company, and the use of modern tools like Zoom and Google Workspace to streamline the S-1 drafting process. The company emphasized the need for confidentiality during the IPO process, adhered to regulations like the Quiet Period, and leveraged its SAFE Framework to ensure responsible public communication. GitLab also highlighted the significance of selecting the right banking partners, the role of the lead-left bank, and the importance of timing the IPO strategically. The blog post concluded with reflections on the efficient collaboration with directors, officers, and insurance providers, and the successful coordination of the opening bell ceremony as part of their global celebration, hoping to inspire other companies in their IPO endeavors.

GitLab provides a platform for collaborative software development, offering tools and resources like the GitLab Duo Agent Platform, Code Suggestions (AI), and CI/CD integration, all of which can be utilized on cloud services such as AWS and Google Cloud. It emphasizes the importance of DevOps maturity and provides resources to help teams assess their DevOps capabilities through a quick quiz. GitLab's blog features insights into topics like consolidating GitLab stacks with Gitaly on Kubernetes and the impact of AI on DevSecOps. The platform encourages feedback and community interaction, inviting users to participate in forums and surveys to improve collaborative development practices. Additionally, GitLab offers a trial for its intelligent orchestration platform, aiming to accelerate DevSecOps processes and innovation.

GitLab utilizes a "docs-as-code" workflow, leveraging its own platform to plan, create, review, edit, and publish technical documentation, streamlining the process with transparency and efficiency. This approach allows documentation to be developed using the same tools and processes as software code, with version control and collaboration facilitated through issues, merge requests, and feedback mechanisms. The system allows for easy tracking of changes, feedback integration, and content testing using third-party tools like Nanoc and Vale, all within GitLab's environment. This setup supports continuous updates, with documentation hosted on GitLab Pages and updated hourly to ensure the most current information is available, aligning with GitLab's commitment to transparency and open-source contribution.

GitLab and Google Cloud have collaborated to launch Cloud Seed, an open-source initiative designed to accelerate cloud adoption and application modernization. This partnership, announced at Google Cloud Next 2022, aims to enhance the developer experience by integrating DevSecOps best practices and improving the use of cloud services. Cloud Seed focuses on two main Google Cloud services: Cloud Run, which supports scalable containerized app deployment, and Cloud SQL, a managed relational database service. During its private beta phase, Cloud Seed gained popularity for creating preview environments and supporting relational database migrations. The initiative is built on open-source principles, making its capabilities accessible to all GitLab users, with the purpose of learning from user feedback to further refine and support cloud adoption strategies.

Git rebase is highlighted as a powerful tool for developers to streamline the code review process by ensuring that each commit within a merge request is small, self-contained, and easy to review. Instead of adding numerous commits that can clutter and complicate the review process, developers can use Git rebase to rework and organize their commits interactively, thus maintaining a clear history of changes. The interactive rebase mode allows developers to edit, reorder, or combine commits, and even incorporate shell commands to ensure each commit passes necessary tests. This method enhances the efficiency and effectiveness of code reviews and debugging, ensuring that the codebase remains in a robust state while also boosting the productivity of both developers and reviewers.

Developers are facing a host of challenges in today's rapidly evolving technological landscape, as revealed by over 5,000 respondents in the 2022 Global DevSecOps Survey. Key concerns include difficulties in hiring and retaining talent, the impacts of economic fluctuations, and navigating the post-Covid work environment. In addition, developers are grappling with the complex adoption of emerging technologies like AI, 5G, and edge computing, while also being highly concerned about security breaches and their implications for organizations. Brendan O'Leary from GitLab highlights a "tectonic shift" in the developer role, describing the juxtaposition of developers' newfound importance in business with market corrections that increase pressures on them. As demand for software remains high despite a shortage of developers, issues such as security, staffing, and the integration of new technologies have become more pronounced, leading developers to feel an overwhelming responsibility to keep pace with innovation, ensure data security, and adapt to cultural and technological changes.

Crafting a compelling tech talk involves more than just presenting technical content; it requires a blend of storytelling, passion, audience connection, balance, and a call to action. The author emphasizes that an exceptional tech talk is not solely dependent on the technical details but rather on how these elements are interwoven to engage and inspire the audience. By highlighting examples from notable speakers like Kelsey Hightower and Jessie Frazelle, the text illustrates how stories and passion can captivate an audience, while understanding the audience's needs and balancing style with substance ensures the message is both informative and memorable. Finally, the talk should conclude with a call to action that offers the audience practical steps to apply what they've learned, thus leaving a lasting impact.

A career in technology can take various paths, as illustrated by the diverse experiences of three GitLab team members who transitioned into tech under different circumstances. Mark Loveless, a Staff Security Engineer, started his tech career in 1990, moving into security roles despite facing age-related biases, and values the independent contributor role over management. Juliet Wanjohi, a Senior Security Engineer, began with a Computer Science degree and progressed rapidly at GitLab, overcoming imposter syndrome and age-related stereotypes by focusing on her skills and passion for security. Pj Metz transitioned into tech at 35 after a career in education, finding the corporate world challenging but rewarding, and emphasizes the importance of continuous learning and supportive work environments. At GitLab, a culture of openness, growth, and inclusivity has helped these individuals thrive despite obstacles, underscoring that success in tech depends more on skills and adaptability than on age or traditional career paths.

GitLab has integrated a feature called Project-level Secure Files with Fastlane Match to simplify the complex process of code signing for iOS apps, making it easier to manage signing certificates and provisioning profiles within GitLab. This integration supports Fastlane's open-source tool, which reduces the time spent debugging errors during iOS development. By using Fastlane Match and Project-level Secure Files, developers can automate the process of generating and uploading signing certificates directly into their GitLab projects, which can then be utilized in CI/CD pipelines without requiring additional access tokens. The integration allows developers to streamline their workflow by incorporating code signing into CI/CD jobs and provides a comprehensive setup for building and signing apps, potentially extending to deployment on platforms like Test Flight or the App Store. While Fastlane aids in handling certificate management, it does require some familiarity to use effectively, and GitLab encourages feedback and exploration of their resources for enhancing Mobile DevOps practices.

Arm has chosen GitLab as its new platform to modernize its infrastructure, aiming to consolidate key projects across internal and open-source repositories while minimizing vendor lock-in and maximizing cost-effectiveness. The transition allows Arm to move its software development operations to a unified platform that supports its native Arm architecture, enhancing collaboration and providing enterprise-grade support. GitLab's open-source nature enables Arm to use its own tools while maintaining control over its open-source projects, with the company achieving significant cost and time savings in the process. The migration to GitLab, which is about 90% complete, has been well-received by Arm's engineering teams, who appreciate the ease of use and feature-rich environment that GitLab offers. Arm sees GitLab not just as a DevOps tool but as a comprehensive developer experience platform that enables the company to deliver software development "by Arm, for Arm, on Arm." Looking forward, Arm plans to further optimize deployment across cloud providers, enhancing redundancy and collaboration with GitLab.