November 2022 Summaries

GitLab has introduced GitLab Dedicated, a single-tenant SaaS version of its enterprise DevSecOps platform, designed to address compliance needs with a focus on data residency, isolation, and private networking. This new offering aims to meet the demands of global enterprises and regulated industries facing complex data governance and compliance challenges, allowing them to choose the cloud region that meets their requirements while maintaining secure, private network connections. Unlike multi-tenant SaaS solutions, GitLab Dedicated provides an isolated instance managed and hosted by GitLab, offering the benefits of cloud efficiency without the burden of managing infrastructure. This solution enables organizations to achieve shorter cycle times, lower costs, and enhanced security, making it viable for companies that require strict compliance and data residency controls. As GitLab scales this offering, it is initially available through a waitlist, with plans for general availability in the future.

Organizations face increasing pressure to ensure their software supply chains are secure and untampered, prompting the creation of the Supply Chain Levels for Software Artifacts (SLSA) as an industry standard. Introduced in 2021, SLSA provides a framework with four levels of standards designed to enhance software integrity and security by examining builds, sources, and dependencies. GitLab supports SLSA compliance by integrating attestation capabilities into its DevSecOps platform, currently facilitating Levels 1 and 2 compliance. This enables users to generate artifact metadata natively within GitLab, preventing tampering by not relying on third-party software. As SLSA evolves, GitLab aims to incorporate additional features, such as integrated code signing, to assist teams in achieving higher compliance levels. These efforts highlight a broader industry move toward enhancing software trustworthiness through detailed provenance and integrity verification processes.

The article examines a persistent latency issue in a Redis instance used as a least recently used (LRU) cache for GitLab.com, focusing on the use of BPF and profiling tools to uncover the root cause. It details an iterative hypothesis-testing approach that reveals a three-phase cycle causing chronic latency spikes due to CPU saturation during eviction bursts. The investigation identifies client input/output buffers as the mystery memory consumer, which bloat during evictions and release memory rapidly afterward, leading to self-amplifying eviction bursts. The team ruled out externally triggered causes and explored potential mitigations, such as adjusting Redis settings and client behavior, to improve memory efficiency. The solution involved reducing cache time-to-live (TTL), switching to client-side caching for certain keys, and partitioning cache keys, which successfully eliminated the latency spikes and improved the user experience. The article highlights the importance of understanding Redis eviction behaviors and offers insights into preventing similar issues by avoiding memory and CPU saturation.

Remix has emerged as a pivotal framework in the frontend development landscape, allowing developers to write backend code within frontend applications, which facilitates scalability without necessitating a complete rewrite of application logic. This capability is particularly advantageous when deploying applications to the edge, where small instances run on servers close to users, minimizing network latency. Cloudflare Workers is highlighted as a popular service for deploying Remix apps due to its global edge network and straightforward deployment process using GitLab CI/CD. The deployment process involves creating a Remix app, setting up a GitLab project, configuring Cloudflare with an API token, and establishing a GitLab pipeline for continuous deployment. Additionally, deploying Remix apps with a custom domain via Cloudflare involves setting up DNS and routing configurations to direct traffic to the deployed Worker, ensuring seamless access to the application.

GitLab enhances the DevOps process by providing seamless developer environment lifecycle management, particularly through its Review Environments feature, which addresses the common friction points associated with environment provisioning, sprawl, and management. By automating the creation and maintenance of isolated, per-feature branch environments, GitLab reduces the inefficiencies and administrative barriers typically encountered in development workflows. This automation allows developers to focus on coding without the administrative burden of environment justification and management, effectively nullifying the negative feedback loop of unmanaged sprawl and cost. GitLab's approach aligns with industry trends of "shifting left" by enabling developers to identify and resolve defects early in the development cycle, thus enhancing the overall value stream. The platform's capabilities extend beyond Kubernetes to other cloud application frameworks, demonstrating its adaptability and potential for broad application across diverse cloud infrastructure scenarios.

Recent advancements in artificial intelligence (AI) and machine learning (ML) have highlighted their potential in transforming computing and software, yet many projects face obstacles reminiscent of early DevOps challenges. Companies like Hugging Face and applications such as DALL-E 2 exemplify AI/ML's growing mainstream presence, but initiatives are often hindered by issues such as lack of experiment repeatability, tool disparities, and insufficient team collaboration. To overcome these hurdles, a strategic and tactical mental model is necessary for AI/ML project success, encompassing steps like data acquisition and transformation through "DataOps," followed by "MLOps" for model experimentation, training, and deployment. Drawing on DevOps principles, breaking down silos and fostering collaboration among diverse teams and skills are crucial to overcoming inefficiencies and ensuring data-driven business advancements. Secure and ethical data management also remains essential to mitigate risks and foster innovation. An intentional approach to tools and processes can help streamline data handling, model deployment, and the use of AI/ML for sustained stakeholder value, despite the allure of rapidly evolving tools that might fragment organizational cohesion.

The tutorial simplifies the process of setting up and managing a Kubernetes cluster using infrastructure as code (IaC) in under 20 minutes, leveraging Terraform and Helm with GitLab CI/CD pipelines. It guides users through creating two IaC repositories: "gitlab-terraform-k8s" for provisioning and managing Kubernetes infrastructure via Terraform, and "cluster-management" for defining the desired state using the GitLab Agent for Kubernetes and Helm. Essential prerequisites include an AWS or GCP account, a GitLab account, and access to a GitLab Runner. The tutorial covers setting up the GitLab Terraform Kubernetes Template, registering the GitLab Agent, and adding cloud credentials to CI/CD variables for AWS EKS or GCP GKE. It also explains setting up the Kubernetes Cluster Management Project using a GitLab template and configuring the CI/CD pipeline to deploy applications like ingress, cert-manager, prometheus, and Vault. This approach allows comprehensive cluster management entirely through code, with the potential to deploy custom applications by updating the cluster-management helmfile.

GitLab Federal, LLC has appointed Joel Krooswyk as the Federal Chief Technology Officer (CTO) to enhance its focus on the public sector within the realm of DevSecOps. This newly created position underscores the significance of government agencies in the development of DevSecOps practices and emphasizes GitLab's commitment to supporting these entities in software development, compliance, and security. Krooswyk, with over 25 years of experience in the software industry, will play a crucial role in ensuring GitLab's active participation in shaping DevSecOps standards and practices through collaboration with standards bodies, Congressional committees, and industry groups. His appointment is seen as a strategic move to foster stronger relationships with federal DevSecOps professionals, aiming to streamline and secure their software development environments. Krooswyk, who has been with GitLab since 2017, expressed enthusiasm about contributing to the advancement of DevSecOps practices in the public sector, particularly in areas like software supply chain security and regulatory compliance.

GitLab accelerated the adoption of phishing-resistant authentication methods following significant phishing campaigns that breached various tech companies, opting for WebAuthn devices as the sole method for logging into Okta, their main SaaS application platform. This shift was necessary due to the vulnerabilities associated with other multi-factor authentication (MFA) methods, such as SMS, TOTP codes, and push notifications, which are susceptible to various types of attacks. The company communicated this transition through a series of initiatives, including a Slack announcement from the CEO, a dedicated FAQ document, and virtual office hours for support. Despite the challenge of transitioning over 1,700 remote team members across more than 65 countries within a tight 48-hour deadline, GitLab successfully enrolled 93% of its employees in the new system by leveraging existing technologies like Touch ID and YubiKeys, along with a significant communication strategy. The implementation was further facilitated by the discovery of a QR code scanning method for enrolling new devices, reducing the need for direct IT support and reinforcing the company's security posture efficiently.

This text provides a guide on using Git rebase techniques to streamline commit histories in daily development workflows. It emphasizes the use of the "fixup" feature to integrate follow-up commits into their corresponding feature-implementing commits, thus cleaning up unnecessary standalone commits. The process involves identifying related commits using "git blame," performing an interactive rebase to reorder and merge commits, and utilizing the "autosquash" option to automate the integration of "fixup" commits. Additionally, it mentions alternative tools like git-absorb and git-autofixup that facilitate the absorption of commits, thereby enhancing the efficiency of version control management.

Organizations are increasingly compelled to integrate security into their software development lifecycles due to federal and industry mandates, which have rendered security a necessity rather than a luxury. A comprehensive DevSecOps strategy is essential to protect the software supply chain, which is vast and complex due to the use of open source and third-party components. This complexity creates a wide attack surface that includes vulnerabilities in open source software, in-house code, misconfigured CI/CD pipelines, and undiscovered vulnerabilities in web APIs. DevSecOps teams must be vigilant against these threats by employing tools and processes like version control, multi-factor authentication, and automated security scanning. The concept of zero trust, which involves scrutinizing all components for potential threats, is crucial, and while it can significantly reduce breach costs, many organizations have not yet fully implemented it. The ease of launching cyber attacks has increased as cybercriminals can now build on past malicious software, such as the Mirai malware, and utilize a wide array of malicious tools. To mitigate these risks, organizations must understand and manage the threat vectors within their software supply chain to ensure their development lifecycle supports innovation rather than becoming a vulnerability.

The text explores the concept of "10x engineers" and their impact on development organizations, emphasizing the challenges of maintaining efficient operations without devolving into bureaucracy and inefficiency. It draws parallels between software development and other fields, highlighting the importance of rapid iteration and real-world feedback in achieving breakthroughs. Using examples like Paul MacCready's Gossamer Condor and SpaceX's iterative approach to rocket development, the text illustrates how embracing risk and accelerating iteration cycles can lead to significant advancements. The discussion extends to software development, advocating for short cycle times as a critical factor in team performance, supported by research from the book "Accelerate." The text argues that the scientific method, involving iterative experimentation and real-world feedback, is crucial for innovation and cautions against relying solely on planning without practical testing. It concludes with a metaphor comparing navigation methods, emphasizing the necessity of regular external checks to prevent errors from accumulating, akin to maintaining a clear understanding of progress in software projects.

OpenSSL has identified two vulnerabilities, CVE-2022-3786 and CVE-2022-3602, impacting versions 3.0 to 3.0.6, which relate to X.509 email address buffer overflows that could lead to denial of service or, under certain conditions, remote code execution. These vulnerabilities, originally considered critical but later downgraded to high, can be mitigated by upgrading to OpenSSL 3.0.7, which includes necessary patches. The vulnerabilities stem from punycode decoding in X.509 certificates, first introduced in OpenSSL 3.0.0, and do not affect earlier versions like 1.0.2 and 1.1.1. Organizations using OpenSSL 3.0 should assess their software supply chain's exposure using tools like GitLab's dependency and container scanning. GitLab has confirmed that its production systems remain unaffected, though it has updated its DAST analyzer to address the issue. It is advised for organizations to upgrade to OpenSSL 3.0.7 to secure their systems against these vulnerabilities.

React is a widely-used JavaScript library for building user interfaces, and this tutorial provides a step-by-step guide to creating a new React application and integrating unit tests into a GitLab CI pipeline. It begins with setting up a GitLab project and cloning the repository locally, followed by using Create React App to initialize the application. The tutorial then explains how to run default unit tests using Jest, and emphasizes the importance of generating test reports and code coverage statistics for CI pipelines. It introduces the jest-junit library to produce JUnit format XML reports and outlines the process of adding a test:ci script to package.json to facilitate automated test execution. Furthermore, it details creating a .gitlab-ci.yml file to define a test stage and a unit-test job, which utilizes the latest Node.js image to run tests and generate coverage reports. The tutorial concludes by guiding users on pushing changes to GitLab, triggering the CI pipeline, and reviewing test results and coverage statistics, thus enabling automated testing in the development workflow.