February 2023 Summaries

Securing CI/CD workflows poses challenges that are addressed through technologies like JWT tokens and OIDC authentication, as discussed in the context of GitLab's evolving security features. The integration of JWT tokens into CI/CD pipelines facilitates secure authentication between products, with GitLab gradually enhancing support from initial JWT implementations to a more secure OIDC token framework, which will become mandatory by GitLab 16.0. This transition involves moving from older methods that utilize the CI_JOB_JWT variable and Hashicorp Vault integration to a more secure OIDC token that can authenticate with various cloud services like AWS and GCP. The security of sensitive information stored in CI/CD workflows is emphasized, with recommendations for using secrets management solutions and configuring pipelines to limit the exposure of JWTs to only necessary jobs, thereby enhancing overall software supply chain security. This strategic shift aims to mitigate risks associated with token exposure and improve the security and efficiency of DevOps processes, while ensuring backward compatibility until the full transition to the new system.

Machine learning is increasingly being integrated into DevSecOps workflows through tools like OctoML CLI, which can now be incorporated into GitLab's CI/CD pipelines to streamline model deployment and optimize performance. This integration aims to prevent issues like bugs and model performance degradation early in the ML development cycle by leveraging existing infrastructure for deployment and monitoring. OctoML offers a service that optimizes machine learning models for cost efficiency and performance by using various acceleration engines and suggesting optimal hardware configurations on platforms like AWS, Azure, or GCP. The integration supports automation and repeatability in deploying and retraining models, addressing challenges such as data drift that can affect model accuracy over time, especially in industries like retail where seasonality plays a role. By adapting models to specific hardware capabilities, OctoML enhances inference speed and reduces costs, ultimately improving the user experience and efficiency of ML applications. The workflow consists of stages for setting up, packaging, deploying, and testing models, with OctoML CLI providing the necessary tools to execute these processes efficiently. With published tutorials and support for various model types, OctoML and GitLab CI/CD offer a unified approach to managing software and ML pipelines, facilitating both local and cloud deployments.

Security in the software supply chain presents a significant opportunity for impact within the DevSecOps domain, with frameworks like SLSA and SSDF seeing partial but not universal adoption. Todd Kuleza from Google Cloud emphasizes the importance of these practices in enhancing security, particularly through CI/CD processes and automated security checks that empower developers to manage security effectively, thereby reducing burnout. The DORA team's research highlights that cultural factors, such as high-trust and low-blame environments, play a crucial role in the adoption of security practices, influencing both organizational performance and developer well-being. Over 50% of developers now bear full responsibility for security in their organizations, and organizations with poor security practices face higher burnout risks. The integration of security culture with technology remains essential for advancing DevSecOps, with DORA metrics providing a data-driven framework to align software delivery with business objectives.

Counting, a fundamental yet often overlooked concept, forms the basis of statistics and, by extension, many disciplines that rely on statistical analysis. The blog post explores the significance of counting within the context of software development, particularly in assessing code stored in GitLab. It discusses the practice of counting lines of code, acknowledging its limitations as a metric while highlighting its utility in various scenarios such as cost assessment, understanding language competencies, and evaluating tech debt. The post further explains the development of a GitLab CI extension for code counting, which employs strategies to manage shared libraries, optimize cloning processes, and automate reporting. Additionally, it describes an innovative approach to assess the complexity of Merge Requests by analyzing code changes, which helps in managing deployment risks and review times. The narrative also emphasizes the value of remote work interactions, illustrating how a casual "coffee chat" led to collaborative improvements in the code counting solution, showcasing GitLab's culture of fostering innovation through informal communication.

In an era of overwhelming information accessibility, website performance is crucial for user engagement, particularly in the context of short attention spans. Total Blocking Time (TBT) is a key metric that measures the unresponsiveness of a website by calculating the time during which tasks block the browser's main thread, preventing user interaction. This metric is assessed between the First Contentful Paint (FCP) and Time to Interactive (TTI), focusing on long tasks exceeding 50 milliseconds. Improving TBT involves strategies like lazy-loading images, reducing HTML, and optimizing component usage in frameworks like VueJS. Techniques such as server-side rendering, using the Intersection Observer API, and leveraging CSS properties like content-visibility: auto can significantly enhance page performance. By employing these methods, an example showed a reduction in TBT from about three seconds to approximately 500 milliseconds. Incremental optimizations can lead to substantial improvements in website responsiveness, ensuring adaptability in an ever-evolving digital landscape.

Organizations adopting GitLab often need to import existing data like code, build pipelines, and issues from other tools or GitLab instances, making seamless data migration crucial. GitLab's dedicated group:import team focuses on facilitating this process by continuously improving importers, allowing for easy data transfer, especially from self-managed GitLab instances to GitLab.com. The preferred method for migrating data is group migration, which automates the import of entire group structures and projects. However, in environments with limited connectivity, a manual file-based import/export method remains available, though GitLab aims to phase it out to encourage automation. GitLab also supports importing projects from external tools, notably GitHub, adapting to structural differences between the platforms to ensure comprehensive data transfer. The GitHub importer is particularly emphasized, with ongoing efforts to enhance its capabilities despite challenges in mapping features between GitHub and GitLab. An alternative import method, "Repository by URL," allows users to import Git repositories via HTTP, further broadening GitLab's data migration flexibility.

GitLab 15.7 introduced a change where file type variables in CI jobs are no longer expanded, which previously allowed the contents of a file to be accessed through another variable, resulting in errors for jobs that utilized this behavior. This change was made to enhance security by preventing the potential exposure of sensitive data in the build environment, as file expansion could inadvertently reveal such information. Before version 15.7, users found variable expansion useful, but it also posed security risks, leading to its deprecation in version 15.5 and removal in 15.7, although a follow-up removal notice was not included, causing some upgrading users to miss the deprecation notice. Users need to review their CI jobs to identify and amend any instances where file variables are referenced within other variables to ensure their workflows continue to function after the upgrade. GitLab continues to refine its processes for communicating the impact of feature changes, emphasizing the complexity of secrets and variable handling within DevSecOps platforms and encouraging users to contact the Verify team for clarification on how changes might affect workflows.

GitLab CEO Sid Sijbrandij announced a 7% reduction in the company's workforce, attributing the decision to the challenging macroeconomic environment and the need for a more conservative approach to software investments. Despite attempts to adjust spending priorities, the ongoing global economic downturn necessitated further measures to align expenditure with responsible growth. The layoffs, described as a difficult decision, affect talented team members who have significantly contributed to GitLab's progress. Those departing will receive support including transitional pay, severance equivalent to four months' salary, accelerated equity vesting, healthcare coverage, and mental health support. Additionally, departing employees can retain their hardware and will receive career support services. For those remaining, GitLab plans to hold Ask Me Anything sessions to address concerns and questions.

In a recent strategic move, GitLab has chosen to integrate Flux CD, a leading GitOps solution, with its existing Kubernetes agent, marking Flux CD as the preferred method for implementing GitOps within GitLab. This decision stems from Flux's seamless integration capabilities with GitLab's UI and its reliance solely on the standard Kubernetes API, in contrast to other contenders like ArgoCD, which use custom APIs. GitLab aims to enhance user experience by building out various integrations, including a Kubernetes UI within GitLab and streamlining access management to reduce the complexity of handling multiple deploy keys. The transition will not impact the current functionality of the Kubernetes agent, and GitLab plans to provide extensive documentation to assist users in adopting Flux. The integration is expected to be fully realized by the GitLab 17.0 release in 2024, with a focus on enabling existing Flux users to transition smoothly. GitLab is actively engaging with the Flux community to contribute and collaborate on the development of this integration.

Cube, a software development company in the Netherlands, faced challenges with a fragmented toolchain and sought a comprehensive solution to unify development, security, and operations teams while enhancing collaboration with customers. They transitioned to GitLab's DevSecOps Platform, which streamlined their operations by providing a single source of truth and improving CI/CD delivery speed and SLA response times. Previously relying on a mix of Bitbucket, Trello, and Jira, Cube found GitLab to be a more efficient all-in-one solution that facilitated fast adoption across the organization, growing their user base from 20 to nearly 70 in three years. GitLab's integration into their workflow has simplified processes, allowing for easy communication among clients, designers, developers, and project managers, while its CI/CD capabilities prevent bugs and ensure timely feature deployment. GitLab's Agile features have centralized communication and project management, allowing Cube to manage epics and milestones effectively, leading to improved efficiency and successful project deliveries. The success of the GitLab migration is measured by tracking lead time, delivery phase efficiency, and compliance with customer agreements, resulting in a more valuable and informative development process.

DevSecOps emphasizes the integration of security within the DevOps framework, highlighting that the current separation between development and security teams leads to inefficiencies and missed opportunities for collaboration. The friction typically arises from differing objectives, with developers focusing on rapid product releases and security teams prioritizing risk management. Despite increased security scanning, vulnerability reduction remains a challenge due to lack of prioritization by developers. The text argues that emergencies often force these teams together, but this is not an ideal time for collaboration. Instead, the focus should be on unifying the functions of development, security, and operations through cultural, organizational, and technical changes. DevSecOps should involve reducing delivery times, automating bug remediation, and ensuring transparent collaboration among stakeholders. The text compares the need for this integration to past efforts in the healthcare industry to enforce hygiene compliance, suggesting that technological solutions should drive the necessary behavioral changes. GitLab is positioned as a platform that can support the transition to DevSecOps by fostering collaboration and improving software security and delivery speed.

The blog post explores the extensive capabilities of the python-gitlab library, an API abstraction tool designed for interacting with GitLab's REST API without the need for raw HTTP requests. It details both basic and advanced use cases, such as automating repetitive tasks, managing GitLab objects, handling pagination, and working with object relationships. The post further delves into DevSecOps workflows, illustrating scenarios like moving epics between groups, ensuring compliance by maintaining consistent project settings, and integrating API scripts into CI/CD pipelines for optimized DevSecOps practices. It emphasizes the importance of automation in improving efficiency and provides practical examples and code snippets for implementing various operations. Additionally, the post highlights development tips, such as the use of lazy objects, object-oriented programming, and advanced configurations, to enhance the performance and maintainability of API scripts, encouraging contributions from the community to further evolve the library and its use cases.