May 2023 Summaries

Implementing best practices in a DevSecOps methodology is crucial for securing development environments, particularly when using GitLab.com. The guide details how to control access to source code, build pipelines, repositories, and deployment keys, emphasizing the importance of settings at both group and project levels. It recommends various security measures, such as making group visibility private, enforcing two-factor authentication, and using SAML SSO for authentication. The document highlights the importance of auditing and compliance by regularly reviewing compliance reports and streaming audit events to a corporate SIEM system. Group-level push rules, such as requiring verified committers and preventing the pushing of secret files, are suggested to prevent malicious code injection. For CI/CD pipeline integrity, the guide advises using protected runners and variables, restricting access to pipeline definition files, and storing sensitive files securely. Project-level security testing, including static application security testing and dependency scanning, is recommended to detect vulnerabilities and ensure the software supply chain's security.

Contributing to open source projects like GitLab provides valuable learning experiences in software development, as seen through the experiences of Mughees Pervaiz and Young Jun Joo during their fellowship with Major League Hacking. Pervaiz focused on enhancing the user interface by updating expand/collapse buttons in GitLab's roadmap feature, which involved collaborating with various team members and learning the importance of thoroughly understanding a problem before coding. Meanwhile, Joo improved GitLab's search function by implementing a memoization algorithm to cache search results, significantly enhancing the speed and efficiency of searches for users. Both contributions not only improved GitLab's functionality but also deepened the fellows' understanding of software optimization and collaboration within the open-source community.

GitLab's blog post discusses the integration of AI/ML into its DevSecOps platform, focusing on the introduction of a feature called Code Suggestions, which utilizes a large language model to enhance developer productivity by streamlining coding tasks. Code Suggestions assists developers by automating tasks such as importing packages, completing functions, generating boilerplate code, manipulating data frames, and creating unit tests, thereby reducing the need for web searches and speeding up workflows. Currently in Beta and available for free on GitLab.com, this feature supports 13 programming languages, including Python, Java, and JavaScript, with ongoing improvements to the AI model to enhance suggestion quality. Users are encouraged to analyze AI-generated code for quality and security, and GitLab emphasizes that product details are subject to change, advising caution in relying on the information for planning or purchasing decisions.

This tutorial provides a comprehensive guide on using AWS Fargate-backed Elastic Kubernetes Service (EKS) for running GitLab Runners, addressing a long-standing demand from customers. It introduces a streamlined setup process that utilizes AWS CloudShell, Terraform, and EKS Blueprints, enabling users to quickly deploy GitLab Runners with enhanced scalability and flexibility. The tutorial highlights the challenges and solutions related to image management with AWS ECS and explores how EKS, by nature, can overcome these limitations. It also emphasizes the benefits of using a product-managed Infrastructure as Code (IaC) framework, like EKS Blueprints, for creating extensible and maintainable solutions. The guide demonstrates the ability to run multiple parallel jobs effectively, showcasing the potential for significant scalability, and discusses the trade-offs and costs associated with using Fargate. Additionally, it encourages contributions from the community to further enhance the project and adapt it to real-world scenarios.

GitLab has expanded its Registration Features program, which allows free self-managed users of GitLab Enterprise Edition to access paid features by registering and sharing activity data via Service Ping. This expansion includes five new features: enhanced password complexity requirements for increased account security, tracking of changes in issue descriptions to facilitate collaboration, configurable issue boards tailored to team needs, coverage-guided fuzz testing to detect bugs and security issues, and a Maintenance Mode to minimize write operations during maintenance tasks. These additions join existing features like email notifications, repository size limits, and IP address access restrictions. Interested users can participate by enabling Service Ping.

Cloud-based development tools are increasingly favored for their consistent and secure developer experiences, which expedite onboarding and enhance productivity. GitLab's introduction of remote development upgrades in GitLab 16.0 marks a significant advancement with the Beta release of secure, on-demand, cloud-based development workspaces for Premium and Ultimate users. These workspaces offer a personal, ephemeral environment in the cloud, allowing developers to focus on coding rather than environment configuration, and ensure stability and reproducibility between sessions. To create a workspace, users need a cloud platform or self-hosted Kubernetes cluster, a GitLab Agent for Kubernetes, a .devfile.yaml file to define the environment, and an editor such as the Web IDE. The default lifespan of a workspace is 24 hours, but it can be extended to a week. GitLab is seeking feedback on this Beta release, with plans to address issues like credential injection and support for additional editors and architectures. The initiative aims to integrate workspaces into the DevSecOps workflow, improving developer experiences and resource management.

Securing your GitLab instance involves a process known as hardening, which focuses on disabling unused features and adjusting settings to minimize security risks while maintaining user productivity. This approach is guided by principles such as layered security, which advocates for multiple security measures, and avoiding security through obscurity, as obscurity is ineffective against modern scanning tools. Key strategies include reducing the attack surface by disabling unnecessary services, enabling multi-factor authentication, enforcing stringent sign-up checks, limiting public visibility of projects, hardening SSH settings, and securing CI secrets. Additionally, protecting pipelines for all branches ensures the integrity of automated tasks within CI/CD processes. Detailed documentation is available to support these efforts, ensuring that GitLab's security practices align with its commitment to transparency and open source.

GitLab is exploring the integration of AI/ML into its DevSecOps platform, focusing on enhancing the code review process by summarizing merge request feedback using AI-generated summaries. This initiative, led by Senior Frontend Engineer Stanislav Lashmanov, aims to streamline the review process by helping authors quickly understand feedback and necessary revisions, thereby accelerating cycle times. Although currently experimental, GitLab is iterating on these AI/ML features to better integrate them into the development workflow and enhance user efficiency across the software development lifecycle. The company encourages interested users to join a waitlist to access these features and contribute ideas, while noting that product details and timelines are subject to change.

GitLab is advancing its integration of AI/ML into its DevSecOps platform by introducing Code Suggestions, a feature currently in Beta, that uses generative AI to suggest code during development, available for free on GitLab.com. Initially supporting six programming languages, the feature now accommodates 13, including popular languages like Java, Python, and TypeScript, with weekly improvements to its AI model. Privacy is a core concern, ensuring proprietary code remains secure within GitLab's infrastructure and is not used to retrain AI models. Currently, Code Suggestions can be accessed in VS Code through the GitLab Workflow extension, with plans for broader IDE support, including JetBrains and Visual Studio, and eventual availability for self-managed instances. The feature aims to enhance efficiency by aiding developers in minimizing routine and time-consuming tasks, and GitLab encourages user feedback to refine the experience, while also cautioning that the feature may experience unscheduled downtime and variable suggestion quality. This development is part of GitLab's broader initiative to embed AI/ML capabilities across the software development lifecycle, with further details and updates shared through their ongoing blog series on AI/ML in DevSecOps.

Lockheed Martin's 1LMX initiative aimed to streamline its business processes by consolidating its diverse DevOps tools into a unified system using GitLab's DevSecOps Platform on AWS. This transformation has significantly enhanced collaboration, innovation, and efficiency across Lockheed Martin's numerous programs, such as satellite and aerospace systems, by enabling a shift from monthly to every-six-day testing cycles and reducing system maintenance time by 90%. The integration has led to the creation of 64,000 projects and 110,000 daily continuous integration builds over three and a half years, while also retiring thousands of servers. As demand grew, AWS collaborated with Lockheed Martin and GitLab to further optimize the deployment process, achieving fully automated and scalable architecture, leading to operational efficiencies like reducing build request queues from 200 to zero. With 20,000 current users of GitLab, Lockheed Martin plans to expand their usage and migrate more projects to the platform, showcasing the potential of digital transformation in large enterprises.

Revamping GitLab's navigation aimed to enhance user experience by addressing three primary themes: minimizing user overwhelm, orienting users across the platform, and enabling users to easily pick up where they left off. The redesign process involved visualizing multiple concepts to address the increasing complexity and disorientation faced by users due to inconsistent navigation elements like sidebars and breadcrumbs. Through testing various layout ideas, such as the "Super Sidebar" and "Element Reswizzle," GitLab's team found that the "Super Sidebar" was favored for its intuitive navigation and ability to support diverse workflows. The final design incorporated valuable elements from both concepts, emphasizing a cohesive and user-friendly interface while iterating on user feedback. The team focused on foundational aspects before refining details like color, font, and iconography, all to ensure a seamless user experience. As GitLab continues to evolve, the navigation system remains a work in progress, with ongoing feedback and improvements anticipated beyond the 16.0 release.

The Friendly Linux Players (FLiP) is a community dedicated to enhancing the gaming experience on Linux by promoting inclusivity and participation. Initiated in 2017 by Andrew Conrad, the group aims to create a welcoming environment for gamers, addressing the intimidation often associated with Linux gaming. FLiP utilizes GitLab to build a transparent, open-source community where members can contribute to projects like the flip-matrix-bot, which facilitates event scheduling and management. The community hosts regular gaming events, emphasizing a supportive atmosphere for players of all skill levels. FLiP also focuses on overcoming technical and social barriers within Linux gaming, providing a space where members can seek both technical support and a sense of belonging. Emphasizing a strong code of conduct and the use of open-source platforms, FLiP is committed to maintaining a safe and inclusive environment, appealing particularly to those deterred by toxicity in other gaming spaces. Members like Stephan Lanfermann and Nell Hardcastle highlight the community's focus on inclusivity, and the group continues to grow through its commitment to these values.

GitLab is enhancing its DevSecOps platform by integrating AI and machine learning (ML) capabilities, including the introduction of Machine Learning Model Experiments available to all users. This feature allows organizations to track various versions of ML models using the open-source MLFlow directly within the GitLab user interface, eliminating the need for users to manage a separate server. By acting as an MLFlow backend, GitLab simplifies the experiment tracking process without requiring data scientists to alter their existing workflows significantly. Users can manage access, explore experiments, and download candidate data via GitLab's UI, facilitating ease of use and collaboration. GitLab aims to support the full ML lifecycle, from creation to deployment, and invites user feedback to refine these experimental features further, emphasizing that all information is subject to change.

GitLab and Red Hat have strengthened their collaboration by integrating GitLab with Red Hat's OpenShift cloud-based container platform through the development of the GitLab Runner Operator, initially introduced in GitLab Version 13.3, and now the GitLab Operator, which is certified by Red Hat. This certification allows for a self-managed instance of GitLab to operate within an OpenShift cluster, offering streamlined installation, seamless version upgrades, and alignment with Red Hat's Universal Base Image (UBI) for deployment. This integration signifies a significant technical achievement, providing customers with confidence that GitLab is effectively supported on OpenShift. The GitLab Operator is available for testing in the OpenShift console and will be production-ready in Q3 2023, enabling organizations to utilize GitLab on the same trusted infrastructure as their other applications and services.

Protestware, a term for software packages modified to convey political messages, has gained attention following incidents such as the 2016 npm project withdrawal and the 2022 'colors' and 'faker' package sabotage, both of which underscore ethical concerns and emphasize the need for a zero trust security model in software supply chains. These events have highlighted the importance of securing dependencies and adopting proactive measures to protect software supply chains. Recommendations include implementing dependency scanning, generating provenance validations, utilizing private registries, and enabling dependency proxies to ensure safe and reliable use of open source software. Tools like GitLab facilitate these security practices through features such as artifact attestation, package registry permissions, and dependency proxy settings, which collectively help organizations manage vulnerabilities and maintain control over their software dependencies.

GitLab's initiative to enhance its platform through internal testing, known as dogfooding, focuses on security testing with the API fuzzing project. The project aims to integrate Web API Fuzz Testing into the DevSecOps lifecycle, identifying bugs and potential security issues by generating unexpected inputs to a web API. GitLab built an OpenAPI specification for its endpoints using the grape-swagger gem, overcoming challenges with edge cases and wildcard parameters. Performance tuning involved splitting tests into multiple jobs and optimizing resources, while triaging hundreds of findings required careful analysis to distinguish true vulnerabilities from unexpected behavior. The project leveraged GitLab's features like Review Apps and dynamically generated pipelines to facilitate the workflow, resulting in improved API documentation and identification of key process pain points. Future efforts may involve moving to OpenAPI v3 and utilizing tools like the HAR Recorder to enhance the fuzzing process, with the workflow best suited to scheduled pipelines due to its high compute cost.

GitLab 15.11 introduces a new feature that allows users to define input parameters for CI/CD templates, enhancing the flexibility and modularity of pipeline configurations. This feature facilitates the replacement of any keyword in the template, such as stage or job name, with a parameter, enabling better job isolation and reducing the reliance on global variables. Input parameters can be mandatory or optional and are scoped to the included configuration, ensuring they do not affect the rest of the pipeline. This functionality is part of the CI/CD Components Catalog roadmap, which aims to allow users to search and reuse CI/CD configuration units with specific parameters. The blog provides detailed instructions on creating and incorporating these templates, showcasing how parameters like website and environment can be utilized within a YAML configuration file.

GitLab is exploring the integration of AI/ML into its DevSecOps platform, as detailed in a blog series showcasing contributions from their product, engineering, and UX teams. The series highlights an experimental feature where the Global Search team has developed an AI-powered chatbot designed to answer how-to questions about GitLab's product, providing explanations and relevant documentation links directly within the GitLab interface. This feature aims to reduce the time users spend searching for answers in documentation or seeking support, particularly during complex tasks like configuring security policies or editing files. The chatbot represents the beginning of GitLab's initiative to incorporate AI/ML capabilities to enhance user efficiency and address time-consuming tasks across the software development lifecycle. Readers are encouraged to join the waitlist for these AI-driven features and to follow the ongoing blog series for further updates, while noting that the information provided is subject to change at GitLab's discretion.

GitLab has unveiled its AI strategy aimed at integrating AI throughout the software development lifecycle via its DevSecOps platform, with a focus on privacy and customer-centric solutions. The company has partnered with Google to leverage its generative AI models, ensuring that customer intellectual property remains secure within GitLab's cloud infrastructure. Current AI-assisted features available to GitLab customers include tools for developers, security, and operations teams, such as code suggestions, automated review assignments, and vulnerability explanations. These features are designed to enhance efficiency and security by automating repetitive tasks and providing insightful summaries. GitLab emphasizes continuous improvement and plans to introduce more AI capabilities throughout the year, highlighting its commitment to driving AI-driven software development.

GitLab is integrating AI/ML into its DevSecOps platform, with a focus on enhancing vulnerability management through AI-assisted recommendations. An experimental feature has been introduced, leveraging large language models to provide users with detailed explanations and example fixes for vulnerabilities within their specific codebase. This feature, powered by Google AI, aims to streamline the process of addressing vulnerabilities, particularly in static application security testing (SAST). Developed by GitLab's product and engineering teams, the feature is part of an ongoing effort to infuse AI/ML capabilities throughout the software development lifecycle, targeting tasks that are often time-consuming and challenging. Users are encouraged to explore the feature, provide feedback, and join a waitlist for further AI-generated capabilities as GitLab continues to expand its AI/ML offerings.

GitLab is introducing enhancements to its CI/CD templates by evolving them into more robust and isolated components, aiming to facilitate the reuse and sharing of pipeline configurations among developers. The recent release, GitLab 15.11, includes a Beta feature allowing users to define inputs to any includable file, which helps in creating more powerful templates without the risk of variable conflicts. These inputs are not inherited and must be explicitly passed, supporting CI/CD interpolation for flexibility. GitLab plans to release an experimental version of CI/CD pipeline components in version 16.0, which will serve as the building blocks for a forthcoming CI/CD component catalog. These components aim to improve consistency, time savings, and reusability in software development processes by providing preconfigured, versioned, and scalable solutions. The CI/CD component catalog is expected to streamline development processes, enhance software delivery quality, and make it easier for developers to discover and utilize preconfigured components, with further updates and resources promised in the coming months.

GitLab is set to launch a redesigned navigation system, developed from extensive user feedback, to improve user experience and workflows. Recognizing the critical role navigation plays, GitLab dedicated a team to this project, focusing on user experience (UX) research and design ideation over nine months. The redesign process was guided by three core themes: minimizing user overwhelm, aiding orientation across the platform, and enabling users to easily resume tasks. These themes were tested with various user personas to ensure alignment with user needs. GitLab has historically iterated rapidly, but this project required a pause for a comprehensive revision to avoid degrading the current user experience. The new navigation, including features like "Your Work" and "Explore" menus, is designed to enhance usability without disrupting core workflows. To ease the transition, the new navigation will include an on/off switch, allowing users to toggle between the new and old systems and provide feedback. The rollout will be gradual, with users able to opt-in via their profile menu, and further updates will be shared on GitLab's various communication channels.