Unlucky for some, GitLab 13.0 is DevSecOps in a box, but will it play nicely with others?
(2020/05/22)
- Reference: 1590152412
- News link: https://www.theregister.co.uk/2020/05/22/gitlab_130_released_devsecops_in/
- Source link:
GitLab version 13.0, the company's major release of 2020, is out today.
Rival GitHub is the biggest player in online code repositories, with Atlassian's Bitbucket and GitLab also popular. GitLab is a distinctive proposition, though, aiming to be the only platform you need for DevSecOps, whereas GitHub and Bitbucket have a narrower focus.
GitLab covers a suite of applications including management, planning, source code and issue tracking, continuous integration and continuous delivery, security testing, Kubernetes management, monitoring, and a Kubernetes web application firewall. The core of GitLab is also open source, unlike GitHub or Bitbucket, and the free [1]Community Edition is popular for self-hosting.
[2]
A GitLab issue board (click to enlarge)
The remote-only firm's development process is open, so anyone can track what each team is doing, and is also based on the Agile principle of [3]minimum viable product , which means new features are introduced with basic functionality and then enhanced.
The company is therefore not about big surprises, but rather continuous improvement, and when new stuff does get added, it is flagged well in advance. You can find exhaustive coverage of what's new in 13.0 in the company's "kickoff" videos [4]here or, if you prefer text content, [5]here .
There is a focus on security in this release, including easier responsible disclosure – since GitLab is now a CVE Numbering Authority. It will soon be possible to request a CVE from within the GitLab user interface. There is also new static analysis security testing for .NET Framework code; previously this only covered .NET Core, and DAST (Dynamic Application Security Testing) for REST APIs, a key part of many modern applications.
Users of the Community Edition get a significant new feature in 13.0, which is design management, previously a GitLab Premium feature. "We've considered our users who are designing products as individual contributors," explain the release notes.
Progressive Delivery, the idea of targeting releases at a subset of users rather than rolling out new features to everyone immediately, is another theme. Feature flags lists, a collection of tagged features for inclusion or exclusion from a release, now has API support for creating, editing and deleting them. A/B testing based on feature flags is promised soon, as is the ability to create feature flags from merge requests.
Brendan O'Leary, senior developer evangelist, told The Reg that a key new feature is Gitaly Cluster support. "Git itself can be hard to scale, it is a filesystem-based database," he said. "That works great on NFS but in the cloud world it's a challenge. Our solution has been the open-source product Gitaly, which is a gRPC between Git and a system that's consuming Git. What's coming in 13.0 is Gitaly clusters' which is the ability to have multiple write destinations for that, so you can now shard your data and have it be highly available. It removes the requirement for NFS."
GitLab's ambition to provide everything in one application makes it unpopular with specialist DevOps vendors for whom it is a threat. Does GitLab play nicely with others? "We think that the more you can adopt a single application the more benefits you get, but that's not realistic for an enterprise tomorrow, they're not going to throw everything they have out," said O'Leary. "We have in our handbook that we need to interoperate with others, and we've got a lot better at that recently. We've got an ecosystem team now that's responsible for how we play with others and we didn't used to have that. Another thing we've added is first-class support for other security scanning integrations."
How has lockdown affected GitLab? "There's been a huge uptick in the interest in remote," said O'Leary. "We always believed that remote was the future of work. On the business side we're seeing enterprises struggle but they want to be efficient. We're not seeing a huge negative impact." ®
[1] https://about.gitlab.com/install/ce-or-ee/
[2] https://regmedia.co.uk/2020/05/22/gitlab-issues.png
[3] https://www.agilealliance.org/glossary/mvp
[4] https://www.youtube.com/watch?v=knWoPiKiwuw&list=PL05JrBw4t0KqWysAAKFYYIE2Tf9IZB5bv
[5] https://release-13-0.about.gitlab-review.app/releases/2020/05/22/gitlab-13-0-released/index.html
Rival GitHub is the biggest player in online code repositories, with Atlassian's Bitbucket and GitLab also popular. GitLab is a distinctive proposition, though, aiming to be the only platform you need for DevSecOps, whereas GitHub and Bitbucket have a narrower focus.
GitLab covers a suite of applications including management, planning, source code and issue tracking, continuous integration and continuous delivery, security testing, Kubernetes management, monitoring, and a Kubernetes web application firewall. The core of GitLab is also open source, unlike GitHub or Bitbucket, and the free [1]Community Edition is popular for self-hosting.
[2]
A GitLab issue board (click to enlarge)
The remote-only firm's development process is open, so anyone can track what each team is doing, and is also based on the Agile principle of [3]minimum viable product , which means new features are introduced with basic functionality and then enhanced.
The company is therefore not about big surprises, but rather continuous improvement, and when new stuff does get added, it is flagged well in advance. You can find exhaustive coverage of what's new in 13.0 in the company's "kickoff" videos [4]here or, if you prefer text content, [5]here .
There is a focus on security in this release, including easier responsible disclosure – since GitLab is now a CVE Numbering Authority. It will soon be possible to request a CVE from within the GitLab user interface. There is also new static analysis security testing for .NET Framework code; previously this only covered .NET Core, and DAST (Dynamic Application Security Testing) for REST APIs, a key part of many modern applications.
Users of the Community Edition get a significant new feature in 13.0, which is design management, previously a GitLab Premium feature. "We've considered our users who are designing products as individual contributors," explain the release notes.
Progressive Delivery, the idea of targeting releases at a subset of users rather than rolling out new features to everyone immediately, is another theme. Feature flags lists, a collection of tagged features for inclusion or exclusion from a release, now has API support for creating, editing and deleting them. A/B testing based on feature flags is promised soon, as is the ability to create feature flags from merge requests.
Brendan O'Leary, senior developer evangelist, told The Reg that a key new feature is Gitaly Cluster support. "Git itself can be hard to scale, it is a filesystem-based database," he said. "That works great on NFS but in the cloud world it's a challenge. Our solution has been the open-source product Gitaly, which is a gRPC between Git and a system that's consuming Git. What's coming in 13.0 is Gitaly clusters' which is the ability to have multiple write destinations for that, so you can now shard your data and have it be highly available. It removes the requirement for NFS."
GitLab's ambition to provide everything in one application makes it unpopular with specialist DevOps vendors for whom it is a threat. Does GitLab play nicely with others? "We think that the more you can adopt a single application the more benefits you get, but that's not realistic for an enterprise tomorrow, they're not going to throw everything they have out," said O'Leary. "We have in our handbook that we need to interoperate with others, and we've got a lot better at that recently. We've got an ecosystem team now that's responsible for how we play with others and we didn't used to have that. Another thing we've added is first-class support for other security scanning integrations."
How has lockdown affected GitLab? "There's been a huge uptick in the interest in remote," said O'Leary. "We always believed that remote was the future of work. On the business side we're seeing enterprises struggle but they want to be efficient. We're not seeing a huge negative impact." ®
[1] https://about.gitlab.com/install/ce-or-ee/
[2] https://regmedia.co.uk/2020/05/22/gitlab-issues.png
[3] https://www.agilealliance.org/glossary/mvp
[4] https://www.youtube.com/watch?v=knWoPiKiwuw&list=PL05JrBw4t0KqWysAAKFYYIE2Tf9IZB5bv
[5] https://release-13-0.about.gitlab-review.app/releases/2020/05/22/gitlab-13-0-released/index.html
Gitlab CI is pretty good, but its still missing some features that other tools we have used (well, Jenkins) provides out of the box. For instance, coverage and defects. Both Jenkins and Gitlab track coverage and defects (ie linting errors, static analysis etc), but Jenkins can provide graphs of historical coverage, and fail a pipeline if coverage percentage decreases. Gitlab can only report the current numbers, there are no dashboards of historical coverage.
For test reports, Gitlab and Jenkins can both parse junit xml test reports, but gitlab will just tell you how many tests have failed in the merge request, where as Jenkins will provide a deep dive in to what test failed, why, what the expected output was etc. For defects, Jenkins will show you a file by file report that you can drill in to and see the specific lines that have defects. Gitlab just shows you a raw number of defects.
I do massively prefer how Gitlab CI is setup and run, its much easier to setup your pipelines. I was never fond of writing Groovy scripts to run the pipelines.
Maybe these things are available with Gitlab Ultimate; we're just Bronze level subscribers. Ultimate is an extra $15 per seat per month..