GitLab ⛅🌱 Cloud Seed, 7 Jan 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: 2021-01-07 5min Production App update meeting

Description

Direction: https://about.gitlab.com/direction/5-min-production/

A

We're back from vacation and ready to dive back into the five-minute production, app dimitri. Take it away.

B

Yes, hi everyone happy new year. My name is dmitry and yeah. This is a regular sync on five minute production app and I will do a short demo showing the progress since last year, and for that let me share the screen. First, okay,.

B

So there are a few things: one is a small one and it's we switched from uh nip.io to our own ip resolver and if you deploy application with five minute production app lately you'll get a different url and it will be our own ip resolver here.

B

So this will help us a self-certification, because there is a limitation how many certificates per domain you can generate and yeah. This is a temporary solution which will further extend with more domains available right now, it's pretty manual but well it works and you can actually deploy your application with a valid ssl certificate. So this first thing that is nice. uh The second one is.

B

Also small, but it's nice so in deploy job. You now have a url of of your environment here so yeah. If I click on the link, I can get to the uh deployment without going to the operations, environments and so on.

B

So those are two changes and uh small change. Number three is that we no longer require from you uh email for certificate, so what we are going. What we are doing now is that we are using a service desk email that is generated for each project in gitlab by default and we use it for generating a uh ssl certificate. The extra benefit of this is that once yeah, once your certificate runs out of time and there will be an email on your email address, it will be converted to the issue in the project.

B

So there's uh a really nice integration of different gitlab features together.

B

So those are small nice improvements for user in particular and now back to the new feature, and the feature is smtp support.

B

So one of the essentials of production application is sending emails, and since we are using ews for uh deployment, we decided to use aws, uh simple email service for sending emails and it will use smtp. So basically, your and your web application with some generics, mtp library will be able to send emails.

B

All we ask from you is that you need to provide smtp from variable, and I did it with cicd variables, but you can also do it in.

B

Yaml file, so, as you see, I put uh one of my emails here and after that I run a pipeline which generated a deployment, and it also did one new thing that happened before. If you go to aws, says management console you can see that it added my email and it sent verification to it. So now, once you go to your inbox and verify this email that you are planning to use as a sender.

B

You can actually start using amazon's service from your web app.

B

What I did I did this. I used on my simple closure application and I added a few lines to it. What it does it on user sign up? It simply sends an email that hey your account, was created and it uses uh four variables from environment like smtp users, mtp password, smtp, host and smtp from, and you see, sukkot is just pretty generic sent email code.

B

Now all those variables are coming for from five minute production app. If you take a look at our readme, it's all listed here, and it should be all you need to send an email. So, let's, let's try. It live with our deployment.

B

And to just try to sign up.

B

So at this point it send an email and if I go to yeah to my ec2 instance and check out the logs I will. I will see that it was.

B

A success, I hope, let's check it out.

B

This is another small insight to five minute production app. Is that uh since it's just ec2 instance, you can always go to aws console and if something goes wrong, you just use docker locks command to see what's happening, so my application started starting port 5000 and this particular line is responsible. It says that it's success and the message was sent and it correlates with uh the source code uh in in the closure application itself.

B

Now, let's try to do the same with some other random email like yeah, like this.

B

One and we got 554 error, says message: rejected email address is not verified, and this is expected behavior. The reason why it is is because amazon sales by default works in sandbox mod, so you are not allowed to send emails to unverified addresses and if I go back to simple email, service, console and email addresses.

B

You'll see that I have those emails verified, but the ones that I try to create account is not so in order to be able to send uh email to all addresses. You need to uh to move your application from from sandbox mod to uh yeah to a production mode. For that.

C

B

Need to fill the form and it's uh yeah it's here, so you fill out the form you send it submit it for view and then uh aws will allow you to send emails to everyone before that. You want to have your email addresses in this.

B

Tab verified to be able to send, but at least at any point you will be able to see that, like hey, it works if it's rejected or if it's successful um yeah, that's pretty much for today, demo I'll stop sharing my screen now and yes. This brings us to certain.

B

Milestone of like having most of the features uh in, we still want to do radius, and that's probably what we present next week.

B

In meantime, if you yeah, if you have any questions yeah, I would love to answer.

A

A

uh Cool, I got a bunch. uh Let's start, this is great lovely progress, glad we made progress even over over this holiday season and uh I think where we keep biting them off. So really great work really excited um and I'm just poking around to see what what else is is low hanging fruit. Some of this is going to be high hanging fruit and we shouldn't pick it. So don't don't do what I suggest.

A

I I'm talking about necessarily um the first thing that comes to mind is the usage section in the vietnamese we say: hey, you can do you can put this include there or you can use the ci template. If you use the ci template, you get the entire honking thing. I think we should opine on what we want users to do. Maybe the ci template should be an include. I don't think so. I think we should just get rid of the include. I think we put it there early because we didn't have a ci template.

A

Now we have it, let's get rid of the ci template. uh Let's sorry, let's get rid of the include, I don't have an opinion either way, but I think the current thing is confusing. I think we should have convention over configuration. We should ask the user to make a choice.

B

Okay, now, here is what I think, let's, uh let's formulate a message that, like hey, use, uh ci template.

B

If you want to try, you know, like the edge version you know like be like uh test it out or like for development or testing using glute, because, like includes, is not going anywhere like it's, uh it doesn't require us. Anything just exists right because it's a yaml file and uh we need it for testing for development, so it will be always be there.

A

Yeah, I would say if you want to use the absolutely latest, so the ci template will be based on your version of gitlab. If you want to use the if your instance is not on the latest version of gitlab, you can use include to use the latest version. I would phrase yeah yeah.

A

A

We need to get out of sandbox mode for people to have like use something useful, because you want to use this email service to reset passwords of your users. You don't know your user email addresses, um maybe in the application we can give an example of the form you need to send like we can have, or even in the readme. Maybe in the maybe give an example of the form you need to send in the readme, so you can copy paste or at least see an example.

A

Now we're asking like maybe a screenshot like this is how this form probably should look like when you send it in, and this is the url where you can do so.

B

Yeah, let's set url and screenshot this field data, like example, data, so people have idea of what they put in those fields. I didn't go through the process yet so I probably like just do it and yeah like describe my experience and right now.

D

A

Let's make sure that everyone fills out five minute uh production, app applications apis reaches out like what's happening here, um the smtp from the variable that people need to fill out uh yeah. Can we use surface tests for that? Let's retie it is there is there still hope there that we can fix.

E

It there's always hope uh there.

A

E

Few things uh smtp from also acts as a flag. So if you define it, we enable that aws resource for you. If it is not defined, we don't do it. uh We wanted to automate it and use the service desk email. We tried.

A

I can, I cannot imagine someone building an application in this day and age that doesn't have password reset. So I think we should. This. Is the production app? It should have password resets. You need email to do so. I think we should give. I understand it under it. It acts as a flag, but that's I don't think we should go for that. Our audience is going to be. I just want to get running with with state full services, including email.

E

Yeah, fair enough: uh if we always want to enable it, then what we can do is instead of service desk email, we can use the gitlab user email.

E

The problem with the service desk email is that it ends with the host incoming.gitlab.com and that host is uh is tied to certain mx records. Why why? Why are those records it's tied to certain ip addresses? So aws is not authorized to send emails on behalf of that host. So.

A

ah We have this this incoming apps. Can we start another host which will just forward emails to incoming, which has much looser mx records.

E

Maybe I think we can do it, I mean we can do it. I can't do it, I don't have the skills to do it, but I'm sure it can be done. Alternatively, we can use the gitlab user email, but that again has a legal aspect.

A

A

Yeah, I do the gitlab user email for now and then make an issue with like the an explanation of the problem and a possible solution.

B

uh Yeah, so we can't use service desk email and, uh if we use like so I'm not I'm just trying to think of this like if you can build a service that is not necessary, use email then like do you want your inbox, like you know, to be spammed by those emails for every five minute production app you create and you have no control over it. Okay,.

A

Okay- let's, let's, let's not do that, then let's not do the personal email, let's at least create an issue with like the problem and a maybe solution which is like um a proxy that ha on another domain that has loser things that will just forward it to incoming ad order to incoming gitlab or whatever.

B

Okay, let's uh three: let's create tunisia and just yeah brainstorm. Is there a bit.

A

Yeah, oh thanks dmitry for speaking up. That makes sense. I I make it makes sense to keep everything limit, whether happens limited to the app and not to your personal email, um yeah, with the collaboration with aws to get the credentials with a button click. Let me know if uh sri, if, if I need to uh to help escalate that.

E

Yeah I'm going to wait for a week and then we can see what to do.

B

What happens there with this one button, click saying: oh.

E

Yeah, so just uh yeah, just a quick quick uh recap: I spoke to pete goldberg, who is the get lab alliance manager, I believe, with with aws, and the idea is to just contact a solutions architect at aws and see what integrations are possible. So, just like a brainstorming session to see what can we do to enable a five-minute production user to automatically create uh aws keys and import them back into the gitlab project? So this is.

D

E

Set up a call and speak to the right person.

B

Yeah, who knows an api and everything yeah okay, makes sense.

A

Cool um we set up stuff like object, storage uh and things like that, but I don't think we we get like configured a rails app to automatically use that um is there. Is there a path to that? Is there an issue for that? We, I think, that's kind of the next step in some regards.

B

About object; storage! What? What exactly I mean like? We use aws for file storage.

A

Yeah, so we set up the s3 bucket automatically, but then in rails. You have something it's new, it's after my time. Let's call it active storage or something and active storage needs to know kind of the name of the speed bucket and the credentials. I'm not sure we're piping, that into the rails app automatically on deploy.

B

ah So we need an example with uh whatever the active storage.

C

B

I just use carrier way if I use this old school stuff, yeah.

A

Yeah we need, we need an example, but preferably like all of that should just happen automatically.

B

Oh yeah, let's let me just investigate this because we scary away, if you yeah, you obviously like uh give it environmental variables like for yeah for fork libraries. It connects to the aws to store the files and retrieve the files from there. I need to check out what active storage actually does, but.

D

I'm pretty sure that.

B

It's similar to carrier wave just it's just a matter of providing an example that people can uh yeah. Look at that.

A

Yeah first step is the example totally agree. It's going to be simple. I think we should go beyond and say hey how how we're going to automatically generate this configuration file for our users.

B

um Yeah yeah, I need to know what what happened insert on to understand yeah, if, if there is anything to be done at all, maybe yeah? No, maybe you can just read from environmental variables and it's a matter of name and yeah, we'll see.

A

A

C

uh Yeah um so sri and I've been working on a cfp for hashi talks next month. uh We started kind of writing up the details on our talk in this uh doc that I linked here. So um I think it'd be helpful if, if anyone that has opinions about what is good for cfps uh could take a look at this and give us some feedback and probably probably help us to tweak the the details a little bit for better results. I did not realize it wasn't shared so I'll do that right now,.

E

And just to add to that michael the question for you: do you, or does anybody in your team have a lot of experience writing cfps? We could definitely use some help.

D

Yeah, I was, I was just saying, I will have a look and suggest probably have tried to suggest what's needed and help you shape the abstract for the submission it should be done by. I think next week is the year that you did.

E

That's right, uh the 14th yeah.

E

Cool uh yeah, if you can get your help with that, it'll be great. uh I think we're there. We've done a first pass attempt on it, so we have enough information out there. um I would love to speak to uh mayank because uh he presented at hashitar the last time so just to understand uh what was the cfp format that he followed. That would be good too.

E

All right uh that was the last point for the meeting that is to be live streamed. There is a question on private, so maybe we can turn off the live stream and discuss that.