GitLab ⛅🌱 Cloud Seed, 10 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: 2020-12-10 5 minute production app sync

Description

Direction: https://about.gitlab.com/direction/5-min-production/

A

I don't he went like you know. I passed this point by the end.

B

Welcome to the five-minute production app where sid knows how to live stream and dmitry knows how to make a five minute production app. So good division of labor here.

A

Perfect perfect, I'm just like here with that: okay hi everyone, my name is mithri, and this is uh our weekly meeting of about five minute production app and I will give you a short demo as usual. So this week was busy with security fixes and some uh architectural changes.

A

So we don't have much, but we have one scene that I find really really important and it's ssl because, like what what production app is without https these days and yeah, if we go to uh deploy template or five-minute production app, we have a new link in the documentation, that's enabling ssl and we try to follow those steps and get a cell working for our application.

A

Now application is this one and uh it's a simple closure application and gitlab say: yaml is pretty much what we used to have different source demos, so it has dbm grade script and it includes includes uh deploy template.

A

uh Of course, aws environmental variables are defined in the icd section, so that's pretty much what we have and let's go back to the deploy template.

A

So the first sentence says that we need to provide two variables search domain, insert email for your pipeline, typically done by adding variables to gitlab, say yaml file. Okay, let's do that.

A

First, one is sir domain and third domain is probably.

A

What they want me to have for this application and third email yeah I'll, just use my 4k email.

A

And yeah, I think it type it all correct. Let's commit it going back to the template as cell certificate, jobs are only enabled on protected branches by default. Master branch is protected.

A

Okay, I make changes directly to master branch, so we shouldn't be set here now execute the setup instruction to open the pipeline. We use a job logs for instruction of how to configure dns records for your domain. Okay, let's, let's take a look at our plan.

A

Okay, indeed, I have the new stage that you didn't have before we set up instructions, job and ssl certificate job. So let's wait for pipeline to finish.

A

In the meantime, let me introduce some updated documentation.

A

So now we have a variable section that lists all the variables that you need to provide all that five minute production app provides to the user, and it's all listed there in one small table with uh yeah description default. Wireless and explanation like is it required to not- and this is like pipeline variable- or this variable that is exposed to your web application inside docker container so yeah. If you're unsure, you can always go to this table to check.

A

A

Okay turn from apply job.

A

This one should be fast, there's no changes to the infrastructure recently, so it should be nice.

A

One important addition that we introduced this week is that uh yeah, your application in docker container now runs through engines, so we have engines, it's reverse proxy in front fades out. It now looks like a more mature solution and we'll go away from the edge of box just in.

A

A

We need to wait for deploy job to finish and then we can.

A

A

I could have those variables inside yaml up front and have pipeline run, but then it's uh creates a sort of confusion. When you just watch the demo of people presenting something it's already, everything is ready and they don't do stuff. And then you try, try it on your own and it's like all those failures and misunderstandings. So I think it's just worth spending a few minutes for applying to actually run and type all those domain variables manually.

A

Okay, so my pipeline is done and let's remember again what we need to do. We need to execute step instructions, open the pipeline and view logs for instructions. Okay, let's, let's do.

A

A

I'm wondering if our environment runs.

A

A

Okay, so it says dns setup instructions create an a record and point out to ip address, execute a cell certificate, so I did already connected this ap to the dns, because otherwise we would need to wait another half an hour to connect the domain, so I assume for in a real world example. You would need to do this. You need to go to your dns provider, create this a record, and then you run this ssl certificate job and if it fails, that means probably dns is not updated.

A

So you just retry it a bit later in a few minutes and then when it's passed it ends yeah everything is good and still certificates are generated for your domain.

A

Okay, it updated the configuration and yeah the job is ring, so it's passed so now we can go to the environments and we open the link and we see that it's actually running on the https and the connection it's secure, so yeah, the environment, uh gitlab environment understands that you have a domain name associated and generated a valid certificate that is attached to this domain.

A

So your application is running on https now.

B

Very cool, can you maybe show the setup instructions again.

A

A

So set instructions provide two variables: certificate domain and certificate email, so.

B

This is, I mean, the uh the job setup instructions.

A

uh Yeah yeah, let me let me go there.

A

A

Setup instructions.

A

Yes, here it is.

B

Cool so like what you didn't have here, the cip address, so you kind of need that before you can do it.

A

Yeah yeah, we have uh an idea for further step. Is that we'll just take? We know the ap address from terraform state even before this job, so what we can do, we can use some domain provider and like nib.io and just assign your domain voice based on ap address automatically.

A

So you don't need to do all those steps and then, when, when you are ready to come with your own personal domain, then you like go through all this process.

A

So this is under discussion because I probably like uh a lot of people who will try it for the first time say: yeah, I just don't have a domain name for it or you know like don't care at first. So maybe.

B

I think considering that browsers are just almost not supporting websites that have don't have an ssl thing. Like you get all kinds of warnings, I think it's not about having a beautiful domain name, it's just about having something with an ssl certificate. So I love nip or I think sip is the thing we're recommending for some reason. um So I think that's a great idea.

A

Yeah yeah, so this is like for for next thing. We even we have an issue for that already and yeah generate domain from ip address and generate a self-certificate. So this way we skip http completely. So it's like your first deploy should be already on ssl, just like it will have the uh the domain name generated from ip address, but yeah it doesn't matter like you can always update it.

A

Okay, um I stopped sharing my screen, so that was it. Do you have any question.

B

A couple of things, if you allow me, I put them on number four. um I love the new table thanks for that, uh the variable stable it's too wide on my machine, so I can't see it properly.

B

um Maybe what we can do is we can shorten some of the terraform variables and maybe even though it's factually incorrect maybe add a space in the middle of the super long example key, so that it can be broken up, because that's because.

A

B

Thing without a space.

B

B

Yeah, I'm not sure about 6, I'm going to remove it.

B

Maybe call it something else and set up instructions, maybe dns record instructions and then also maybe the the setup. Instructions or dns record instructions can also like link to the source code, and you can see like oh figure out here, I'm figuring out eip and I'm looking in. I don't know terraform whatever, so that people they don't have to wait for the deploy, but they can kind of reverse engineer it and help themselves.

A

Yeah yeah, we can think of it like right now. The way it looks works is like you know uh the first iteration just to to. Actually you know reach the point of itself working. I think, once we have uh knee boy dot io whatever, like you know, uh domain provider based on ip address. We would need to rethink this strategy anyway, because then it would be like there would be. No such jobs like you, don't need the setup instructions or ssl generation job.

A

You would just have it all in one and run automatically as a part of pipeline, and then, when you bring in custom domain, then it would probably ever sync it a bit differently but yeah that stands for suggestions.

A

B

So that's all fine. So let's wait for that exit thing to do and then let's so please disregard that and then very small thing that maybe we can use numbered lists in the readme. So if you have a list of instructions, you can refer to number three or number two.

A

B

Instead of all the points but uh yeah just overall, like super cool, we have ssl working, which is great and it's not trivial. I looked at the heroku instructions and there's quite a few pages to get that working on heroku, so great job.

A

Thank you. Thank you uh yeah. I like how it works. It's like it's, uh it's getting better, so uh yeah as a usual sensory for for doing a lot of work with this is self-certificate. Generations could just do that and for fighting with also security uh issues that we brought with with credentials and everything.

A

Okay, so a few words about the plans for next week is uh number one would look at this uh ip address domain generation. Number two is that I'm working on the draft merge request to get lab repo with five minute production, app yaml file uh yeah. Let me share the screen really quick, so my first goal uh is.

A

To bring it as a separate template- and you might have concerns about this- but this is just the most boring solution- is to have it selectable among gitlab templates.

A

uh Because integrating it out to the warps would take some time, I would probably need some abstraction bringing because how to do objects to kubernetes focus. So I suggest we just start with a separating plane and then before we bring it inside out to devops. So.

B

There isn't much equality, you might get, you might get into trouble and I might not be able to help you there, but uh let's go I'm not stopping you either from trying this great.

A

Yeah yeah, we'll we'll see how it goes like um it becomes more common, seem to get in trouble with scat love developments.

A

It won't be my first time: okay, uh yeah, we'll see if it's like, if it uh goes in, and if it does then like yay, we have it as a part like shipped as a part of gitlab. If not well, you would need to pass two lines in your ciaml file, but it's still like it's still usable and still can benefit it, and I think if we make a blog post and some you know, uh share uh some information about it, I'm pretty sure people will use it anyway.

A

I'm looking into this uh uh ci template merch request, see if I can uh get it to some reasonable state and uh we are going to work into simplifying the domain narration and making it a default scene and yeah, and I think it's that's pretty much. It.

B

Cool um I'm opening up the uh oh. No. I saw that there's other people who have questions uh michael.

C

I I didn't have questions I just wanted to give a heads up on the first blog post, which is in review. It should be published today, hopefully, um and I'm looking into other topics which uh include terraform database management and maybe a hackathon hackathon, especially in that regard, because today at aws3 event at the live demo session, I just wanted to try it out and it worked.

C

It was super fun and I've tweeted about it and shared it on linkedin as well yeah, and I'm I'm looking forward to find ways to like test it and motivate others to try it out then, and for the uh for the blog post, dimitri just just ping me. If we can collaborate and do something.

A

Yeah yeah sounds mindful um great news that you tried it out.

C

It's some it's! It's amazing, I'm like playing the the first time user card and I have no idea, I'm just like following the steps, uh credentials and and the template include and watching it. Oh that's awesome. That's really like! I have no idea how it works in the background it just works. It's awesome.

B

It's amazing and I think, like we're just two weeks into the quarter, and basically we have something that is already very far along. We can try merging it in the gitlab core and then from there we can. We can start working on the rough edges and all the ux in the ui and make that better so and and test with users and I'm sure we'll get a lot of as people start using this I will get a lot of feedback or will get very valid feedback, maybe not a lot but valid feedback so very excited.

B

I think this is way ahead of where I expected it to be so great work. Sweet. Thank you for your work. I really appreciate it. Look at the issue board. It's it's really good. I think you're prioritizing the right thing, so I'm excited michael thanks for the blog post, I'm a very happy camper. With this I'm very excited and um for context.

B

I think kubernetes is a great thing. It's a great thing that happened to gitlab. We we doubled down on it, but we've seen, for example, in uh monitor apm that, like there's a lot of people who not yet using uh kubernetes for good reasons like volume snapshots, just chipped like stateful apps were just are still hard on kubernetes.

B

So I think I'm really excited about using terraform and more mundane, more practical things and I think well. We should reach a way bigger audience and have something that's usable by far more people. So this is super exciting.

B

Yay anyone wants to close us out with that. Last.

B

Point sri: how has it been for you working on this.

D

Hey all right, uh it's it's been good. It's been uh you're asking me now and it's been like a really busy few days, so probably not the best time to ask me this question, but on the whole it's been like a great experience. I think we've done. uh We've done really good in the past six, seven weeks that we worked so we have something but now it's time to just close all the bugs make it as secure as possible and try to ship it in 13.7 a bit a bit optimistic here.

D

Let's, let's see what happens.

B

Very cool uh yeah and shout out to jeremy, who, who did the security testing? That's a great work as well appreciate it thanks. Everyone.