GitLab Incubation Engineering, 14 Jan 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Incubation Engineering 5mp - Weekly Update - January 14th 2022

Description

5mp is now Cloud Seed ⛅🌱 https://hello.cloudseed.app

Cloud Seed is an open-source program lead by GitLab Incubation Engineering in collaboration with Google Cloud.

Deploying web application (and related workloads) from GitLab to major cloud providers should be trivial.

Cloud Seed makes it ridiculously simple and intuitive to consume appropriate Google Cloud services within GitLab.

00:00 Intro
00:36 Recap
01:43 MR 01 - Merged
02:25 MR 02 - Merged
03:10 MR 03 - Open
04:46 Discussion around OIDC
06:38 What's next

A

This is the weekly update dated january 14th 22 for the 5 minute production incubation engineering project.

A

In this video I'll start with a recap of last week, then I'll go through some of the merge requests. I worked on and then a discussion around workload, identity, federation and finally, looking at what's next.

A

In the last quarter, we worked on the theme around one click authentication, wherein service account generation within git lab was a super smooth process, and once this was developed, it was split into multiple small, merge, requests and merged into get lab source in quarter. Four. What we have done so far is we have got a functional working demo of deployment to cloud run.

A

If you remember, or if you check last week's video, you will see that I demonstrated a feature branch wherein a dockerized web application could be deployed to cloud run with the press of a button.

A

The major piece of work that remains now is to break that feature branch into multiple, smaller merge requests and merge that into gitlab source. Once this gets done in the coming weeks, we look forward to fy23q1 where we will work on a preview rollout first privately and then to a larger user base.

A

One of the merge requests worked last week was mr 77663, which introduced the deployments controller with placeholder routes. This paves way for the action which will generate the merge requests that configures the cloud run pipeline.

A

This was a fairly, I would say, small merge request that got reviewed and merged pretty smooth. So I would like to thank the two reviewers uh cynthia david kim and tyler rabos, for their support with this, mr and having it merged.

A

The second mr I've worked on was one that introduced the cloud run and cloud storage buttons in the deployments tab of the google cloud page.

A

This introduces the ui elements which are disabled, and this will basically be the place where the user would configure their merge request again fairly small and straightforward merge request that got reviewed and merged as a smooth process. So I would like to thank peyton and natalia for this smooth, merge process.

A

The final mr77590 is still open. This is a merged request that sets the protected status of the ci virus generated for the service account and the protected status of these ci variables is linked to the environment they were created. For so, if I create a service account for a non-protected environment, then the ci wires are not protected, whereas if I create the ci wires for a protected environment, then of course they are protected.

A

If no environment is chosen, then the default is that they are not protected. This merge request is going through the review process, the maintainer, sorry, the the first pass review performed uh by tyler ramos. This has gone pretty smooth the second pass, which is the maintainer review.

A

This is where uh we are still waiting for douglas to return from his out of office. He was out of office for a few days, so this review hasn't been merged yet, but he'll be back monday and uh we'll go through the changes that I made and we'll see if we can get it merged.

A

The expectation is that this will be merged early next week.

A

Apart from these, mrs, I had a couple of interesting discussions. The first was the internal discussion with marshall cottrell, and the second one was with seth vargo, which who is a google employee?

A

You might know seth, he is one of the leading lights when it comes to chef, has has led the way at hashicorp as well, and now has been, let's say, the auth guy or one of the auth guys for gcp he's been at google for about four years now, so he is well known.

A

uh Both these discussions were around workload, identity, federation. I wanted to understand what it is and how it works and where we are within oidc support or open id support, or, should I say, open, I d connect support within gitlab there's an epic, and this should be there at some point uh once it's ready. I feel that seth has made a strong case for this to be implemented. I think it makes sense to implement it.

A

It reduces the responsibility of our software in holding secrets and that's a good thing, and the key element for me was to ensure that we do not compromise on the one. Click authentication and one click on configuration, user experience, and if I understood what set said properly, it seems that we can stick with the existing user experience, which means my oauth flow will configure workload, identity federation for me and then, once the gitlab ci runner is provided with the jwt token for ooidc, we will be able to use it for five minute production as well.

A

So this is still something that we need to do, but it seems that it's a good use case that we should follow up upon again I'll, be following these epics closely. Links to the videos are provided. If you are interested in diving a bit deeper.

A

The agenda for what's next is simple: we create one or more, mrs to get the configure cloud run pipeline working, and this will mean that we are ready to have a preview rollout. I suspect this will be two, mrs, maybe three. The other step is to work on the existing openmr and get that merged as well. The focus would be just performing these engineering tasks and closing the quarter strong.

A