►
Description
Speaker: Edmond Kuqo
Currently, many government organizations use multiple tools and platforms to accomplish their cost, schedule, and performance activities. Consequently, developers waste time tracking their work across different platforms and on tool integration as well as on how they operate when they should be focusing on the product delivery that supports the mission.
Discover how NIWC Atlantic is introducing and driving adoption of GitLab as their all-inclusive platform for DevSecOps development Navy-wide and how they are overcoming the government infrastructure deployment challenges of:
* GitLab 13.x via AWS and integration with the RedHat OpenShift Container Platform
* Deployment of HA and AutoScaling in AWS
Get in touch with Sales: http://bit.ly/2IygR7z
B
Good
afternoon,
everyone,
my
name-
is
ed
cuccio,
I'm
a
government,
civilian
employee
with
naval
information
warfare
center
atlantic.
Before
I
say
something
about
myself,
I
would
like
to
note
that
the
following
is
based
on
my
personal
opinion
and
my
experience
as
a
devsecops
lead
engineer
in
government
and
not
that
of
the
federal
government.
B
Currently
as
a
now
weak
atlantic
employee.
I
am
a
liaison
for
the
department
of
navy
and
to
n6g
group,
and
I
am
leading
at
devsecops
pathfinders
effort
under
the
prometheus
go
initiative
for
context.
The
discussion
for
this
discussion.
I
would
like
to
start
by
looking
at
the
today's
presentation
in
form
of
a
story
or
a
question
being
asked
from
a
customer
or
mission
owner.
B
Before
the
request
can
be
accomplished.
First,
there
needs
to
be
a
place
to
deploy
and
migrate
the
applications
into,
and
the
teams
must
have
tools
and
services
to
do
this
kind
of
automation
required.
On
top
of
that,
it
must
be
secure,
compliant
and
ensure
portability
across
multiple
cloud
service
providers
to
reduce
the
time
to
delivery
and
utilize
containers.
As
a
mechanism
for
deploying
our
applications
for
this
initial
pilot,
we
would
consider
deploying
a
red
hat
openshift
container
platform.
B
As
I
mentioned
earlier,
the
ask
from
a
typical
customer
or
a
mission
owner
would
be
that
they
want
to
reduce
the
time
for
delivering
their
capabilities
to
the
mission
owner
of
utilizing
a
natural
or
devsecops
philosophy
in
a
traditional
typical
setting,
a
government
system
command
acts
as
a
service
provider
on
customers.
Behalf
as
such
to
meet
the
customer
requirements.
B
B
Speaking
of
teams,
depending
on
the
complexity
and
size
of
a
given
project,
a
team
or
teams
following
an
agile,
scrum
team
setup
would
look
like
this
for
our
effort.
Our
team
consists
of
two
developers:
one
continuous
integration,
continuous
development,
member,
utilizing
gitlab
for
building
secure
pipelines,
doing
the
static
code,
analysis,
doing
the
security
scanning
and
fully
completing
a
pipeline
from
a
development
to
production
deployment
model.
I
wanted
to
focus
on
the
cyber
security
members.
B
B
In
order
to
achieve
success,
the
tools
must
be
assessed
and
incorporated
into
the
environment
and
must
be
fully
integrated
to
take
advantage
of
the
automation
and
reduce
the
manual
process
to
reduce
the
time
to
delivery
of
capabilities.
One
must
acknowledge
the
fact
that
automation
is
one
of
the
basic
tenants
to
successfully
implement
ci
cd
and
reduce
the
time
it
takes
to
deliver.
B
You
know
such
capabilities
in
a
commercial
cloud
offering
most
of
the
cuts
tools
can
be
deployed
following
their
documentation
offered
by
the
vendors
in
a
government
setting,
though
the
engineering
teams
face
additional
challenges.
That
first
must
be
addressed
before
a
tool
or
service
that
needs
to
be
utilized
its
full
capabilities,
for
example,
a
tool
or
service
like
gitlab
in
this
case,
must
go
through
the
risk
management
framework
or
rmf
for
short
and
get
an
authority
to
operate
in
a
government
environment.
B
B
Virtual
private
networks
sometimes
pose
challenges
in
speed
and
access
to
resources,
in
many
cases,
depending
on
the
load
of
the
network.
A
successful
pipeline
in
this
case
yesterday
will
fail
to
execute
properly
during
a
busy
time
as
it
tries
to
download
the
resources
it
needs
for
executing
the
pipeline.
B
Another
challenge
would
be
a
policy
related
issue
can
be
challenging
to
solve
in
some
cases,
because
most
likely
policies
are
handled
by
other
teams
or
other
groups
which
require
orchestration
and
engagement
to
ensure
uptime
I'll
not
get
into
too
much
details
on
this
topic.
As
today,
I'm
here
to
discuss
the
following.
How
did
our
nine
week
atlantic
team
concluded
to
deploy
gitlab
in
our
government
infrastructure
and,
of
course,
how
do
we
best
utilize?
B
The
capabilities
that
gitlab
offers
so
that
we
can
deliver
within
the
requirements,
cost
and
schedule
and
the
performance
our
context
or
for
context,
and
to
share
some
details
how
the
tools
and
services
acquisition
operate
in
government.
The
previous
legacy
acquisition
model
is
lengthy
and
was
built
early
on
to
support
hardware
acquisitions
and
not
much
catered
for
highly
software
intensive
programs
fast
forward
to
today.
We
have
a
need
for
a
more
rapid
and
agile
acquisition
model
to
perform
rapid
acquisition
of
tools
and
services,
especially
in
software
intensive
programs.
B
There
is
a
need
for
automation
and
the
time
to
reduce,
in
order
for
us
to
deliver
secure
capabilities
with
low
risk.
In
order
for
all
these
to
take
effect,
one
might
say
that
the
first
thing
that
needs
to
be
addressed
is
the
culture
of
your
team
or
teams.
Let
me
focus
a
bit
on
the
culture
to
improve
the
relationship
between
teams
for
a
devsecops
adoption.
B
The
first
thing
that
needs
to
be
addressed
overall
is
that
we
need
to
ensure
that
the
tools
integrated
together
and
the
teams
utilizing
these
tools
are
familiar
and
trained
to
fully
take
advantage
of
these
services
offered.
On
the
same
now,
on
the
same
note,
we
need
to
build
cultures
that
will
come
the
feedback
and,
of
course,
a
culture
where
failure
is
not
criticized
but
learn
from
it
and
push
forward
to
accomplish
the
mission.
B
Now
we
all
know
and
recognize
that
you
can't
just
buy
devsec
ups,
it's
a
methodology,
it's
a
philosophy,
whatever
you
might
call
it
in
which
cross-functional
teams
deliver
integrate
technologies
and
collaborate
to
put
your
processes,
practice
and
philosophy
into
action,
but
you
can
buy
the
tools,
such
as
gitlab,
for
example,
for
continuous
integration,
continuous
delivery
release
management
to
enable
your
devsecops
pipeline
and
help
the
teams
to
reduce
time
spent
on
maintaining
and
operating
different
tools
via
one
platform.
But
it's
really
your
delivery
teams
that
make
make
it
happen.
B
They
are
the
ones
providing
value
and
always
push
forward
towards
delivering
capabilities
on
time
and
on
their
coast.
As
I
mentioned
earlier,
some
of
these
challenges
span
in
different
settings.
One,
for
example,
as
I
previously
stated,
cots
tools
in
a
traditional
deployment
model
or
an
industry,
do
not
have
the
same
constraints
from
a
government
setting
against
the
government.
Setting
deploying
these
cut
solutions
from
industry
and
government
infrastructure
are
related
to
network
constraints,
security
controls
which
in
many
cases,
cause
issues
with
the
installation
and
configuration
of
tools
and
services.
B
B
In
this
case,
we
attempted
to
deploy
gitlab
ultimate
in
our
aws
golf
cloud
and
from
the
beginning,
we're
having
some
challenges
with
the
network
bandwidth
as
well
as
government
certificate
authorities
or
cas
for
that
matter,
that
required
additional
troubleshooting
by
the
teams.
Before
we
could
proceed
with
the
successful
deployment
of
the
product.
In
some
cases
we
could
deploy
the
gitlab
instance
in
successful,
but
the
gitlab
runners
which
are
needed
in
order
for
the
you
know
continuous
integration
and
continues
deployment
and
automation
to
execute.
B
We
then
failed
to
execute
because
the
certificate
authorities
or
the
certificates
were
not
being
propagated
correctly.
The
path
forwarding
was
another
challenge
with
gitlab
needed
to
be
configured
via
different
urls,
which
you
know
would
have
required
different
certificates
to
be
issued
and
configured.
I
think
the
team
was
able
to
come
up
with
a
clever
way
to
handle
this
by
doing
forward
passing
the
other
proxy.
B
Another
challenge
that
we
were
able
to
remediate
was
making
runners
shareable
with
a
redhead
openshift
container
platform.
The
gitlab
runner
was
using
a
docker
and
docker
design
and
drain
as
a
root
by
design
redhead.
On
the
other
hand,
the
openshift
container
platform
blocks
these
containers
from
running
as
by
design
it
only
allows
non-root
or
rootless
deployment
of
containers.
B
We
found
that
gitlab,
of
course,
on
another
note,
was
that
every
time
someone
would
check
in
the
code,
you
have
this
automatic
devops,
auto
devops
for
triggers.
That
would
start
automatically
by
default
and
there
is
no
way
to
actually
disable
it
or
to
make
it
to
start
as
needed,
and
the
main
challenge
is
working
together
with
gitlab
support
to
ensure
that
our
risk
management
framework
and
the
authority
to
operate
process
for
gitlab
is
streamlined
and
ready
to
execute.
B
We
are
building
customized
templates,
so
the
customers
can
then
utilize
for
their
ci
cd
pipeline
needs
and,
of
course,
you
know
being
in
the
government
infrastructure.
You
are
mandated
to
use
a
2fa
or
two-factor
authentication,
utilizing
a
common
access
card.
We
have
also
configured
gitlab
to
allow
user
creation
via
guest
roles
on
logging,
to
further
streamline
the
onboarding
process.
B
Since
cove
id
19
pushed
all
of
us
to
embrace
remote
working
and
collaborate
via
any
means
necessary,
I
would
like
to
give
kudos
to
the
dod
team
for
deploying
microsoft
teams,
which
is
the
hub
for
collaborating
our
team
specifically,
has
embraced
this
telework
and
utilized
team
videos
calls
capability
at
the
maximum
in
an
average
at
any
given
day.
The
team
is
on
the
meeting
calls
with
our
industry
partners.
B
In
this
scenario,
you
can
see
our
red
hat
team
support
and
our
infrastructure
team
trying
to
troubleshoot
some
of
the
challenges
that
I
spoke
to
earlier.
The
the
team
truly
have
embraced
this
notion
of
a
mob
development.
There
is
actually
a
follow.
It's
called
the
integration
mob
development
mob
or
what
we
decided
to
do.
Given
this
ongoing
collaborations,
we
considered
it
and
called
it
a
mob
devsecops
in
the
screen
share.
B
Some
might
ask:
why
did
we
choose
git
lab
for
our
use
case?
This
might
not
be
the
same
for
other
programs,
but
we
felt
confident
in
our
choice
of
gitlab.
The
gitlab
was
the
right
tool
to
achieve
our
mission
requirements
and
dedicated
our
other
resources
to
focus
on
actually
deploying
and
building
the
capabilities.
B
Note.
This
is
based
in
my
opinion
and
does
not
constitutes
the
opinion
of
dod
or
navy.
Gitlab
is
a
complete
devsecops
platform
delivered
as
a
single
application,
depending
on
your
ci
cd
pipeline
or
complexity
for
your
project.
At
an
average,
you
need
I'll,
say
five
to
ten
integration
tools.
Multiple
licenses,
multiple
rmf
packages,
as
I
mentioned
earlier,
risk
management
framework
because
being
in
a
government,
you
need
an
authority
to
operate,
but
one
application
like
gitlab.
You
get
to
focus
with
managing
one
application,
one
rmf
package
and.
A
B
Less
resources
are
spent
to
keeping
the
application
operational
and
the
fact
that
it
is
a
consolidated
platform
for
all
of
your
devsecop
needs.
Given
the
nature
of
the
requirements
and
security
being
emphasized
at
all
levels,
it
becomes
challenging
for
any
team
to
continue
to
provide
support
across
different
tools
that
require
constant
monitoring
and
updates.
In
addition
to
maintain
the
security
posture
across
the
platform
or
environments
for
that
matter.
Thus,
our
preferred
choice
in
this
scenario
became
gitlab
ultimate
on
the
screen.
B
You
guys
can
see
see
that
in
an
average,
as
I
mentioned
earlier,
you
have
multiple
tools.
You
need
to
integrate
additional
extra
clicks
that
you
have
to
go
between
windows,
to
make
sure
that
you
configure
them
properly
for
your
automation
to
then
successfully
execute
looking
forward
to
stay
relevant
and
adopt
to
change.
B
It
is
imperative
that
we
work
together
to
solve
complex
problems,
continue
to
build
the
robust
and
secure
systems
and
build
these
trusted
environments
where
the
tools
and
services
are
working
in
orchestration
to
further,
simplify
and
improve
the
user
experience
at
all
levels,
but
to
enable
a
workforce
that
is
fully
trained
and
empress.
The
right
tools
for
the
right
job:
we
need
to
continue
looking
for
methods
to
further
train
our
workforce.
B
This
is
it
for
me.
I
hope
that
I
provided
a
view
on
what
why
and
how
our
team
is
currently
working
to
deploy
git
lab
in
as
our
devsecops
tool
chain
in
support
of
our
mission
owners
and
to
help
to
speed
up
the
delivery
of
capabilities
by
aggressively
using
automation
via
a
consolidated
platform
like
guild
lab.
Thank
you
for
your
time
and
please
feel
free
to
send
me
any
comments,
feedback
or
constructive
criticism
and
I'll
do
my
very
best
to
provide
you
any
responses
to
your
questions.