GitLab-CI and Docker Registry Oleg Fiksel Security Consultant @ - - PowerPoint PPT Presentation

▶
gitlab ci and docker registry
SMART_READER_LITE
LIVE PREVIEW

GitLab-CI and Docker Registry Oleg Fiksel Security Consultant @ - - PowerPoint PPT Presentation

Jul 17, 2023 129 likes •1k views

A BOUT I NTRODUCTION GitLab 101 Deploying on-premise Known issues E ND GitLab-CI and Docker Registry Oleg Fiksel Security Consultant @ CSPI GmbH oleg.fiksel@cspi.com | oleg@fiksel.info | Matrix: @oleg:fiksel.info FrOSCon 2017 A BOUT I

slide-1
SLIDE 1

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GitLab-CI and Docker Registry

Oleg Fiksel Security Consultant @ CSPI GmbH

  • leg.fiksel@cspi.com | oleg@fiksel.info | Matrix: @oleg:fiksel.info

FrOSCon 2017

slide-2
SLIDE 2

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

AGENDA

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END Q & A

slide-3
SLIDE 3

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

ABOUT ME

◮ Security Consultant @ CSPI 1 (former MODCOMP 2) ◮ Main topics

◮ Architecture ◮ Development cycle ◮ Perl Coding 1About CSPi 2Wikipedia: MODCOMP

slide-4
SLIDE 4

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GOALS OF THIS TALK

slide-5
SLIDE 5

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GOALS OF THIS TALK

◮ This is not a comparision of CI tools

slide-6
SLIDE 6

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GOALS OF THIS TALK

◮ This is not a comparision of CI tools ◮ Provide an overview of dependencies needed to deploy

GitLab-CI Community Edition and Docker Registry

  • n-premise
slide-7
SLIDE 7

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GOALS OF THIS TALK

◮ This is not a comparision of CI tools ◮ Provide an overview of dependencies needed to deploy

GitLab-CI Community Edition and Docker Registry

  • n-premise

◮ Disclamer: The means and methods presented are my own

expirience

slide-8
SLIDE 8

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GITLAB 101

slide-9
SLIDE 9

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WHAT IS GITLAB?

slide-10
SLIDE 10

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WHAT IS GITLAB?

◮ Web-based Git repository manager and more...

slide-11
SLIDE 11

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WHAT IS GITLAB?

◮ Web-based Git repository manager and more... ◮ Started as a pet-project in 2011 and now has more then 150

employees

slide-12
SLIDE 12

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WHAT IS GITLAB?

◮ Web-based Git repository manager and more... ◮ Started as a pet-project in 2011 and now has more then 150

employees

◮ Introduced Pipelines (CI) in version 8.8 (2016-05-28)

slide-13
SLIDE 13

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WHAT IS GITLAB?

◮ Web-based Git repository manager and more... ◮ Started as a pet-project in 2011 and now has more then 150

employees

◮ Introduced Pipelines (CI) in version 8.8 (2016-05-28) ◮ GitLab is used by many organisations such as: IBM, Sony,

NASA, Alibaba, SpaceX and CSPi

slide-14
SLIDE 14

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WHAT IS DOCKER?

slide-15
SLIDE 15

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WHAT IS DOCKER?

client docker build docker pull docker run docker host docker daemon images containers registry

...

slide-16
SLIDE 16

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WORDING

slide-17
SLIDE 17

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WORDING

◮ GitLab Server: git repository hosting service

slide-18
SLIDE 18

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WORDING

◮ GitLab Server: git repository hosting service ◮ GitLab-CI Runner: user-space daemon that executes

build/tests

slide-19
SLIDE 19

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WORDING

◮ GitLab Server: git repository hosting service ◮ GitLab-CI Runner: user-space daemon that executes

build/tests

◮ Artifacts: build results pushed into an internal GitLab

storage

slide-20
SLIDE 20

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WORDING

◮ GitLab Server: git repository hosting service ◮ GitLab-CI Runner: user-space daemon that executes

build/tests

◮ Artifacts: build results pushed into an internal GitLab

storage

◮ GitLab Container Registry: integrated docker registry

frontend

slide-21
SLIDE 21

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

WORDING

◮ GitLab Server: git repository hosting service ◮ GitLab-CI Runner: user-space daemon that executes

build/tests

◮ Artifacts: build results pushed into an internal GitLab

storage

◮ GitLab Container Registry: integrated docker registry

frontend

◮ Docker Registry: mandatory container registry service

slide-22
SLIDE 22

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

DEPLOYING ON-PREMISE

slide-23
SLIDE 23

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

CHECKLIST

slide-24
SLIDE 24

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

CHECKLIST

◮ 2 VMs or Rancher/Kubernetes/Mesos cluster

slide-25
SLIDE 25

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

CHECKLIST

◮ 2 VMs or Rancher/Kubernetes/Mesos cluster ◮ Reverse proxy/loadabalancer for SSL offload (optional)

supporting HTTP 1.1 to the backend (! Lighttpd)

slide-26
SLIDE 26

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

CHECKLIST

◮ 2 VMs or Rancher/Kubernetes/Mesos cluster ◮ Reverse proxy/loadabalancer for SSL offload (optional)

supporting HTTP 1.1 to the backend (! Lighttpd)

◮ Direct internet connection (for pulling docker images)

slide-27
SLIDE 27

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

CHECKLIST

◮ 2 VMs or Rancher/Kubernetes/Mesos cluster ◮ Reverse proxy/loadabalancer for SSL offload (optional)

supporting HTTP 1.1 to the backend (! Lighttpd)

◮ Direct internet connection (for pulling docker images) ◮ SSL Certificates (own CA or official)

slide-28
SLIDE 28

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

PITFALLS

slide-29
SLIDE 29

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

PITFALLS

◮

Internal CA

slide-30
SLIDE 30

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

PITFALLS

◮

Internal CA

◮

Forward proxy

slide-31
SLIDE 31

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

PITFALLS

◮

Internal CA

◮

Forward proxy

◮

DNS split horizon (not handled in this talk)

slide-32
SLIDE 32

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GITLAB-CI RUNNER ARCHITECTURE

slide-33
SLIDE 33

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GITLAB-CI RUNNER ARCHITECTURE

GitLab-CI GitLab-CI-Runner Docker GitLab-CI-Runner Shell Container Container Container

GitLab-CI-Runner

GitLab-CI-Runner GitLab-CI-Runner

slide-34
SLIDE 34

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

ON-PREMISE DEPLOYMENT ARCHITECTURE

slide-35
SLIDE 35

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

ON-PREMISE DEPLOYMENT ARCHITECTURE

Docker Container GitLab GitLab-CI Auth Docker registry (frontend) Artifacts GitLab-CI Runner git clone run Test, Build, etc push (HTTPS) Docker registry (container) push/pull (HTTPS) local S3 Azure GCS Swift store blob read/write access Docker client pull/push (HTTPS) auth token (HTTPS) [separate CA] auth (HTTPS) hub.docker.com Pull (HTTPS)

slide-36
SLIDE 36

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA

slide-37
SLIDE 37

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA

Every GitLab HTTPS client must trust internal CA including:

slide-38
SLIDE 38

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA

Every GitLab HTTPS client must trust internal CA including:

◮ gitlab-ci-runner

slide-39
SLIDE 39

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA

Every GitLab HTTPS client must trust internal CA including:

◮ gitlab-ci-runner ◮ docker container building docker images

slide-40
SLIDE 40

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA

◮ Problem: docker images are pulled from docker hub and

doesn’t trust intern CA.

slide-41
SLIDE 41

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA

◮ Problem: docker images are pulled from docker hub and

doesn’t trust intern CA.

◮ Solution: extend all base images with internal CA and use

them for building.

slide-42
SLIDE 42

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SWITCH DOCKER STORAGE BACKEND

1Source

slide-43
SLIDE 43

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SWITCH DOCKER STORAGE BACKEND

By default, when using docker:dind, Docker uses the vfs storage driver which copies the filesystem on every run. This is a very disk-intensive operation which can be avoided if a different driver is used, for example overlay.1

1Source

slide-44
SLIDE 44

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SWITCH DOCKER STORAGE BACKEND

OS Setup:

slide-45
SLIDE 45

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SWITCH DOCKER STORAGE BACKEND

OS Setup:

◮ add overlay to /etc/modules (Ubuntu 16.04)

slide-46
SLIDE 46

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SWITCH DOCKER STORAGE BACKEND

OS Setup:

◮ add overlay to /etc/modules (Ubuntu 16.04) ◮ modprobe overlay or reboot the system

slide-47
SLIDE 47

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SWITCH DOCKER STORAGE BACKEND

Adjust /etc/docker/daemon.json

1 { 2

" storage−driver " : " overlay "

3 }

and restart Docker. Warning: make sure you have no important local images or

  • containers. You will start with an empty Docker storage.
slide-48
SLIDE 48

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - BOOTSTRAP PROCEDURE

slide-49
SLIDE 49

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - BOOTSTRAP PROCEDURE

◮ Adjust runner configuration

slide-50
SLIDE 50

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - BOOTSTRAP PROCEDURE

◮ Adjust runner configuration ◮ Build docker first docker images locally and push them to

the registry

slide-51
SLIDE 51

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - BOOTSTRAP PROCEDURE

◮ Adjust runner configuration ◮ Build docker first docker images locally and push them to

the registry

◮ Create CI configuration and build images automatically

slide-52
SLIDE 52

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - BOOTSTRAP PROCEDURE

◮ Adjust runner configuration ◮ Build docker first docker images locally and push them to

the registry

◮ Create CI configuration and build images automatically ◮ Update images daily using scheduled builds (CI feature)

slide-53
SLIDE 53

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - BOOTSTRAP PROCEDURE

Adjust runner configuration:

1 # /etc/gitlab −runner/config . toml 2

[ [ runners ] ]

3

. . .

4

executor = " docker "

5

[ runners . docker ]

6

. . .

7

privileged = true

8

volumes = ["/ cache " , "/ var/run/docker . sock :/ var/run/docker . sock : rw " ]

slide-54
SLIDE 54

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - DOCKER IMAGE

Dockerfile for Docker image with internal CA:

slide-55
SLIDE 55

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - DOCKER IMAGE

Dockerfile for Docker image with internal CA:

1 # Dockerfile 2 FROM docker : l a t e s t 3 4 COPY my_ca . c r t /tmp/ 5 RUN cat /tmp/my_ca . c r t >>/etc/ s s l / c e r t s /ca−c e r t i f i c a t e s . c r t &&

rm /tmp/my_ca . c r t

6 7 ENTRYPOINT [ " docker−entrypoint . sh " ] 8 C

M D [ " sh " ]

slide-56
SLIDE 56

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - DOCKER IMAGE

CI configuration for Docker image with internal CA:

slide-57
SLIDE 57

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - DOCKER IMAGE

CI configuration for Docker image with internal CA:

1 # .gitlab-ci.yml 2 variables: 3

DOCKER_DRIVER: overlay

4

IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME

5 6 before_script: 7

  • docker

login −u gitlab −ci−token −p $CI_JOB_TOKEN $CI_REGISTRY

8 9 build_docker_image: 10

stage: build

11

image: $CI_REGISTRY/gitlab −c i /docker:master

12

services:

13

  • $CI_REGISTRY/gitlab −c i /dind:master

14

tags:

15

  • dind

16

s c r i p t :

17

  • docker build −t $IMAGE_TAG .

18

  • docker push $IMAGE_TAG
slide-58
SLIDE 58

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - DOCKER-IN-DOCKER IMAGE

Dockerfile for Docker-in-Docker image with internal CA:

slide-59
SLIDE 59

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - DOCKER-IN-DOCKER IMAGE

Dockerfile for Docker-in-Docker image with internal CA:

1 # Dockerfile 2 FROM docker : dind 3 4 COPY my_ca . c r t /tmp/ 5 RUN cat /tmp/my_ca . c r t >>/etc/ s s l / c e r t s /ca−c e r t i f i c a t e s . c r t &&

rm /tmp/my_ca . c r t

6 7 VOLUME /var/ l i b /docker 8 EXPOSE 2375 9 10 ENTRYPOINT [ " dockerd−entrypoint . sh " ] 11 C

M D [ ]

slide-60
SLIDE 60

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - DOCKER-IN-DOCKER IMAGE

CI configuration for Docker-in-Docker image with internal CA:

slide-61
SLIDE 61

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - DOCKER-IN-DOCKER IMAGE

CI configuration for Docker-in-Docker image with internal CA:

1 # .gitlab-ci.yml 2 variables: 3

DOCKER_DRIVER: overlay

4

IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME

5 6 before_script: 7

  • docker

login −u gitlab −ci−token −p $CI_JOB_TOKEN $CI_REGISTRY

8 9 build_docker_image: 10

stage: build

11

image: $CI_REGISTRY/gitlab −c i /docker:master

12

services:

13

  • $CI_REGISTRY/gitlab −c i /dind:master

14

tags:

15

  • dind

16

s c r i p t :

17

  • docker build −t $IMAGE_TAG .

18

  • docker push $IMAGE_TAG
slide-62
SLIDE 62

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - BUILDING IMAGES

Now we can build Docker images with GitLab-CI!

slide-63
SLIDE 63

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

INTERNAL CA - BUILDING IMAGES

Now we can build Docker images with GitLab-CI!

1 # .gitlab-ci.yml 2 variables: 3

DOCKER_DRIVER: overlay

4

IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME

5 6 before_script: 7

  • docker

login −u gitlab −ci−token −p $CI_JOB_TOKEN $CI_REGISTRY

8 9 build_docker_image: 10

stage: build

11

image: $CI_REGISTRY/gitlab −c i /docker:master

12

services:

13

  • $CI_REGISTRY/gitlab −c i /dind:master

14

tags:

15

  • dind

16

s c r i p t :

17

  • docker build −t $IMAGE_TAG .

18

  • docker push $IMAGE_TAG
slide-64
SLIDE 64

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

FORWARD PROXY

slide-65
SLIDE 65

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

FORWARD PROXY

◮ Not every application have proxy support

slide-66
SLIDE 66

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

FORWARD PROXY

◮ Not every application have proxy support ◮ Some application configuration is tricky

slide-67
SLIDE 67

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

FORWARD PROXY

◮ Not every application have proxy support ◮ Some application configuration is tricky ◮ Configuring proxy every time bloats CI configuration

slide-68
SLIDE 68

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

FORWARD PROXY

◮ Not every application have proxy support ◮ Some application configuration is tricky ◮ Configuring proxy every time bloats CI configuration ◮ Set proxy configuration via environmental variables while

integrating your CA in the docker image

slide-69
SLIDE 69

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

FORWARD PROXY - LOCAL TRANSPARENT PROXY

For applications not supporting proxy − → local squid in tranparent mode (doesn’t work for HTTPS)

1 # squid

configuration

2 acl

docker src 172.17.0.0/16

3 acl

SSL_ports port 443

4 cache_mem 16 MB 5 # upstream proxy ip 6 cache_peer

1 0 . 0 . 0 . 1 0 parent 8080 0 no−query proxy−only default

7 dns_v4_first on 8 http_access

allow docker

9 http_access deny CONNECT ! SSL_ports 10 http_access deny ! Safe_ports 11 http_port 3129

intercept

12 memory_pools off

slide-70
SLIDE 70

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

FORWARD PROXY - LOCAL TRANSPARENT PROXY

iptables configuration:

1 iptables −t

nat − A PREROUTING −s 172.17.0.0/16 −p tcp − m tcp − − dport 80 −j REDIRECT − −to−ports 3129

slide-71
SLIDE 71

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

KNOWN ISSUES

slide-72
SLIDE 72

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GITLAB-CI WITH SUBMODULES

slide-73
SLIDE 73

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GITLAB-CI WITH SUBMODULES

Submodule init failing due to "SSL certificate problem".

f a t a l : unable to access ’ https :// github . com/minio/minio−go / ’: SSL c e r t i f i c a t e problem : unable to get l o c a l issuer c e r t i f i c a t e

slide-74
SLIDE 74

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GITLAB-CI WITH SUBMODULES

Submodule init failing due to "SSL certificate problem".

f a t a l : unable to access ’ https :// github . com/minio/minio−go / ’: SSL c e r t i f i c a t e problem : unable to get l o c a l issuer c e r t i f i c a t e ◮ Issue: 2148

slide-75
SLIDE 75

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GITLAB-CI WITH SUBMODULES

Submodule init failing due to "SSL certificate problem".

f a t a l : unable to access ’ https :// github . com/minio/minio−go / ’: SSL c e r t i f i c a t e problem : unable to get l o c a l issuer c e r t i f i c a t e ◮ Issue: 2148 ◮ Will be fixed in gitlab-ci-multi-runner v9.4

slide-76
SLIDE 76

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GIT-LFS

1https://git-lfs.github.com

slide-77
SLIDE 77

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GIT-LFS

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.1

1https://git-lfs.github.com

slide-78
SLIDE 78

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GIT-LFS

◮ Problem: GitLab-CI doesn’t download git-LFS objects on

CI run (probably fixed by now)

slide-79
SLIDE 79

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GIT-LFS

◮ Problem: GitLab-CI doesn’t download git-LFS objects on

CI run (probably fixed by now)

◮ Workaround: download git-LFS objects “manually” via CI

script

slide-80
SLIDE 80

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

GIT-LFS

1 # .gitlab-ci.yml 2 stages: 3 − build 4 5 create_package: 6

stage: build

7

image: $CI_REGISTRY/gitlab −c i /ubuntu:xenial

8

s c r i p t :

9

  • apt−get update &

& apt−get i n s t a l l −y wget g i t

10

  • wget https://packagecloud . io/github/git−l f s /packages/ubuntu/

xenial/git−l f s _ 1 . 5 . 2 _amd64 . deb/download − O /tmp/git−l f s _ 1 . 5 . 2 _amd64 . deb & & dpkg −i /tmp/git−l f s _ 1 . 5 . 2 _amd64 . deb

11

  • g i t

l f s i n s t a l l & & g i t l f s fetch && git−l f s checkout

12

  • tar

czf application −‘ cat application/version . txt ‘ . tar . gz application

13

a r t i f a c t s :

14

expire_in: 2 weeks

15

paths:

16

  • application−* . tar . gz

17

  • nly:

18

  • /^release . * $/
slide-81
SLIDE 81

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SUMMARY

slide-82
SLIDE 82

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SUMMARY

◮ GitLab is a great product evolving rapidly

slide-83
SLIDE 83

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SUMMARY

◮ GitLab is a great product evolving rapidly ◮ Deploying GitLab-CI in an enterprise environment can be

quite challenging

slide-84
SLIDE 84

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

SUMMARY

◮ GitLab is a great product evolving rapidly ◮ Deploying GitLab-CI in an enterprise environment can be

quite challenging

◮ Some of use cases and videos are focused on frontend

development using Ruby-On-Rails and deployment to a Kubernetes cluster

slide-85
SLIDE 85

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

Q & A

slide-86
SLIDE 86

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

Thanks!

Oleg Fiksel

  • leg.fiksel@cspi.com | oleg@fiksel.info | Matrix: @oleg:fiksel.info
slide-87
SLIDE 87

ABOUT INTRODUCTION GitLab 101 Deploying on-premise Known issues END

LINKS

◮ Files from this talk on Github ◮ Introduction to GitLab pipelines ◮ Install a root CA in Ubuntu