DOES SFO 2016 - Matthew Barr - Enterprise Git - the hard bits
0 likes•428 views
The document covers the complexities of using Git in enterprise settings, focusing on various Git hosting options, safety practices, and access control. It discusses the operationalization of Git at Akamai, including authentication methods and best practices for code integrity and review processes. The presentation emphasizes the importance of preventing unauthorized changes and maintaining proper audits within a large number of repositories.
DOES SFO 2016 - Matthew Barr - Enterprise Git - the hard bits
- 1. Enterprise Git - the hard bits Matthew Barr
- 2. Enterprise Git - the hard bits Matthew Barr, Architect
- 3. ©2016 AKAMAI | FASTER FORWARD TM Overview ● Introduction ● Git hosting options ● o18n ● Safety & Best Practices
- 4. ©2016 AKAMAI | FASTER FORWARD TM Admissions
- 5. Lawyer Not
- 11. ©2016 AKAMAI | FASTER FORWARD TM Me: SysAdmin / DevOps Engineer for 20 years ● Lehman Bros, MarkitServ ● Community Connect, Snap Interactive ● Nokia Focus @ Akamai: Developer Productivity ● Provide tools for our engineers ● SCM, Build, CI & Test systems ● Current project: Horizontally scalable build farm w/ Docker agents
- 12. So you want to be a hero store your code in Git
- 13. ©2016 AKAMAI | FASTER FORWARD TM GitHub or Bitbucket ● Hosted ● Great features ● Low overhead ● Great for small teams ● Even medium size
- 14. ©2016 AKAMAI | FASTER FORWARD TM Self hosted options ● GitLab ● Gitolite ● cgit
- 15. ©2016 AKAMAI | FASTER FORWARD TM Enterprise ● Github Enterprise ● Bitbucket Server (Atlassian) (née Stash) ● Gitlab Enterprise ● Perforce GitSwarm
- 16. ©2016 AKAMAI | FASTER FORWARD TM Git @ Akamai ● Currently: 6000+ repositories, 115+ Projects/Organizations ○ Not primary code repository (yet) ● Relaunched 1 year ago ● Stash Data Center Edition ● 2 sites ○ 2 App Servers ○ 2 DB nodes ○ Netapp filer & load balancer
- 17. ©2016 AKAMAI | FASTER FORWARD TM o16n (Operationalization)* * Gordon Marx
- 18. ©2016 AKAMAI | FASTER FORWARD TM HA, DR, GeoDiversity & Backups ● Varies by product ● Github Enterprise ○ Clustering ○ Active / Passive Node ○ Point in time snapshots ● Bitbucket Server ○ Self Service Backups, DB replication, Snapshots ○ Improvement in Bitbucket Server (Stash) ■ Smart Mirrors ■ Zero Downtime Backups
- 19. ©2016 AKAMAI | FASTER FORWARD TM Authentication for the enterprise ● Mandate: No passwords ● 3 types of access ○ WebUI ○ Git (SSH, HTTPS) ○ API ● SAML for WebUI ● SSH key sync script from LDAP ● X.509 Client auth for API
- 20. ©2016 AKAMAI | FASTER FORWARD TM Safety & Best Practices
- 21. ©2016 AKAMAI | FASTER FORWARD TM PCI, SOX, etc. Boils down to: ● Prevent unauthorized changes ● Review change!
- 22. ©2016 AKAMAI | FASTER FORWARD TM Code Review - Pull Requests ● Sign offs - +1, approvers ● Prevent merges without PR’s ● Merge commits ○ Audit points, in git log
- 23. ©2016 AKAMAI | FASTER FORWARD TM Code Integrity ● Branching workflow ○ Combination Gitflow + Feature Branch (Github) ■ No Develop branch, but flexibility for QA ■ Can be CD ● Protected branches ○ Limited users can merge ● No force push / rewriting history ● Unapprove PR’s when modified ○ Really? Provided by optional plugin?
- 24. ©2016 AKAMAI | FASTER FORWARD TM Q: Who wrote that code? ● Pusher != committer ● Committer $ git config --global user.name "John Doe" $ git config --global user.email [email protected] ● GPG? ● Log all commits/pusher?
- 25. ©2016 AKAMAI | FASTER FORWARD TM Access Control ● 1000’s of repos = 1000’s of ACLs ● Organizations / Projects ● LDAP groups? ● Access Controls ○ Who manages, approves access? ○ Audits access, quarterly? ● Separation of Concerns ○ Ops can’t modify code ○ Prove it!
- 26. ©2016 AKAMAI | FASTER FORWARD TM Automation ● API’s! ● Configure ● External Front Ends ○ User Mgmt ○ Webhooks ○ Audit settings
- 27. ©2016 AKAMAI | FASTER FORWARD TM References ● Github Enterprise Documentation ● Bitbucket Server Documentation
- 28. ©2016 AKAMAI | FASTER FORWARD TM Matthew Barr ● https://www.akamai.com ● [email protected] ● @matthewbarr - Twitter & Github: ● [email protected]