/2022/01/terraform-provider-gitlabci/terraform_gitlab.png

terraform-provider-gitlabci: Register GitLab CI Runners

Easy runner registration via terraform

Chris Weyl published on 2022-01-14 included in GitLab Infrastructure as Code

I’m a huge fan of terraform, so when I needed to build out cloud infrastructure for GitLab CI/CD it was the first thing I reached for. The native terraform-provider-gitlab was very useful, but left out one critical detail: it was not possible to register a runner.

Ouch. 💢

Docker container network interface ordering

...it seems kinda random, yeah?

Chris Weyl published on 2022-01-08 included in Random Tidbits

Lately I’ve found myself routinely attaching Docker-based containers to multiple networks. This has led to a couple… interesting surprises.

/2020/10/using-a-metadata-proxy-for-secure-iam-in-gitlab-ci/phone-operator.jpg

Using a Metadata Proxy to Limit AWS/IAM Access with GitLab CI

Chris Weyl published on 2020-10-05 included in GitLab

The gitlab-runner agent is very flexible, with multiple executors to handle most situations. Similarly, AWS IAM allows one to use “instance profiles” with EC2 instances, obviating the need for static, long-lived credentials. In the situation where one is running gitlab-runner on an EC2 instance, this presents us with a couple interesting challenges – and opportunities.

/2020/08/additional-gitlab-metrics-with-pg-exporter/bottles.jpg

Additional GitLab Metrics using `pg_exporter`

Chris Weyl published on 2020-08-27 included in GitLab

GitLab makes a great deal of information available through Prometheus metrics. But not everything.

/2020/08/kms-key-context-and-s3/keys.jpg

KMS key context, IAM conditions, and s3

Chris Weyl published on 2020-08-23 included in AWS

At $work, I’ve been using KMS to encrypt s3 bucket contents for some time now. It works rather well, but one thing that had been bugging me is that our IAM policies granted both read permissions on bucket objects and encrypt/decrypt on the relevant KMS key. That is, principals with the policies attached can use the key to encrypt/decrypt anything they otherwise have permission to access, not just objects in the bucket.

/2019/03/conditional-git-includes/pikwizard-traffic-lights-with-red-light-on.jpg

Conditional git Configuration

Chris Weyl published on 2019-03-21 included in Dev Tooling

git has always(?) allowed for additional configuration files to be unconditionally included. However, sometimes on our systems we also have certain locations where we store multiple git projects, which may need different configuration from the global, but still common across that location.