CI/CD Essentials

Day 1: High-level presentation on DevOps concepts (1 hour)

Title: “Exploring the DevOps Toolbox: Tools for Scalability, Deployment, and Incident Management”

Objective

Provide a high-level overview of essential DevOps tools, their purposes, and how they fit into the CI/CD and operations ecosystem.

Content Outline

• What is the DevOps Ecosystem?
  • A brief history of DevOps and the role of automation in modern workflows.
  • Key categories of DevOps tools: Infrastructure, CI/CD, Observability, and Incident Management.
• Popular Tools Developers Should Know:
  • Infrastructure as Code (IaC): Terraform, Ansible.
  • Containerization and Orchestration: Docker, Kubernetes, Helm.
  • Deployment Automation: ArgoCD (GitOps for Kubernetes).
  • Monitoring and Alerts: Prometheus, Grafana, Opsgenie.
• Real-World Integration:
  • How tools like Helm and ArgoCD work together for Kubernetes deployments.
  • Using Opsgenie for proactive incident response.

Day 1: Foundations of CI/CD Pipelines (5 hours)

• Key Topics:
  • Introduction to CI/CD.
    • Benefits of CI/CD and its role in software delivery.
  • GitLab overview and pipeline architecture.
  • Designing efficient pipelines with stages, jobs, and runners.
  • Managing build stages, jobs, and runners.
  • Introduction to securing CI/CD pipelines:
    • Managing secrets and environment variables securely (e.g., GitLab CI/CD secrets).
    • Implementing access controls and audit logs for GitLab projects (RBAC).
• Hands-On Lab (paired):
  • Create and deploy a simple CI/CD pipeline in GitLab.
  • Automate a sample application build and test.
  • Secure the pipeline using GitLab’s built-in secret management and RBAC features.

Day 2: High-level presentation on DevOps concepts (1 hour)

Title: “GitOps, Branching Strategies, and Repository Design for Scale”

Objective

Introduce developers to effective branching strategies, GitOps principles, and the pros and cons of monorepo vs. multirepo setups.

Content Outline

1. Branching Strategies for teams:
   • Overview of popular branching models:
     • GitFlow, Trunk-based Development, and Release Branching.
   • How to choose a strategy for your team size and release cycle.
2. Introduction to GitOps:
   • What is GitOps, and why is it important?
   • Git as the single source of truth for infrastructure and deployments.
   • Tooling examples: Flux, ArgoCD.
3. Monorepo vs. Multirepo:
   • Monorepo: Advantages (simplified dependency management, single source of truth) and challenges (scalability, complexity).
   • Multirepo: Advantages (independence, faster builds) and challenges (dependency tracking, fragmentation).
   • When to choose each approach.

Day 2: Monitoring and Observability (5 hours)

• Key Topics:
  • Monitoring principles and the “Three Pillars of Observability” (metrics, logs, and traces).
  • Setting up Prometheus for pipeline and system metrics collection.
  • Visualizing metrics with Grafana dashboards.
  • Creating and analyzing dashboards for system health.
  • Incident response workflows.
  • Security logging essentials:
    • Identifying suspicious activities in logs (e.g., unauthorized access attempts).
    • Correlating logs for security incident detection.
    • Proactive alerting for pipeline issues and potential security threats.
• Hands-On Lab (paired):
  • Integrate Prometheus and Grafana with GitLab to monitor pipeline performance.
  • Build dashboards to monitor CI/CD pipeline performance.
  • Configure security logging to detect and analyze failed login attempts and unauthorized changes.
• Tools used:
  • Prometheus:
    • Open-source metrics and monitoring tool.
    • Used to collect and store real-time metrics such as system performance and pipeline health.
  • Grafana:
    • Visualization tool integrated with Prometheus for building and customizing dashboards.
    • Enables participants to create real-time visual insights into pipeline metrics.
  • GitLab’s Built-in Monitoring Features:
    • Exploring the monitoring and analytics capabilities provided directly within GitLab, such as pipeline insights, job statistics and historical DORA metrics.

Day 3: High-level presentation on DevOps concepts (1 hour)

Title: “Smart Deployments: Canary Releases, A/B Testing, and Rollbacks”

Objective

Teach developers about deployment strategies that minimize risk, maximize user feedback, and ensure smooth rollbacks when failures occur.

Content Outline

1. Modern Deployment Strategies:
   • Canary Deployments: Gradually rolling out changes to a small user subset.
   • Blue/Green Deployments: Seamlessly switching between environments for zero downtime.
   • A/B Testing: Testing variations in production to gather user behavior data.
2. Failure Recovery Techniques:
   • Importance of monitoring during deployments (using tools like Prometheus and Grafana).
   • Automated rollbacks and the role of health checks.
3. Real-World Examples:
   • How big tech companies like Google or Netflix implement these strategies.
   • Simpler versions of these strategies for small teams.

Day 3: Logging and Advanced Practices (5 hours)

• Key Topics:
  • Centralized Logging for CI/CD Pipelines:
    • Setting up ELK (Elasticsearch, Logstash, Kibana) for log aggregation.
    • Troubleshooting pipeline and application issues using centralized logs.
  • Enhancing CI/CD Pipelines:
    • Implementing automated rollbacks and canary deployments.
    • Continuous improvement of pipeline performance and security.
  • Security Testing in Pipelines:
    • Introduction to SAST (Static Application Security Testing).
    • Running DAST (Dynamic Application Security Testing) on deployed applications.
    • Analyzing and remediating vulnerabilities in SAST and DAST reports.
  • Incident response workflows and case studies.
    • Best practices for responding to and mitigating security incidents.
• Hands-On Lab (paired):
  • Configure centralized logging for GitLab pipelines.
  • Simulate and troubleshoot common CI/CD pipeline issues.
  • Integrate GitLab SAST and DAST scans to identify and fix vulnerabilities in the code.