Gerrit at SAP

Gerrit at SAP

Introduction

SAP AG

Gerrit at SAP

Why is SAP using Gerrit?

Gerrit at SAP

Why is SAP using Gerrit?

Gerrit at SAP

Why is SAP using Gerrit?

Gerrit at SAP

Why is SAP using Gerrit?

Gerrit at SAP

Why is SAP using Gerrit?

Gerrit at SAP

Why is SAP using Gerrit?

Gerrit at SAP

Why is SAP using Gerrit?

Gerrit at SAP

Why is SAP using Gerrit?

Gerrit at SAP

Why is SAP using Gerrit?

Gerrit at SAP

Gerrit at SAP

Main instance (2.7)

  • mainly small projects
  • number of projects: > 5K (~70GB)
  • number of users: ~ 8K
  • number of changes: ~ 400K
  • virtual machine: 16 CPU, 64GB RAM

Special instance (2.5.2)

  • 1 huge project (~15GB)
  • number of users: > 2K
  • hardware cluster, 80 CPU, 1TB RAM

 

Further Gerrit instances in preparation.

Project Administration & Self-Services

SAP Project Portal

Project Search

Quick Search

../../img/project-portal-search-1.png

Result

../../img/project-portal-search-2.png

Project Info

../../img/project-portal-project-info.png

Project Info

../../img/project-portal-project-info-about.png

Project Info

../../img/project-portal-project-info-project-team.png

Project Info

../../img/project-portal-project-info-links.png

Contribute to a project

  1. find project in Project Portal
  2. clone the Git repository
  3. make a change and push to Gerrit for review

Contribute to a project

Everyone at SAP can contribute to any SAP project ➊!

➊ any project hosted in Gerrit

Project Creation

Skalli

../../img/skalli.png

Default Access Rights

Default Access Rights

Default Access Rights

Default Access Rights

Default Access Rights

Project access rights

../../img/project-access-rights.png

Inherited default access rights

../../img/default-access-rights.png

Default Access Rights

Default Access Rights

Default Access Rights

Default Access Rights

Default Access Rights

Default Access Rights

Decentralized Project Administration

SAP Product Standards

Requirements for development infrastructures

SAP Product Standards

For each code change it must be possible to find the person that was doing the change.

SAP Product Standards

Traceability

SAP Product Standards

Every release build must be reproducable.

SAP Product Standards

Special processes are enforced for release branches:

Self-Service for Service User Creation

Configuration of serviceuser Plugin

../../img/service-user-plugin-administration.png

Configuration of serviceuser Plugin

../../img/service-user-plugin-administration-help-messages.png

Configuration of serviceuser Plugin

../../img/service-user-plugin-administration-email.png

Configuration of serviceuser Plugin

../../img/service-user-plugin-administration-group.png

Configuration of serviceuser Plugin

../../img/service-user-plugin-administration-git-notes.png

Observed misuses of Gerrit

Protect against misuse of Gerrit

Administration Pain Points

Summary - Project Administration & Self-Services

Future Plans

Future Plans

Offer Gerrit as Git Service in the SAP HANA Cloud Platform.

Future Plans

Offer Gerrit as Git Service in the SAP HANA Cloud Platform.

Future Plans

Offer Gerrit as Git Service in the SAP HANA Cloud Platform.

Helium

../../img/helium.png

Requirements for Gerrit

Requirements for Gerrit

Requirements for Gerrit

Requirements for Gerrit

Requirements for Gerrit

Multi Tenancy Support in Gerrit

Map tenant to top-level folder in Gerrit.

Multi Tenancy Support in Gerrit

Map tenant to top-level folder in Gerrit.

../../img/tenant-projects.png

Multi Tenancy Support in Gerrit

Tenant users must only see projects of their own tenant.

ProjectControl
  /** Can this user see this project exists? */
  public boolean isVisible() {
    if (user instanceof InternalUser && !isHidden()) {
      return true;
    }

    if (!canPerformOnAnyRef(Permission.READ) || isHidden()) {
      return false;
    }

    Project p = state.getProject();
    for (ProjectFilter e : visibilityExtensions) {
      if (!e.accept(p)) {
        return false;
      }
    }
    return true;
  }
ProjectFilter
  /**
   * An extension to the standard project visibility check
   */
  public interface ProjectFilter {
    public boolean accept(Project project);
  }
Tenant ProjectFilter
  class TenantAsTopLevelFolder implements ProjectFilter {
    private final Provider<CurrentUser> currentUser;
    private final DomainDbClient checker;

    @Inject
    public TenantAsTopLevelFolder(Provider<CurrentUser> currentUser,
        DomainDbClient checker) {
      this.currentUser = currentUser;
      this.checker = checker;
    }

    @Override
    public boolean accept(Project project) {
      if (currentUser.get().getCapabilities().canAdministrateServer()) {
        return true;
      }

      String projectName = project.getName();
      int n = projectName.indexOf('/');
      if (n == -1) {
        return false;
      }
      String tenant = projectName.substring(0, n);
      String userName = currentUser.get().getUserName();
      return checker.hasGitAccess(userName, tenant);
     }
  }

Questions?