FA8307_GitLab_Ultimate_Alternatives_Research_Atch_1.xlsx
XLSX spreadsheet 18 KB Posted
- Attached to
- FA8307_GitLab_Ultimate_Alternatives_FY25
- Solicitation number
- FA8307_GitLab_Ultimate_Alternatives_FY25
About this file
This document is a Request for Information (RFI) and Market Research related to federal contract opportunity FA8307_GitLab_Ultimate_Alternatives_FY25. The government is seeking alternative licensing models or solutions to GitLab Ultimate for self-hosted, containerized deployment compatible with AWS EKS. Key requirements include CI/CD capabilities, artifact registry hosting, security testing, issue tracking, repository mirroring, compliance features, and integrations with DevOps tools. Vendors are requested to provide details on available licensing options, pricing, transition/training costs, and any additional features or benefits. Responses should use the provided requirements capability sheet and either the RFI excel template or the word document sections on alternative license types, pricing, and other considerations. The government intends to compete this requirement through DoD ESI or NASA SEWP. Responses should be submitted to the specified government points of contact.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| FA8307_GitLab_Ultimate_Alternatives_Research.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFI Excel version of Word sheet
| Alternative License Types: | |
| 1 | What alternate licensing models or solutions do you offer for Gitlab Ultimate? |
(Please provide details on available options, such as enterprise, cloud-managed, or open-source/community editions. For each licensing option/solution set, please provide how it differs from the listed license.) [INSERT ANSWER HERE
2 For each licensing option/solution set, please provide how it is similar from the listed license.
(Specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities) [INSERT ANSWER HERE
3 For each licensing option/solution set, please provide how it meets the above requirements.
(Identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license type.) [INSERT ANSWER HERE
4 For each licensing option/solution set, clarify how it meets the above requirements for our logging and monitoring needs.
(Please highlight specific ways in which each licensing tier can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.) [INSERT ANSWER HERE
| Pricing Information: | |
| 1 | For each license, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution. |
(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.) [INSERT ANSWER HERE
2 For each license, please provide any price plans associated such as monthly, trial, annual.
(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.) [INSERT ANSWER HERE
| Other Considerations: | |
| 1 | Are there any additional features or benefits associated with the different licenses that we should consider? |
For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses. [INSERT ANSWER HERE
2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?
(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.) [INSERT ANSWER HERE
Requirements Capability Sheet
| GITLAB ULTIMATE ALTERNATIVE: | [PUT NAME HERE] | ||||
| Instructions: | Please select Y/N | Please select Y if Yes, N if no plans, or N/A if ready on day 1 | Please insert # of days from award to build capability or a date if known | Please insert comments, questions, or concerns for each requirement if needed | |
| Requirement: | Ready on Day 1 | Future Capability | Estimated date of Capability | Comments | |
| 1 | Must be capable of being self-hosted. | ||||
| 2 | Must be capable of being containerized. | ||||
| 3 | Must be deployable with containers and Helm Charts. | ||||
| 4 | Must be compatible with Amazon Web Services (AWS) EKS. | ||||
| 5 | The solution must be able to leverage Single Sign On (SSO), and OIDC and SAML compatibility. | ||||
| 6 | Must provide built-in CI/CD capabilities with pipeline support with configuration-as-code via YAML files. | ||||
| 7 | Must provide the ability to create templated CI/CD pipelines. | ||||
| 8 | Must be capable of hosting Linux Foundation Open Container Initiative (OCI) artifact registry. | ||||
| 9 | Must be capable of acting as a package repository for the following: | ||||
| 9a | Npm | ||||
| 9b | NuGet | ||||
| 9c | Python/pip | ||||
| 9d | Maven/Gradle | ||||
| 9e | Generic/tarball artifacts | ||||
| 10 | Must provide Static Application Security Testing (SAST) capability for scanning pipelines. | ||||
| 11 | Must support Dynamic Application Security Testing (DAST), license compliance, and dependency scanning. | ||||
| 12 | Vulnerability Management: Must provide clear vulnerability reporting and management with options for automatic vulnerability remediation (GitLab offers an in-depth vulnerability dashboard and dependency scanning). | ||||
| 13 | Must provide a built-in Issue Tracker integrated with pipeline operations with issue management workflows. | ||||
| 14 | Must provide KanBan-style boards for planning and managing work. | ||||
| 15 | Needs-based pipelines: Pipeline must be able to be run in parallel and dependencies setup in a non-linear manner | ||||
| 16 | Must have integrated source control management. | ||||
| 17 | Must have compatibility with service mesh usage–Istio at a minimum. | ||||
| 18 | Project Creation and Management: Must provide an ability to create and organize projects efficiently, with options for subgrouping and nesting within repositories. | ||||
| 19 | Repository Mirroring: Must provide a capability to mirror repositories to and from external sources to sync code across different servers. | ||||
| 20 | Customizable Project Templates: Must provide access to predefined project templates to standardize setup across repositories. | ||||
| 21 | Branching Strategy Support: Must support a range of branching strategies such as Git Flow, feature branches, and hotfix branches. | ||||
| 22 | Merge Request System: Must provide robust merge request (MR) features for collaborative code review, with options for approvals, discussions, and suggestions within the MR. | ||||
| 23 | Discussions and Threads: Must support in-line code comments, discussions, and threads within merge requests for effective code review (GitLab’s MR comments and threads improve team collaboration). | ||||
| 24 | Customizable Runners: Must provide support for self-hosted or shared runners to control build environments and workload distribution. | ||||
| 25 | Environment Management: Must provide the ability to manage and preview deployment environments and monitor each environment’s status. | ||||
| 26 | Automated Testing and Code Quality Reports: Must provide built-in integration for automated testing and analysis tools, including code quality reports and test summaries. | ||||
| 27 | Documentation and Wiki Support: Must provide the ability to create and maintain project documentation or Wiki pages within the repository. | ||||
| 28 | Permissions and Role Management: Must provide granular access control to set permissions by user roles. | ||||
| 29 | Audit Logs and Compliance Tracking: Must provide detailed audit logs and compliance features to track changes and meet industry standards. | ||||
| 30 | Branch Protection and Approvals: Must provide the capability to set protected branches and require approvals for merges to ensure secure code deployment. | ||||
| 31 | Project and Team Analytics: Must provide project metrics and team analytics to track contributions, velocity, and overall activity. | ||||
| 32 | Pipeline and Job Logs: Must provide detailed logging and monitoring of CI/CD pipelines for troubleshooting and performance analysis. | ||||
| 33 | Code Review Analytics: Must provide insights on code review performance, merge request times, and other metrics for process improvement. | ||||
| 34 | Integration with DevOps Tools: Must be compatible with third-party DevOps tools and services such as Kubernetes and Prometheus. | ||||
| 35 | Infrastructure as Code (IaC) Support: Must provide support for managing IaC directly in the repository, including CI/CD for IaC deployments. | ||||
| 36 | High Scalability and Availability: Must provide support for large, distributed teams with high availability options. | ||||
| 37 | Efficient Caching and Performance Optimization: Must provide built-in caching to reduce CI/CD job times and optimize resource use. | ||||
| 38 | Distributed Collaboration: Must support geographically dispersed teams to collaborate with minimal latency. | ||||
| 39 | User-Friendly Interface: Must provide an intuitive and customizable interface for ease of navigation. | ||||
| 40 | Comprehensive Documentation and Support: Must provide users access to extensive documentation, community support, and professional support plans. | ||||
| 41 | Customizable Notifications and Alerts: Must provide configurable notifications for merge requests, CI/CD pipelines, and other project events. | ||||
| 42 | Version Control: Must provide an integrated Version Control Service (VCS) with the following features: | ||||
| 42a | Must be capable of hosting git repositories, | ||||
| 42b | Must support the protection of a "main" or "master" branch and the creation of multiple other branches within the repository | ||||
| 42c | Must support a "merge" workflow to integrate the work on non-main branches ("feature branches" or "dev branches") into the protected primary branch | ||||
| 43 | Compliance: Must provide the ability to enforce policies for MRs that prevent project owners from overriding MR rules. | ||||
| 44 | Merge requests: Must provide the ability to do Merge trains, wherein merge requests are completed based on order and MR pipeline status. | ||||
| 45 | Scan execution policies: Must provide the ability to run pipelines and scans as policy, which allows for doing ad-hoc incident response. | ||||
| 46 | Tailored support: Must provide an integrated customer support model for expected use cases like meeting with P1 engineers, supporting critical CVE upgrades in Iron Bank, and being reachable via chat or other means. | ||||
| 47 | Mattermost notifications: Must provide the capability for P1 to enable webhooks to send notifications to P1's instance of Mattermost whenever any changes to repos are made or if issues are found in pipelines. | ||||
| 48 | Custom and built-in pipeline variable integrations: Must provide the ability to use built-in CI variables for easier runtime pipeline logic. Also with custom variables in pipelines, can make CI code more adaptable | ||||
| 49 | Robust API: Must provide an API that enables automation and integrations across other tools and datasets. | ||||
| 50 | Access tokens: Must provide the ability to create access tokens for personal use as well as per-repo and per-group use to scope down authentication. Access tokens must also have the ability to be scoped down in role and permissions to said groups and projects. | ||||
| 51 | Custom roles: Must provide the ability to create custom roles for specific, tailored functions within the DevOps platform. | ||||
| 52 | Auditing: Must provide the ability to audit all functions within each repository and determine user-level actions on settings manipulation and code tagging. | ||||
| 53 | DORA Metrics: Must provide CI/CD Metrics like deployment frequency, contributor level metrics, and repository analytics. | ||||
| 54 | Must be able to integrate code coverage metrics into MR dashboards. | ||||
| 55 | Must be able to support using tools like Renovate for library and dependency updates. | ||||
| 56 | Desired: Provide NIST 800-53 controls for built-in SAST scanning capability. | ||||
| 57 | Desired: Provide testing compatibility with sidecar-less service meshes, e.g., Istio Ambient Mesh, Cillium, and other eBPF technology. |
Leave Blank
| Y | Y |
| N | N |
| N/A |
File details come from the government source that posted it. Updated .