Skip to content
Snippets Groups Projects

2023-05-04: Remove admin rights from ops-gitlab-net

Production Change

Change Summary

The ops-gitlab-net shared admin account has been flagged as a risk so we need to take action. This CR is about turning ops-gitlab-net into a regular account as it's used for project mirroring, etc but doesn't need admin.

Before executing on this, we should figure out how SREs can have access to ops.gitlab.net going forward: https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/17366#note_1377565296

Issue: https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/17366

Change Details

  1. Services Impacted - ops.gitlab.net
  2. Change Technician - @gsgl
  3. Change Reviewer - @pguinoiseau
  4. Time tracking - unknown
  5. Downtime Component - none

Detailed steps for the change

Change Steps - steps to take to execute the change

Estimated Time to Complete (mins) - 30min

  • Set label changein-progress /label ~change::in-progress

  • Invite ops-gitlab-net as owner of the gitlab-org group

  • Invite ops-gitlab-net as owner of the gitlab-com group

  • Invite ops-gitlab-net as owner of the gitlab-cookbooks group

  • Remove ops-gitlab-net from the reliability group (already an owner of gitlab-org)

  • Remove ops-gitlab-net from the scalability group (already an owner of gitlab-org)

  • Remove ops-gitlab-net from the delivery group (already an owner of gitlab-org)

  • Remove ops-gitlab-net from the infrastructure group (already an owner of gitlab-com)

  • Shell into the toolbox container: and run in gitlab-rails console:

    kubectl -n gitlab exec -it deployments/ops-gitlab-toolbox -c toolbox -- gitlab-rails console

    Ruby snippet:

    u = User.find_by_username('ops-gitlab-net')
u.update(admin: false)

  • Set label changecomplete /label ~change::complete

Rollback

Rollback steps - steps to be taken in the event of a need to rollback this change

Estimated Time to Complete (mins) - 30min

  • Remove ops-gitlab-net from the gitlab-org group

  • Remove ops-gitlab-net from the gitlab-com group

  • Remove ops-gitlab-net from the gitlab-cookbooks group

  • Add ops-gitlab-net to the reliability group

  • Add ops-gitlab-net to the scalability group

  • Add ops-gitlab-net to the delivery group

  • Add ops-gitlab-net to the infrastructure group

  • SSH to gitlab-01-inf-ops.c.gitlab-ops.internal and run in sudo gitlab-rails console:

    u = User.find_by_username('ops-gitlab-net')
u.update(admin: true)

  • Set label changeaborted /label ~change::aborted

Monitoring

Key metrics to observe

  • Metric: Metric Name
    • Location: Dashboard URL
    • What changes to this metric should prompt a rollback: Describe Changes

Change Reviewer checklist

C4 C3 C2 C1:

  • Check if the following applies:
    • The scheduled day and time of execution of the change is appropriate.
    • The change plan is technically accurate.
    • The change plan includes estimated timing values based on previous testing.
    • The change plan includes a viable rollback plan.
    • The specified metrics/monitoring dashboards provide sufficient visibility for the change.

C2 C1:

  • Check if the following applies:
    • The complexity of the plan is appropriate for the corresponding risk of the change. (i.e. the plan contains clear details).
    • The change plan includes success measures for all steps/milestones during the execution.
    • The change adequately minimizes risk within the environment/service.
    • The performance implications of executing the change are well-understood and documented.
    • The specified metrics/monitoring dashboards provide sufficient visibility for the change.
      • If not, is it possible (or necessary) to make changes to observability platforms for added visibility?
    • The change has a primary and secondary SRE with knowledge of the details available during the change window.
    • The labels blocks deployments and/or blocks feature-flags are applied as necessary

Change Technician checklist

  • Check if all items below are complete:
    • The change plan is technically accurate.
    • This Change Issue is linked to the appropriate Issue and/or Epic
    • Change has been tested in staging and results noted in a comment on this issue.
    • A dry-run has been conducted and results noted in a comment on this issue.
    • The change execution window respects the Production Change Lock periods.
    • For C1 and C2 change issues, the change event is added to the GitLab Production calendar.
    • For C1 and C2 change issues, the SRE on-call has been informed prior to change being rolled out. (In #production channel, mention @sre-oncall and this issue and await their acknowledgement.)
    • For C1 and C2 change issues, the SRE on-call provided approval with the eoc_approved label on the issue.
    • For C1 and C2 change issues, the Infrastructure Manager provided approval with the manager_approved label on the issue.
    • Release managers have been informed (If needed! Cases include DB change) prior to change being rolled out. (In #production channel, mention @release-managers and this issue and await their acknowledgment.)
    • There are currently no active incidents that are severity1 or severity2
    • If the change involves doing maintenance on a database host, an appropriate silence targeting the host(s) should be added for the duration of the change.
Edited by Gonzalo Servat