[CR] [gprd] Switch to new HAProxy 2.6 internal gateway

Production Change

Change Summary

In this change, we replace the int.gprd.gitlab.net DNS name which points the old HAProxy 1.8 with the new internal-gateway.gprd.gitlab.net DNS name pointing to the new HAProxy 2.6.

Change Details

1. Services Impacted - ServiceHAProxy
2. Change Technician - @miladx
3. Change Reviewer - @f_santos
4. Time tracking - 30 minutes
5. Downtime Component - none

Detailed steps for the change

Prep

• Notify the Delivery team about this change, risks, and potential disruption as well as the exact time of execution.
  • Slack channel: #g_delivery
  • Point of contact: @jennykim-gitlab

Change Steps - steps to take to execute the change

Estimated Time to Complete (mins) - 30

• Set label changein-progress /label ~change::in-progress
• Merge gitlab-com/gl-infra/k8s-workloads/gitlab-com!2742 (merged)
  • Ensure the post-merge pipeline is green
    • https://gitlab.com/gitlab-com/gl-infra/k8s-workloads/gitlab-com/-/pipelines/877988155
  • Wait for the ops deployment pipeline to apply the change.
    • https://ops.gitlab.net/gitlab-com/gl-infra/k8s-workloads/gitlab-com/-/pipelines/1965113
• Verify the Ingress annotations have been updated.
  • gprd-us-east1-b
    • glsh kube use-cluster gprd-us-east1-b
    • kubectl get ingress gitlab-webservice-api --namespace=gitlab --output=yaml
  • gprd-us-east1-c
    • glsh kube use-cluster gprd-us-east1-c
    • kubectl get ingress gitlab-webservice-api --namespace=gitlab --output=yaml
  • gprd-us-east1-d
    • glsh kube use-cluster gprd-us-east1-d
    • kubectl get ingress gitlab-webservice-api --namespace=gitlab --output=yaml
• Merge https://gitlab.com/gitlab-com/gl-infra/chef-repo/-/merge_requests/3519
  • Ensure the post-merge pipelines are all green!
    • https://gitlab.com/gitlab-com/gl-infra/chef-repo/-/pipelines/878034908
    • https://ops.gitlab.net/gitlab-com/gl-infra/chef-repo/-/pipelines/1965251
• Run chef-client on all affected instances to update the new DNS names.
  • knife ssh 'roles:gprd-base-stor-gitaly-common' 'sudo chef-client'
  • knife ssh 'roles:gprd-infra-prometheus-server' 'sudo chef-client'
• Check out the metrics listed in the monitoring section.
• Run the end-to-end QA tests against the gprd environment.
  • Run a pipeline on master branch here.
    • https://ops.gitlab.net/gitlab-org/quality/production/-/pipelines/1965273
• Set label changecomplete /label ~change::complete

Rollback

Rollback steps - steps to be taken in the event of a need to rollback this change

Estimated Time to Complete (mins) - 10

• Revert https://gitlab.com/gitlab-com/gl-infra/chef-repo/-/merge_requests/3519
• Set label changeaborted /label ~change::aborted

Monitoring

Key metrics to observe

• Dashboard: HAProxy 2
• Metric: Current number of sessions for the new HAProxy main nodes
  • Thanos Query
  • We expect a small jump around a few thousand in the number of sessions coming from the internal load balancer.

Change Reviewer checklist

C4 C3 C2 C1:

• Check if the following applies:
  • The scheduled day and time of execution of the change is appropriate.
  • The change plan is technically accurate.
  • The change plan includes estimated timing values based on previous testing.
  • The change plan includes a viable rollback plan.
  • The specified metrics/monitoring dashboards provide sufficient visibility for the change.

C2 C1:

• Check if the following applies:
  • The complexity of the plan is appropriate for the corresponding risk of the change. (i.e. the plan contains clear details).
  • The change plan includes success measures for all steps/milestones during the execution.
  • The change adequately minimizes risk within the environment/service.
  • The performance implications of executing the change are well-understood and documented.
  • The specified metrics/monitoring dashboards provide sufficient visibility for the change.
    • If not, is it possible (or necessary) to make changes to observability platforms for added visibility?
  • The change has a primary and secondary SRE with knowledge of the details available during the change window.
  • The labels blocks deployments and/or blocks feature-flags are applied as necessary

Change Technician checklist

• Check if all items below are complete:
  • The change plan is technically accurate.
  • This Change Issue is linked to the appropriate Issue and/or Epic
  • Change has been tested in staging and results noted in a comment on this issue.
  • A dry-run has been conducted and results noted in a comment on this issue.
  • The change execution window respects the Production Change Lock periods.
  • For C1 and C2 change issues, the change event is added to the GitLab Production calendar.
  • For C1 and C2 change issues, the SRE on-call has been informed prior to change being rolled out. (In #production channel, mention @sre-oncall and this issue and await their acknowledgement.)
  • For C1 and C2 change issues, the SRE on-call provided approval with the eoc_approved label on the issue.
  • For C1 and C2 change issues, the Infrastructure Manager provided approval with the manager_approved label on the issue.
  • Release managers have been informed (If needed! Cases include DB change) prior to change being rolled out. (In #production channel, mention @release-managers and this issue and await their acknowledgment.)
  • There are currently no active incidents that are severity1 or severity2
  • If the change involves doing maintenance on a database host, an appropriate silence targeting the host(s) should be added for the duration of the change.ifjhjre