2024-04-10: [CR] [gprd] Change internalTrafficPolicy to Cluster for Consul K8s Service
Production Change
Change Summary
This change will address this issue. Here is a summary.
Currently, the consul-gl-consul-dns
service has internalTrafficPolicy set to Local
. This means for nodes that only run a single consul-gl-consul-client
pod, all requests to this service name go to one pod making Consul running on the majority of nodes a Single Point of Failure (SPoF). This issue has recently caused an incident.
The immediately required change is to remove the internalTrafficPolicy: Local
which changes the consul-gl-consul-dns
to pick either a consul-gl-consul-server
or a consul-gl-consul-client
pod on any node in the cluster. This addresses the single-point-of-failure concern.
Please notice that we run the Consul server agents only on the regional cluster.
See this comment for more details.
Change Details
- Services Impacted - ServiceConsul
- Change Technician - @miladx
- Change Reviewer -@mchacon3
- Time tracking - 120 minutes
- Downtime Component - none
Set Maintenance Mode in GitLab
If your change involves scheduled maintenance, add a step to set and [unset maintenance mode] (https://gitlab.com/gitlab-com/runbooks/-/blob/master/docs/monitoring/set_maintenance_window.md) per our runbooks. This will make sure SLA calculations adjust for the maintenance period.
Detailed Steps For The Change
Change Steps - steps to take to execute the change
Estimated Time to Complete (mins) - 120
-
Set label changein-progress /label ~change::in-progress
-
Merge gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4736 (merged) -
Ensure all post-merge pipelines are green and passed.
-
-
Merge gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4737 (merged) -
Ensure all post-merge pipelines are green and passed.
-
-
Merge gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4738 (merged) -
Ensure all post-merge pipelines are green and passed.
-
-
Merge gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4739 (merged) -
Ensure all post-merge pipelines are green and passed.
-
-
Merge gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4740 (merged) -
Ensure all post-merge pipelines are green and passed.
-
-
Set label changecomplete /label ~change::complete
Rollback
Any increased and sustained level of errors in dashboards or logs should trigger a rollback.
Rollback Steps - steps to be taken in the event of a need to rollback this change
Estimated Time to Complete (mins) - 20
-
Revert gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4740 (merged) -
Revert gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4739 (merged) -
Revert gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4738 (merged) -
Revert gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4737 (merged) -
Revert gitlab-com/gl-infra/k8s-workloads/gitlab-helmfiles!4736 (merged) -
Set label changeaborted /label ~change::aborted
Monitoring
Key metrics to observe
-
Dashboard: consul: Overview
- Monitor the Service Error Ratio and Service RPS and ensure there are no soft or hard violations
- Have an eye on Saturation metric. It should show no big change in its recent trend.
-
Logs: Consul errors
- Look for any errors after merging each MR.
Change Reviewer checklist
-
Check if the following applies: - The scheduled day and time of execution of the change is appropriate.
- The change plan is technically accurate.
- The change plan includes estimated timing values based on previous testing.
- The change plan includes a viable rollback plan.
- The specified metrics/monitoring dashboards provide sufficient visibility for the change.
-
Check if the following applies: - The complexity of the plan is appropriate for the corresponding risk of the change. (i.e. the plan contains clear details).
- The change plan includes success measures for all steps/milestones during the execution.
- The change adequately minimizes risk within the environment/service.
- The performance implications of executing the change are well-understood and documented.
- The specified metrics/monitoring dashboards provide sufficient visibility for the change.
- If not, is it possible (or necessary) to make changes to observability platforms for added visibility?
- The change has a primary and secondary SRE with knowledge of the details available during the change window.
- The change window has been agreed with Release Managers in advance of the change. If the change is planned for APAC hours, this issue has an agreed pre-change approval.
- The labels blocks deployments and/or blocks feature-flags are applied as necessary.
Change Technician checklist
-
Check if all items below are complete: - The change plan is technically accurate.
- This Change Issue is linked to the appropriate Issue and/or Epic
- Change has been tested in staging and results noted in a comment on this issue.
- A dry-run has been conducted and results noted in a comment on this issue.
- The change execution window respects the Production Change Lock periods.
- For C1 and C2 change issues, the change event is added to the GitLab Production calendar.
- For C1 and C2 change issues, the SRE on-call has been informed prior to change being rolled out. (In #production channel, mention
@sre-oncall
and this issue and await their acknowledgement.) - For C1 and C2 change issues, the SRE on-call provided approval with the eoc_approved label on the issue.
- For C1 and C2 change issues, the Infrastructure Manager provided approval with the manager_approved label on the issue.
- Release managers have been informed prior to any C1, C2, or blocks deployments change being rolled out. (In #production channel, mention
@release-managers
and this issue and await their acknowledgment.) - There are currently no active incidents that are severity1 or severity2
- If the change involves doing maintenance on a database host, an appropriate silence targeting the host(s) should be added for the duration of the change.