2024-06-20: [non-production] Remove gitlab_unstable repository from the gitlab-omnibus-secrets in vault
Production Change
Change Summary
Removing the gitlab_unstable
repository from the gitlab-omnibus-secret in vault. This aims to remove the repository that is not-used anymore, REF: production-engineering#25305 (closed)
Since it affects the omnibus installation there will be a lot of services it affects.
Change Details
- Services Impacted - Basically everything that uses omnibus-installation: redis, prometheus, patroni, console, haproxy and gitlay.
-
Change Technician -
@tkhandelwal3
- Change Reviewer - @jcstephenson
- Time tracking - 60 minutes
- Downtime Component - There won't be any downtime for the service but rather new deployments to the system would start failing.
Set Maintenance Mode in GitLab
If your change involves scheduled maintenance, add a step to set and unset maintenance mode per our runbooks. This will make sure SLA calculations adjust for the maintenance period.
Detailed steps for the change
Change Steps - steps to take to execute the change
Estimated Time to Complete (mins) - 90
-
Set label changein-progress /label ~change::in-progress
-
Remove the gitlab_unstable repository for gstg
from the chef secret vault at path:env/gstg/shared/gitlab-omnibus-secrets
. The field is present at:gitlab-server.apt.repository
in the JSON.-
Note the current version for the vault before deletion for rollback purposes.
-
-
Remove the /etc/apt/sources.list.d/gitlab_unstable.list
from all thegstg
nodesbundle exec knife ssh 'recipes:gitlab-server\:\:apt AND environment:gstg' sudo rm /etc/apt/sources.list.d/gitlab_unstable.list
-
Wait for the next deployment to gstg
and notify the@release-managers
to ping you in case anything goes wrong related to packages. -
Wait for a successful deployment to gstg -
Once the change has been validated on gstg apply the change to the following non-prod environments: -
dr-testing -
ops -
pre -
qa-runners -
release
-
-
Export the ENV to the target non-prod environment. # Example for dr-testing environment export ENV=dr-testing
-
Remove gitlab_unstable repository from the chef secret vault at path: env/$ENV/shared/gitlab-omnibus-secrets
. The field is present at:gitlab-server.apt.repository
in the JSON.-
Note the current version for the vault before deletion for rollback purposes.
-
-
Remove the /etc/apt/sources.list.d/gitlab_unstable.list
from all the $ENV nodes# **Replace $ENV with the env you are working with** bundle exec knife ssh 'recipes:gitlab-server\:\:apt AND environment:$ENV' sudo rm /etc/apt/sources.list.d/gitlab_unstable.list
-
Set label changecomplete /label ~change::complete
Rollback
Rollback steps - steps to be taken in the event of a need to rollback this change
Estimated Time to Complete (mins) - 10 mins
-
Rollback the vault version before the repository was removed. -
Run the chef-client
on the nodes to apply the repository back.#!/bin/bash # List of environments environments=("dr-testing" "gstg" "ops" "pre" "qa-runners" "release") # Loop through each environment and execute the command for env in "${environments[@]}"; do echo "Running chef-client on nodes in environment: $env" bundle exec knife ssh "recipes:gitlab-server\:\:apt AND environment:$env" 'sudo chef-client' done
-
Set label changeaborted /label ~change::aborted
Monitoring
Key metrics to observe
- Metric: Deployments
- Location: #announcements slack channel
- What changes to this metric should prompt a rollback: Failing deployments to the environments with relations to packages.
Change Reviewer checklist
-
Check if the following applies: - The scheduled day and time of execution of the change is appropriate.
- The change plan is technically accurate.
- The change plan includes estimated timing values based on previous testing.
- The change plan includes a viable rollback plan.
- The specified metrics/monitoring dashboards provide sufficient visibility for the change.
-
Check if the following applies: - The complexity of the plan is appropriate for the corresponding risk of the change. (i.e. the plan contains clear details).
- The change plan includes success measures for all steps/milestones during the execution.
- The change adequately minimizes risk within the environment/service.
- The performance implications of executing the change are well-understood and documented.
- The specified metrics/monitoring dashboards provide sufficient visibility for the change.
- If not, is it possible (or necessary) to make changes to observability platforms for added visibility?
- The change has a primary and secondary SRE with knowledge of the details available during the change window.
- The change window has been agreed with Release Managers in advance of the change. If the change is planned for APAC hours, this issue has an agreed pre-change approval.
- The labels blocks deployments and/or blocks feature-flags are applied as necessary.
Change Technician checklist
-
Check if all items below are complete: - The change plan is technically accurate.
- This Change Issue is linked to the appropriate Issue and/or Epic
- Change has been tested in staging and results noted in a comment on this issue.
- A dry-run has been conducted and results noted in a comment on this issue.
- The change execution window respects the Production Change Lock periods.
- For C1 and C2 change issues, the change event is added to the GitLab Production calendar.
- For C1 and C2 change issues, the SRE on-call has been informed prior to change being rolled out. (In #production channel, mention
@sre-oncall
and this issue and await their acknowledgement.) - For C1 and C2 change issues, the SRE on-call provided approval with the eoc_approved label on the issue.
- For C1 and C2 change issues, the Infrastructure Manager provided approval with the manager_approved label on the issue.
- Release managers have been informed prior to any C1, C2, or blocks deployments change being rolled out. (In #production channel, mention
@release-managers
and this issue and await their acknowledgment.) - There are currently no active incidents that are severity1 or severity2
- If the change involves doing maintenance on a database host, an appropriate silence targeting the host(s) should be added for the duration of the change.