You need to sign in or sign up before continuing.
GitLab-SSHD PROXY rollout [gprd]
Production Change
Change Summary
As part of enabling the IP Allowlisting feature for Git SSH:
Change Details
- Services Impacted - ServiceGitLab SSHD
- Change Technician - @ahyield
- Change Reviewer - @skarbek
- Time tracking - 60 minutes
- Downtime Component - None expected. If problems occur, they are localized to git ssh traffic.
Detailed steps for the change
Change Prerequisites
Please reference the internal note below
Change Steps - steps to take to execute the change
Estimated Time to Complete (mins) - 10 minutes
-
Set label changein-progress /label ~change::in-progress
-
Disable chef on the loadbalancers: knife ssh -C 3 'role:gprd-base-lb-fe' -- chef-client-disable 'gitlab-com/gl-infra/production/#7108'
Canary:
-
Merge and Apply https://gitlab.com/gitlab-com/gl-infra/chef-repo/-/merge_requests/1872 -
Manually trigger chef on fe-01-lb-gprd
.-
Enable chef on the node -
ssh fe-01-lb-gprd.c.gitlab-production.internal -- sudo -i chef-client-enable
ssh fe-01-lb-gprd.c.gitlab-production.internal -- sudo -i chef-client
-
Ensure chef finished successfully.
-
-
In /etc/haproxy/haproxy.conf
check thebackend ssh
section ensure:ssh fe-01-lb-gprd.c.gitlab-production.internal -- "sudo grep 'server gke-cny-ssh' /etc/haproxy/haproxy.cfg"
-
server gke-cny-ssh
containssend-proxy-v2
-
Manually trigger chef on the gprd-base-lb-fe
role via knife with a concurrency of 3- enable chef on the nodes
knife ssh -c 3 'role:gprd-base-lb-fe' -- sudo -i chef-client-enable
knife ssh -C 3 'role:gprd-base-lb-fe' -- sudo -i chef-client
- enable chef on the nodes
-
Validate in our logs that we are processing requests successfully in Canary -
Validate in our logs that the IP addresses show up as desired
Main:
-
Merge and Apply https://gitlab.com/gitlab-com/gl-infra/chef-repo/-/merge_requests/1873 -
Manually trigger chef on fe-01-lb-gprd
viasudo -i chef-client
.ssh fe-01-lb-gprd.c.gitlab-production.internal -- sudo -i chef-client
-
Ensure chef finished successfully.
-
In /etc/haproxy/haproxy.cfg
check thebackend ssh
section ensure:ssh fe-01-lb-gprd.c.gitlab-production.internal -- "sudo grep 'server shell-gke-us-east1-b' /etc/haproxy/haproxy.cfg"
-
server shell-gke-us-east1-b
containssend-proxy-v2
ssh fe-01-lb-gprd.c.gitlab-production.internal -- "sudo grep 'server shell-gke-us-east1-c' /etc/haproxy/haproxy.cfg"
-
server shell-gke-us-east1-c
containssend-proxy-v2
ssh fe-01-lb-gprd.c.gitlab-production.internal -- "sudo grep 'server shell-gke-us-east1-d' /etc/haproxy/haproxy.cfg"
-
server shell-gke-us-east1-d
containssend-proxy-v2
-
Manually trigger chef on the gprd-base-lb-fe
role via knife with a concurrency of 3knife ssh -C 3 'role:gprd-base-lb-fe' -- sudo -i chef-client
-
Validate in our metrics that are not exceeding any SLI thresholds -
Validate in our logs that the IP addresses are coming through as desired -
Set label changecomplete /label ~change::complete
Rollback
Rollback steps - steps to be taken in the event of a need to rollback this change
Estimated Time to Complete (mins) - 20 minutes
-
Drain traffic from Canary for only GitLab-Shell ./bin/set-weights gprd cny 0 ssh
-
Revert and Apply: https://gitlab.com/gitlab-com/gl-infra/chef-repo/-/merge_requests/1873 -
Force a chef run on the loadbalancers: knife ssh 'role:gprd-base-lb-fe' 'sudo chef-client-enable; sudo chef-client' -C 3
-
Set label changeaborted /label ~change::aborted
Monitoring
Key metrics to observe
-
Metric: All SLI's (main stage)
- Location: https://dashboards.gitlab.net/d/git-main/git-overview?orgId=1
- What changes to this metric should prompt a rollback: Any violation of our SLI
-
Metric: All SLI's (canary stage)
- Location: https://dashboards.gitlab.net/d/git-main/git-overview?orgId=1&var-PROMETHEUS_DS=Global&var-environment=gprd&var-stage=cny
- What changes to this metric should prompt a rollback: Any violation of our SLI
-
Logs: Kibana Link
- The filter for the
stage
selection is quickly editable so we can more easily target a given stage during validation - We SHOULD see remote IP's of remote hosts, vs our internal load balancers if this change is successful
- The filter for the
Change Reviewer checklist
-
Check if the following applies: - The scheduled day and time of execution of the change is appropriate.
- The change plan is technically accurate.
- The change plan includes estimated timing values based on previous testing.
- The change plan includes a viable rollback plan.
- The specified metrics/monitoring dashboards provide sufficient visibility for the change.
-
Check if the following applies: - The complexity of the plan is appropriate for the corresponding risk of the change. (i.e. the plan contains clear details).
- The change plan includes success measures for all steps/milestones during the execution.
- The change adequately minimizes risk within the environment/service.
- The performance implications of executing the change are well-understood and documented.
- The specified metrics/monitoring dashboards provide sufficient visibility for the change.
- If not, is it possible (or necessary) to make changes to observability platforms for added visibility?
- The change has a primary and secondary SRE with knowledge of the details available during the change window.
Change Technician checklist
-
Check if all items below are complete: - The change plan is technically accurate.
- This Change Issue is linked to the appropriate Issue and/or Epic
- Change has been tested in staging and results noted in a comment on this issue.
- A dry-run has been conducted and results noted in a comment on this issue.
- For C1 and C2 change issues, the SRE on-call has been informed prior to change being rolled out. (In #production channel, mention
@sre-oncall
and this issue and await their acknowledgement.) - Release managers have been informed (If needed! Cases include DB change) prior to change being rolled out. (In #production channel, mention
@release-managers
and this issue and await their acknowledgment.) - There are currently no active incidents that are severity1 or severity2
- If the change involves doing maintenance on a database host, an appropriate silence targeting the host(s) should be added for the duration of the change.
Edited by John Skarbek