Update GPRD Gitaly and Praefect configs for release version 16
Production Change
Change Summary
Update gitaly
and praefect
configuration structure due to deprecation/removal in upcoming release 16.0.
Reference issues:
- https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/19359
- https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/23499
- #9091 (closed)
- https://docs.gitlab.com/ee/update/#gitaly-omnibus-gitlab-configuration-structure-change
Change Details
- Services Impacted - ServicePraefect and ServiceGitaly
- Change Technician - @steveazz
- Change Reviewer - @rehab
- Time tracking - 90 minutes
- Downtime Component - none
Detailed steps for the change
Change Steps - steps to take to execute the change
Estimated Time to Complete (mins) - 60 minutes
-
Set label changein-progress /label ~change::in-progress
-
Disable chef-client on gprd
servers
knife ssh -C 5 "roles:gprd-base-stor-gitaly* OR roles:gprd-base-stor-praefect*" "sudo chef-client-disable 'https://gitlab.com/gitlab-com/gl-infra/production/-/issues/9541'"
-
Validate chef client is disabled everywhere: https://thanos.gitlab.net/graph?g0.expr=chef_client_enabled%7Benv%3D%22gprd%22%2C%20type%3D~%22gitaly%7Cpraefect%22%7D%20%3D%3D%200&g0.tab=1&g0.stacked=0&g0.range_input=1h&g0.max_source_resolution=0s&g0.deduplicate=1&g0.partial_response=0&g0.store_matches=%5B%5D -
Update the structure of secrets in hashi vault for gitaly
ingprd
vault kv get -mount=chef -format json -field data env/gprd/shared/gitlab-omnibus-secrets > /tmp/omnibus-v2.json
cp /tmp/omnibus-v2.json /tmp/omnibus-v3.json
edit /tmp/omnibus-v3.json
diff /tmp/omnibus-v2.json /tmp/omnibus-v3.json
cat /tmp/omnibus-v3.json | vault kv put -mount=chef env/gprd/shared/gitlab-omnibus-secrets -
vault kv get -mount=chef -format json -field data env/gprd/shared/gitlab-omnibus-secrets > /tmp/omnibus-v3-remote.json
diff /tmp/omnibus-v2.json /tmp/omnibus-v3-remote.json
rm /tmp/omnibus-v2.json /tmp/omnibus-v3.json /tmp/omnibus-v3-remote.json
-
Update the structure of secrets in GKMS vault for praefect
bin/gkms-vault-pull praefect-omnibus-secrets gprd
mv /tmp/gkms-vault.{random suffix shown by previous command} /tmp/gkms-vault.{random suffix shown by previous command}.orig
bin/gkms-vault-edit praefect-omnibus-secrets gprd
bin/gkms-vault-pull praefect-omnibus-secrets gprd
diff /tmp/gkms-vault.{random suffix shown by previous command} /tmp/gkms-vault.{random suffix shown by previous command}.orig
rm /tmp/gkms-vault.{random suffix shown by previous command} /tmp/gkms-vault.{random suffix shown by previous command}.orig
-
Merge this MR: https://gitlab.com/gitlab-com/gl-infra/chef-repo/-/merge_requests/3325 -
Run chef-client file-cny-01-stor-gprd.c.gitlab-production.internal
and check if Gitaly updates successfully bydiff
, and checkingGitLab-ctl reconfigure
logs
ssh file-cny-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client-enable"
ssh file-cny-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client"
ssh file-cny-01-stor-gprd.c.gitlab-production.internal -- "sudo gitlab-ctl status gitaly"
ssh file-cny-01-stor-gprd.c.gitlab-production.internal -- "sudo find /var/log/gitlab/reconfigure -type f -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs cat"
ssh file-cny-01-stor-gprd.c.gitlab-production.internal -- "sudo find /opt/gitlab/embedded/cookbooks/cache/backup/var/opt/gitlab/gitaly/ -type f -name 'config.toml*' -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs -I{} sudo diff /var/opt/gitlab/gitaly/config.toml {}"
-
Run chef-client file-01-stor-gprd.c.gitlab-production.internal
and check if Gitaly updates successfully bydiff
, and checkingGitLab-ctl reconfigure
logs
ssh file-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client-enable"
ssh file-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client"
ssh file-01-stor-gprd.c.gitlab-production.internal -- "sudo gitlab-ctl status gitaly"
ssh file-01-stor-gprd.c.gitlab-production.internal -- "sudo find /var/log/gitlab/reconfigure -type f -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs cat"
ssh file-cny-01-stor-gprd.c.gitlab-production.internal -- "sudo find /opt/gitlab/embedded/cookbooks/cache/backup/var/opt/gitlab/gitaly/ -type f -name 'config.toml*' -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs -I{} sudo diff /var/opt/gitlab/gitaly/config.toml {}"
-
Run chef-client file-hdd-01-stor-gprd.c.gitlab-production.internal
and check if Gitaly updates successfully bydiff
, and checkingGitLab-ctl reconfigure
logs
ssh file-hdd-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client-enable"
ssh file-hdd-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client"
ssh file-hdd-01-stor-gprd.c.gitlab-production.internal -- "sudo gitlab-ctl status gitaly"
ssh file-hdd-01-stor-gprd.c.gitlab-production.internal -- "sudo find /var/log/gitlab/reconfigure -type f -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs cat"
ssh file-hdd-01-stor-gprd.c.gitlab-production.internal -- "sudo find /opt/gitlab/embedded/cookbooks/cache/backup/var/opt/gitlab/gitaly/ -type f -name 'config.toml*' -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs -I{} sudo diff /var/opt/gitlab/gitaly/config.toml {}"
-
Run chef-client file-praefect-01-stor-gprd.c.gitlab-production.internal
and check if Gitaly updates successfully bydiff
, and checkingGitLab-ctl reconfigure
logs
ssh file-praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client-enable"
ssh file-praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client"
ssh file-praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo gitlab-ctl status gitaly"
ssh file-praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo find /var/log/gitlab/reconfigure -type f -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs cat"
ssh file-praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo find /opt/gitlab/embedded/cookbooks/cache/backup/var/opt/gitlab/gitaly/ -type f -name 'config.toml*' -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs -I{} sudo diff /var/opt/gitlab/gitaly/config.toml {}"
-
Take praefect config backup and run chef-client on praefect-01-stor-gprd.c.gitlab-production.internal
and verify configurationdiff
ssh praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo gitlab-ctl praefect check"
ssh praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client-enable"
ssh praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo chef-client"
ssh praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo gitlab-ctl praefect check"
ssh praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo find /var/log/gitlab/reconfigure -type f -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs cat"
ssh praefect-01-stor-gprd.c.gitlab-production.internal -- "sudo find /opt/gitlab/embedded/cookbooks/cache/backup/var/opt/gitlab/praefect/ -type f -name 'config.toml*' -printf '%T@ %p\n' | sort -k1,1nr | head -1 | awk '{print \$2}' | xargs -I{} sudo diff /var/opt/gitlab/praefect/config.toml {}"
-
If all praefect and gitaly nodes are updated and running successfully then enable chef-client and let all the rest of servers converge automatically:
knife ssh -C 5 "roles:gprd-base-stor-gitaly* OR roles:gprd-base-stor-praefect*" "sudo chef-client-enable"
-
Set label changecomplete /label ~change::complete
Rollback
Rollback steps - steps to be taken in the event of a need to rollback this change
Estimated Time to Complete (mins) - 30 minutes
-
Revert this MR: https://gitlab.com/gitlab-com/gl-infra/chef-repo/-/merge_requests/3325 -
Update the structure of secrets in hashi vault for gitaly
ingprd
vault kv get -mount=chef -format json -field data env/gprd/shared/gitlab-omnibus-secrets > /tmp/omnibus-v2.json
cp /tmp/omnibus-v2.json /tmp/omnibus-v3.json
edit /tmp/omnibus-v3.json
diff /tmp/omnibus-v2.json /tmp/omnibus-v3.json
cat /tmp/omnibus-v3.json | vault kv put -mount=chef env/gprd/shared/gitlab-omnibus-secrets -
vault kv get -mount=chef -format json -field data env/gprd/shared/gitlab-omnibus-secrets > /tmp/omnibus-v3-remote.json
diff /tmp/omnibus-v2.json /tmp/omnibus-v3-remote.json
rm /tmp/omnibus-v2.json /tmp/omnibus-v3.json /tmp/omnibus-v3-remote.json
-
Update the structure of secrets in GKMS vault for praefect
bin/gkms-vault-pull praefect-omnibus-secrets gprd
mv /tmp/gkms-vault.{random suffix shown by previous command} /tmp/gkms-vault.{random suffix shown by previous command}.orig
bin/gkms-vault-edit praefect-omnibus-secrets gprd
bin/gkms-vault-pull praefect-omnibus-secrets gprd
diff /tmp/gkms-vault.{random suffix shown by previous command} /tmp/gkms-vault.{random suffix shown by previous command}.orig
rm /tmp/gkms-vault.{random suffix shown by previous command} /tmp/gkms-vault.{random suffix shown by previous command}.orig
-
Enable chef-client and let all the servers converge automatically
knife ssh -C 5 "roles:gsprd-base-stor-gitaly* OR roles:gprd-base-stor-praefect*" "sudo chef-client-enable"
-
Check if there are any chef-client errors in gprd
: https://thanos.gitlab.net/graph?g0.expr=chef_client_error%7Benv%3D%22gprd%22%7D%20%3D%3D%201&g0.tab=1&g0.stacked=0&g0.range_input=1h&g0.max_source_resolution=0s&g0.deduplicate=1&g0.partial_response=0&g0.store_matches=%5B%5D (runners-manager-saas-macos-staging-green-2
is expected) -
Set label changeaborted /label ~change::aborted
Monitoring
Key metrics to observe
There are no target metrics to monitor. The Gitaly and Praefect services will fail to start and/or executions of gitlab-ctl reconfigure
will fail during this procedure if something is improperly configured.
Change Reviewer checklist
-
Check if the following applies: - The scheduled day and time of execution of the change is appropriate.
- The change plan is technically accurate.
- The change plan includes estimated timing values based on previous testing.
- The change plan includes a viable rollback plan.
- The specified metrics/monitoring dashboards provide sufficient visibility for the change.
-
Check if the following applies: - The complexity of the plan is appropriate for the corresponding risk of the change. (i.e. the plan contains clear details).
- The change plan includes success measures for all steps/milestones during the execution.
- The change adequately minimizes risk within the environment/service.
- The performance implications of executing the change are well-understood and documented.
- The specified metrics/monitoring dashboards provide sufficient visibility for the change.
- If not, is it possible (or necessary) to make changes to observability platforms for added visibility?
- The change has a primary and secondary SRE with knowledge of the details available during the change window.
- The labels blocks deployments and/or blocks feature-flags are applied as necessary
Change Technician checklist
-
Check if all items below are complete: - The change plan is technically accurate.
- This Change Issue is linked to the appropriate Issue and/or Epic
- Change has been tested in staging and results noted in a comment on this issue.
- A dry-run has been conducted and results noted in a comment on this issue.
- The change execution window respects the Production Change Lock periods.
- For C1 and C2 change issues, the change event is added to the GitLab Production calendar.
- For C1 and C2 change issues, the SRE on-call has been informed prior to change being rolled out. (In #production channel, mention
@sre-oncall
and this issue and await their acknowledgement.) - For C1 and C2 change issues, the SRE on-call provided approval with the eoc_approved label on the issue.
- For C1 and C2 change issues, the Infrastructure Manager provided approval with the manager_approved label on the issue.
- Release managers have been informed (If needed! Cases include DB change) prior to change being rolled out. (In #production channel, mention
@release-managers
and this issue and await their acknowledgment.) - There are currently no active incidents that are severity1 or severity2
- If the change involves doing maintenance on a database host, an appropriate silence targeting the host(s) should be added for the duration of the change.
Edited by Steve Xuereb