[Feature flag] Enable description of header_read_timeout_buffered_io
Summary
This issue is to roll out #336999 (closed) on production,
that is currently behind the header_read_timeout_buffered_io
feature flag.
Owners
- Team: ~"group::integrations"
- Most appropriate slack channel to reach out to:
#g_ecosystem_integrations
- Best individual to reach out to:
@Andysoiron
- PM:
@g.hickman
Expectations
What are we expecting to happen?
The vulnerability described in #336999 (closed) should be fixed with no other sideeffects.
What might happen if this goes wrong?
HTTP request might fail with Gitlab::HTTP::HeaderReadTimeout
or unexpected errors.
What can we monitor to detect problems with this?
What can we check for monitoring production after rollouts?
Rollout Steps
Rollout on non-production environments
- Ensure that the feature MRs have been deployed to non-production environments.
-
/chatops run auto_deploy status <merge-commit-of-your-feature>
-
-
Enable the feature globally on non-production environments. -
/chatops run feature set header_read_timeout_buffered_io true --dev
-
/chatops run feature set header_read_timeout_buffered_io true --staging
-
-
Verify that the feature works as expected. Posting the QA result in this issue is preferable.
Preparation before global rollout
-
Ensure that you or a representative in development can be available for at least 2 hours after feature flag updates in production. If a different developer will be covering, or an exception is needed, please inform the oncall SRE by using the @sre-oncall
Slack alias. -
Announce on the feature issue an estimated time this will be enabled on GitLab.com. -
Notify #support_gitlab-com
and your team channel (more guidance when this is necessary in the dev docs).
Global rollout on production
For visibility, all /chatops
commands that target production should be executed in the #production
slack channel and cross-posted (with the command results) to the responsible team's slack channel (#g_TEAM_NAME
).
-
Incrementally roll out the feature. -
/chatops run feature set header_read_timeout_buffered_io 10
-
/chatops run feature set header_read_timeout_buffered_io 20
-
/chatops run feature set header_read_timeout_buffered_io 50
-
/chatops run feature set header_read_timeout_buffered_io true
-
-
Announce on the feature issue that the feature has been globally enabled. -
Wait for at least one day for the verification term.
Release the feature with the feature flag
If you're still unsure whether the feature is deemed stable but want to release it in the current milestone, you can change the default state of the feature flag to be enabled. To do so, follow these steps:
-
Create a merge request with the following changes. Ask for review and merge it. -
Set the default_enabled
attribute in the feature flag definition totrue
. -
Create a changelog entry.
-
-
Ensure that the default-enabling MR has been deployed to both production and canary. If the merge request was deployed before the code cutoff, the feature can be officially announced in a release blog post. -
/chatops run auto_deploy status <merge-commit-of-default-enabling-mr>
-
-
Close the feature issue to indicate the feature will be released in the current milestone. -
Set the next milestone to this rollout issue for scheduling the flag removal. -
(Optional) You can create a separate issue for scheduling the steps below to Release the feature. -
Set the title to "[Feature flag] Cleanup header_read_timeout_buffered_io
". -
Execute the /copy_metadata <this-rollout-issue-link>
quick action to copy the labels from this rollout issue. -
Link this rollout issue as a related issue. -
Close this rollout issue.
-
WARNING: This approach has the downside that it makes it difficult for us to clean up the flag. For example, on-premise users could disable the feature on their GitLab instance. But when you remove the flag at some point, they suddenly see the feature as enabled and they can't roll it back to the previous behavior. To avoid this potential breaking change, use this approach only for urgent matters.
Rollback Steps
-
This feature can be disabled by running the following Chatops command:
/chatops run feature set header_read_timeout_buffered_io false