Duo Core enables automatically by default if license activated
Summary
Activating a license in GitLab versions >= 18.2.x seems to enable Duo Core by default. This occurs even if the customer has upgraded from v17.11.x originally.
Our documentation suggests that Duo Core is enabled automatically by default for "new customer in GitLab 18.0 or later". However, if they upgrade from 17.11.x, they need to enable explicitly: https://docs.gitlab.com/user/gitlab_duo/turn_on_off/#turn-gitlab-duo-core-on-or-off
GitLab Duo Core is included with Premium and Ultimate subscriptions.
- If you are an existing customer from GitLab 17.11 or earlier, you must turn on features for GitLab Duo Core.
- If you are a new customer in GitLab 18.0 or later, GitLab Core is automatically turned on and no further action is needed.
If you were an existing customer with a Premium or Ultimate subscription before May 15, 2025, when you upgrade to GitLab 18.0 or later, to use GitLab Duo Core, you must turn it on.
Although our testing has been done with subscriptions with start dates newer than May 15th 2025, the documentation is not clear what happens in that circumstance.
Why it's a problem
Organizations with strict data governance requirements need explicit control over which third-party services process their data. Automatically enabling Duo Core may not align with some customers' compliance review processes and data residency policies. Providing an opt-in approach allows customers to evaluate the feature against their specific regulatory and security requirements before adoption.
Workaround
If you don't want Duo enabled, change Duo setting to "Always Off".
Steps to reproduce
- Install GitLab self-managed 17.11.7
- Activate subscription
- Upgrade GitLab to v18.0.6
- Upgrade GitLab to v18.2.8
- Check Admin > Duo Settings
- Re-Activate subscription in Admin > Subscriptions
- Check Admin > Duo Settings
Example Project
What is the current bug behavior?
Step 7: Duo is enabled by default following subscription activation, despite upgrading from v17.11 and not explicitly enabling Duo
What is the expected correct behavior?
Step 7: Keep Duo disabled until the user enables
Relevant logs and/or screenshots
Screenshot 1: v17.11.7 -> 18.0.8 -> v18.2.8 without enabling Duo or re-activating license subscription
Screenshot 2: v17.11.7 -> 18.0.8 -> v18.2.8
without enabling Duo, but re-activated license subscription
Output of checks
Results of GitLab environment info
Expand for output related to GitLab environment info
(For installations with omnibus-gitlab package run and paste the output of: \`sudo gitlab-rake gitlab:env:info\`) (For installations from source run and paste the output of: \`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production\`)
Results of GitLab application Check
Expand for output related to the GitLab application check
(For installations with omnibus-gitlab package run and paste the output of: `sudo gitlab-rake gitlab:check SANITIZE=true`) (For installations from source run and paste the output of: `sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true`) (we will only investigate if the tests are passing)
Possible fixes
Patch release information for backports
If the bug fix needs to be backported in a patch release to a version under the maintenance policy, please follow the steps on the patch release runbook for GitLab engineers.
Refer to the internal "Release Information" dashboard for information about the next patch release, including the targeted versions, expected release date, and current status.
High-severity bug remediation
To remediate high-severity issues requiring an internal release for single-tenant SaaS instances, refer to the internal release process for engineers.