Reintroduce vulnerability_read_es_dual_write feature flag

Bala Kumarrequested to merge
592362-reintroduce-vulnerability-read-es-dual-write-flag into master

Summary

Reintroduces the vulnerability_read_es_dual_write feature flag to gate dual write of Vulnerabilities::Read records to the vulnerability_reads Elasticsearch index, as part of Dual writes to both vulnerability ES indices.

The flag previously existed, was rolled out to 100%, and was removed in af6a008b0171. This MR effectively reverts that commit and adds a fresh flag definition so dual write can be rolled out again under a new rollout issue.

Approach

Vulnerabilities::Read#dual_write_to_es? (in ee/app/models/vulnerabilities/read.rb) now checks Feature.enabled?(:vulnerability_read_es_dual_write, project) in addition to the existing create_vulnerability_reads_index migration check. #elastic_reference calls dual_write_to_es? to decide whether to return one reference (legacy vulnerabilities index only) or two (legacy vulnerabilities index plus the newer vulnerability_reads index).

Comments in ee/app/services/elastic/process_bookkeeping_service.rb and ee/app/services/vulnerabilities/removal/remove_from_project_service.rb are updated to refer to the flag again; neither file has a logic change.

Deletes from the vulnerability_reads index in ee/app/workers/search/elastic/delete_worker.rb remain gated only by the create_vulnerability_reads_index migration, not by this flag. That is unchanged by this MR.

Feature flag gating

Method Checks Behavior when flag is disabled
Vulnerabilities::Read#dual_write_to_es? Feature.enabled?(:vulnerability_read_es_dual_write, project) and create_vulnerability_reads_index migration finished elastic_reference returns only the legacy vulnerabilities index reference; no write to vulnerability_reads index

Feature flag

Flag Type Scope Default Purpose
vulnerability_read_es_dual_write gitlab_com_derisk project actor off Gates dual write of Vulnerabilities::Read to the vulnerability_reads Elasticsearch index alongside the legacy vulnerabilities index

Enable and disable with chatops:

/chatops gitlab run feature set vulnerability_read_es_dual_write true
/chatops gitlab run feature set vulnerability_read_es_dual_write false

Because the flag defaults to off, dual write to vulnerability_reads stops on GitLab.com and self-managed as soon as this merges, until the flag is enabled again through the rollout issue. Vulnerability search and the vulnerability report read from the legacy vulnerabilities index, so there is no user-facing change while the flag is off. The vulnerability_reads index will drift from the vulnerability_reads Postgres table while the flag is off, so re-enabling it may need a backfill or reindex to close the gap.

Local testing

Setup and verification
  1. In the Rails console, get a Vulnerabilities::Read record, for example Vulnerabilities::Read.first.
  2. Enable or disable the flag and check elastic_reference:
Feature.enable(:vulnerability_read_es_dual_write)
Vulnerabilities::Read.first.elastic_reference # => returns two references (vulnerabilities + vulnerability_reads)

Feature.disable(:vulnerability_read_es_dual_write)
Vulnerabilities::Read.first.elastic_reference # => returns one reference (vulnerabilities only)

Value matrix

vulnerability_read_es_dual_write enabled create_vulnerability_reads_index migration finished Expected elastic_reference result
yes yes two references (legacy vulnerabilities + vulnerability_reads)
no yes one reference (legacy vulnerabilities only)
yes no one reference (legacy vulnerabilities only)

References

Merge request reports