Add tier-aware throttle flags and decouple the rate limiter gate

Ashwin Srequested to merge
29662-tier-aware-throttle-feature-flags into master

What does this MR do and why?

Feature flags

  • Adds 8 EE-only gitlab_com_derisk flags, all default_enabled: false: six per-plan observe/enforce pairs, plus a plan-independent pair for the unauthenticated per-IP limit.
  • Part of tier-aware throttles — GitLab.com request limits that vary by Free/Premium/Ultimate plan: https://gitlab.com/groups/gitlab-com/gl-infra/-/work_items/2122
  • Command used to generate the yml file:
    • bin/feature-flag --force -e -t gitlab_com_derisk -g "group::Networking & Incident Management" -M 19.4 -u ashs2 -a "https://gitlab.com/groups/gitlab-com/gl-infra/-/work_items/2122" -i "<rollout_issue_url>" -m "https://gitlab.com/gitlab-org/gitlab/-/merge_requests/253269" -d "<description>" <flag_name>
  • Closes https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/work_items/29662

Middleware gate

  • LabkitRackRateLimit#run returned early unless a Rack::Attack migration cohort flag was on, which tied this rollout to flags a later cleanup deletes.
  • The gate is now an OR, so either family keeps the middleware running and neither rollout can switch the other off.
  • Cohort flags still gate enforcement, so nothing here can newly return a 429.
  • New PlanRules: a CE stub plus an EE override holding the flag list and the "any tier-aware limit on" check. SaaS-gated, so it is inert on self-managed.
  • The spec suite defaults the new flags off, so unrelated specs don't start running the middleware.
  • Closes https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/work_items/29664

A flaky test fix

  • A small test-isolation fix in limiters_spec.rb — a separate concern that was failing intermittently.

Note

  • No user-facing change: flags are off by default and no throttle rules are added yet; those land in later issues.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/work_items/29662 https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/work_items/29664

Edited by Ashwin S

Merge request reports