Remove Secrets Manager billing event feature flags

Erick Bajaorequested to merge
eb-remove-secrets-manager-flags-step-4 into master

What does this MR do and why?

Related: MR 4 of 6 removing Secrets Manager feature flags for GA. Targets master. Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/600967, !238134 (merged), and !238145 (merged).

All MRs in this series
  1. secrets_manager, group_secrets_manager: !259222 (merged) (merged)
  2. Enrollment flags (secrets_manager_namespace_enrollment, secrets_manager_instance_enrollment): !260090 (merged) (merged)
  3. secrets_manager_async_audit_logs: !260091 (merged) (merged)
  4. Billing event flags (secrets_manager_emit_secret_read_events, secrets_manager_emit_secret_stored_events): !260092 (merged) (this MR)
  5. secrets_manager_denial_telemetry: !260094 (merged)
  6. secrets_manager_paid_experience: !260110 (merged)

secrets_manager_api_access stays in beta and default disabled for GA, so it is not part of this series.

Problem

  • secrets_manager_emit_secret_read_events and secrets_manager_emit_secret_stored_events are both off by default, so self-managed instances still skip billing event emission that Secrets Manager needs for GA.
  • Both flags still wrap code that is otherwise ready, so keeping them is just dead weight in the emitters and the cron worker.

Solution

  • SecretsReadEmitter and SecretsStoredEmitter no longer check either flag.
  • EmitSecretsStoredBillableEventCronWorker always enqueues per root namespace now. It still skips on a read-only database.
  • All other guards stay as they are: billable event types, request-type lines, the enrollment opt-out, and zero quantity. The offline-license skip in Gitlab::BillingEvents::Client is also unchanged.
  • Specs: remove the flag stubs and the two "feature flag is disabled" contexts, for both emitters and the cron worker. Also remove the now-unneeded flag stub in the internal API spec left over from the previous MR in this series.

How the events reach billing now:

  • Online license (GitLab.com and GitLab Self-Managed): the events are sent over the network to the billing service. billing_event_tracking no longer gates this, because !260610 (merged) removed it.
  • Offline or legacy license (GitLab Self-Managed): nothing is sent over the network. The events are recorded locally instead, because local_billing_persistence is on by default.

Impact

  • GitLab.com: no change. Both flags have been on in production since 2026-08-21.
  • GitLab Self-Managed with an online license: starts sending secrets_read and secrets_stored events to the billing service.
  • GitLab Self-Managed with an offline or legacy license: starts recording these events locally. Nothing is sent over the network.
  • Together with !260610 (merged), Self-Managed Secrets Manager billing starts in a single release, 19.5.
  • No database changes.
  • Changelog: commit subject "Always emit Secrets Manager billable usage events", with Changelog: changed and EE: true.

Before merge

  • Confirm with chatops that secrets_manager_emit_secret_read_events and secrets_manager_emit_secret_stored_events are fully enabled in production. Both have been on since 2026-08-21.

After merge

  • Delete the flags from all environments: /chatops gitlab run feature delete secrets_manager_emit_secret_read_events secrets_manager_emit_secret_stored_events --dev --pre --staging --staging-ref --production

References

Screenshots or screen recordings

Not applicable. No UI change.

How to set up and validate locally

  1. Run the changed specs:

    bundle exec rspec ee/spec/lib/secrets_management/billable_events ee/spec/workers/secrets_management/emit_secrets_stored_billable_event_cron_worker_spec.rb ee/spec/requests/api/internal/secrets_manager_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Erick Bajao

Merge request reports