Remove secrets_manager_denial_telemetry flag

Erick Bajaorequested to merge
eb-remove-secrets-manager-flags-step-6 into master

What does this MR do and why?

Related: MR 5 of 6 removing Secrets Manager feature flags for GA. Targets master. Related to https://gitlab.com/gitlab-org/gitlab/-/work_items/602364 and !245606 (merged).

All MRs in this series
  1. secrets_manager, group_secrets_manager: !259222 (merged) (merged)
  2. Enrollment flags (secrets_manager_namespace_enrollment, secrets_manager_instance_enrollment): !260090 (merged) (merged)
  3. secrets_manager_async_audit_logs: !260091 (merged) (merged)
  4. Billing event flags (secrets_manager_emit_secret_read_events, secrets_manager_emit_secret_stored_events): !260092 (merged) (merged)
  5. secrets_manager_denial_telemetry: !260094 (merged) (this MR)
  6. secrets_manager_paid_experience: !260110 (merged)

secrets_manager_api_access stays in beta and default disabled for GA, so it is not part of this series.

Problem

  • secrets_manager_denial_telemetry is off by default, so self-managed instances still miss telemetry for denied Secrets Manager write actions.
  • The feature issue for this flag is closed, so the flag check is just leftover gating on finished code.

Solution

  • SecretsManagement::Entitlement::DenialTelemetry.track no longer checks the flag. When an entitlement denies a write action, it always emits the secrets_manager_access_denied internal event and the structured log line. This is still deduplicated per request, and still only happens when there is a denial reason.
  • This covers all four surfaces: graphql_mutation, ci_runner_payload, service_gate, and job_scheduling.
  • Specs: remove the "flag is disabled" context.

Impact

  • Self-managed instances, where the flag was off by default, now send this event through Service Ping and Snowplow, the same as other internal events.
  • Event volume is bounded by the number of denied access attempts, so this does not add unbounded telemetry.
  • No database changes.
  • Changelog: commit trailer Changelog: other and EE: true.

Before merge

  • Confirm with chatops that secrets_manager_denial_telemetry is fully enabled in production.

After merge

  • Delete the flag from all environments: /chatops gitlab run feature delete secrets_manager_denial_telemetry --dev --pre --staging --staging-ref --production

References

Screenshots or screen recordings

Not applicable. No UI change.

How to set up and validate locally

  1. Run the changed spec:

    bundle exec rspec ee/spec/lib/secrets_management/entitlement/denial_telemetry_spec.rb

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Erick Bajao

Merge request reports