<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Label this issue](https://contributors.gitlab.com/manage-issue?action=label&projectId=278964&issueIid=605070) </details> <!--IssueSummary end--> <!-- Title suggestion: [FF] `skip_authorized_projects_refresh_for_new_group` -- <short description> --> ## Summary Roll out [the feature](<feature-issue-link>) currently behind the `skip_authorized_projects_refresh_for_new_group` feature flag. - DRI: @eugielimpin - Team Slack channel: `#g_sscs_authorization` ### Strategy - [ ] Rollout to top users triggering `AuthorizedProjectsWorker` runs after group creation that exceed the worker's target duration (10s): <details> <summary></summary> `developer1256/36397453` </details> ``` # Data view: pubsub-sidekiq-inf-gprd # breakdown by json.args.keyword json.class:"AuthorizedProjectsWorker" AND (json.meta.root_caller_id:"GroupsController#create" OR json.meta.root_caller_id:"GitlabGroupsController#create" OR json.meta.root_caller_id.keyword:"POST /api/:version/groups" OR json.meta.root_caller_id.keyword:"POST /api/:version/groups/import" OR json.meta.root_caller_id:"GroupImportWorker" OR json.meta.root_caller_id:"BulkImports::PipelineWorker") AND json.duration_s>10 ``` Alternative query: no-op `AuthorizedProjectsWorker` runs after group creation ``` # Data view: pubsub-sidekiq-inf-gprd json.event: "authorized_projects_refresh" AND (json.authorized_projects_refresh.rows_added_count<1 AND json.authorized_projects_refresh.rows_deleted_count<1) AND (json.meta.root_caller_id:"GroupsController#create" OR json.meta.root_caller_id:"GitlabGroupsController#create" OR json.meta.root_caller_id.keyword:"POST /api/:version/groups" OR json.meta.root_caller_id.keyword:"POST /api/:version/groups/import" OR json.meta.root_caller_id:"GroupImportWorker" OR json.meta.root_caller_id:"BulkImports::PipelineWorker") ``` - [ ] Rollout to 25% of users - [ ] Rollout to 50% of users - [ ] Rollout to 75% of users - [ ] Rollout globally > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What we expect to happen? Decreased `AuthorizedProjectsWorker` runs triggered by group creation exceeding 10s target execution duration: ``` # Data view: pubsub-sidekiq-inf-gprd json.class:"AuthorizedProjectsWorker" AND (json.meta.root_caller_id:"GroupsController#create" OR json.meta.root_caller_id:"GitlabGroupsController#create" OR json.meta.root_caller_id.keyword:"POST /api/:version/groups" OR json.meta.root_caller_id.keyword:"POST /api/:version/groups/import" OR json.meta.root_caller_id:"GroupImportWorker" OR json.meta.root_caller_id:"BulkImports::PipelineWorker") AND json.duration_s>10 ``` ## What could go wrong? <!-- Optional but recommended: blast radius, data-loss risk, and the dashboard(s) you'll watch on https://dashboards.gitlab.net. Delete if not applicable. --> ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_sscs_authorization`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set skip_authorized_projects_refresh_for_new_group 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set skip_authorized_projects_refresh_for_new_group true --dev --pre --staging --staging-ref ``` **Production** — percentage rollout (wait ≥15 min between steps, watch dashboards): ``` /chatops gitlab run feature set skip_authorized_projects_refresh_for_new_group <percentage> --actors ``` Or target specific actors instead: ``` /chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss skip_authorized_projects_refresh_for_new_group true /chatops gitlab run feature set --group=gitlab-org,gitlab-com skip_authorized_projects_refresh_for_new_group true /chatops gitlab run feature set --user=eugielimpin skip_authorized_projects_refresh_for_new_group true ``` ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/issues/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete skip_authorized_projects_refresh_for_new_group --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set skip_authorized_projects_refresh_for_new_group false # production /chatops gitlab run feature set skip_authorized_projects_refresh_for_new_group false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete skip_authorized_projects_refresh_for_new_group --dev --pre --staging --staging-ref --production # remove entirely ``` <!-- Uncomment the appropriate type label /label ~"type::feature" ~"feature::addition" /label ~"type::maintenance" /label ~"type::bug" -->