## Summary Roll out [the feature](https://gitlab.com/gitlab-com/gl-infra/production-engineering/-/work_items/29032) currently behind the `rate_limiting_rule_bypass_header` feature flag. This change makes bypass-traffic volume visible for the first time by routing requests with the trusted infra bypass header through labkit's rate-limiter (where they hit a `:skip` rule that never blocks them, but increments a Prometheus counter). The flag exists so the team can enable it deliberately during working hours and observe the metric appear in real time, rather than behavior changing silently on deploy. - DRI: @hardikgala - Team Slack channel: `#g_tenant-controls` > [!note] > > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What could go wrong? - Bypass-header requests now flow through labkit's key-registration and settings-lookup checks instead of short-circuiting before them. If those checks raise exceptions, bypass traffic will no longer be immune. This tradeoff was reviewed with the rate-limiting maintainer and accepted, since those checks validate the rate limiter's own configuration: a property shared by all requests to the endpoint, not unique to bypass traffic. - No expected Redis or performance impact: `:skip` rules never write to Redis by design. ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#proj-ai-to-prod-rate-limits`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set rate_limiting_rule_bypass_header 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set rate_limiting_rule_bypass_header true --dev --pre --staging --staging-ref ``` **Production** (percentage rollout, wait ≥15 min between steps, watch dashboards): ``` /chatops gitlab run feature set rate_limiting_rule_bypass_header <percentage> --actors ``` Or target specific actors instead: ``` /chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss rate_limiting_rule_bypass_header true /chatops gitlab run feature set --group=gitlab-org,gitlab-com rate_limiting_rule_bypass_header true /chatops gitlab run feature set --user=hardikgala rate_limiting_rule_bypass_header true ``` ## Before global rollout Confirm the relevant gotchas before going to 100%, see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle), see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/issues/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete rate_limiting_rule_bypass_header --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set rate_limiting_rule_bypass_header false # production /chatops gitlab run feature set rate_limiting_rule_bypass_header false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete rate_limiting_rule_bypass_header --dev --pre --staging --staging-ref --production # remove entirely ```