<:robot:> ## Summary Roll out [DAP suspendable workloads](https://gitlab.com/gitlab-org/gitlab/-/work_items/612876) currently behind the `suspendable_environment_for_dap` feature flag. Introduced in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/252787 for milestone 19.5, `type: wip`, `default_enabled: false`. - DRI: @AndrasHerczeg > [!note] > Process and guidance live in the docs, this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability, which is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) The rollout plan, blast radius and executor constraints are in https://gitlab.com/gitlab-org/gitlab/-/work_items/613318. This issue tracks the enablement steps and the prerequisites raised in review of https://gitlab.com/gitlab-org/gitlab/-/merge_requests/252787. ## Prerequisites from review ### Before the flag is enabled anywhere - [ ] **Settle the audience and auth model of `GET /api/v4/jobs/:id/runtime_environment_key`.** @fabiopitino's thread on https://gitlab.com/gitlab-org/gitlab/-/merge_requests/252787 is unresolved and he scoped it explicitly: "as long as the FF is disabled, I'm not blocking this MR". Enabling the flag is what reopens it. Facts established during review: nothing in `gitlab-org/gitlab` or `gitlab-runner` reads the route, and a job can never read back its own key because `authenticate_job!` requires `EXECUTING_STATUSES` while the key is written at job completion. @ashvins expects a future Environment service, and later Autoflow, to read it with user credentials, which a job-token-only route cannot serve. Owners: @fabiopitino, @ashvins, @vtak. ### Before widening past the first internal projects - [ ] **Exercise the `commit-msg` hook across a real suspend and resume.** The hook installer was not idempotent: on the first resume it moved its own wrapper to `commit-msg.orig`, so every `git commit` in the resumed environment recursed into itself, and any framework hook the first run had preserved was discarded. Fixed in `37758bd6` with a marker guard plus a filesystem regression test, but never run against a live runner, and the defect only appears on resume. On an enabled project, confirm a commit after a resume succeeds, carries the `Duo-Session` trailer exactly once, and still chains a `commit-msg` hook installed by a framework such as lefthook. ### Before global rollout and flag removal - [ ] **Restore the coverage gate.** `pipeline:skip-undercoverage` was applied to https://gitlab.com/gitlab-org/gitlab/-/merge_requests/252787 because `rspec:undercoverage` reports `ci_runtime_environment_key` in `ee/app/services/ai/duo_workflows/start_workflow_service.rb` at 0%. It is a two line default returning `nil`, overridden and covered in `ResumeWorkflowService`. Cover it or make the node coverable, so later MRs do not need the label. - [ ] **Deprecate the orphaned `update_job` permission.** `config/authz/permissions/job/update.yml` and its `assignable_permissions` entry are referenced by no route after the endpoint moved to `lib/api/ci/runner.rb`. It shipped in 19.4, so removal may be breaking and belongs to group::runner core. - [ ] Constraints in https://gitlab.com/gitlab-org/gitlab/-/work_items/613318 confirmed: Kubernetes executor only, Kata Containers unsupported, `privileged: true` on build and helper containers, PVC TTL fixed at 7 days, and resumed jobs routed back to the runner that suspended them. - [ ] The PVC-missing to clone-from-scratch fallback test from https://gitlab.com/gitlab-org/gitlab/-/work_items/613318 exists and passes. ## What could go wrong? A resumed job reuses a filesystem the previous run left behind, so failures show up as state that is subtly wrong rather than as an error: a stale hook, a missing git remote, or a clone that silently did not restore. Two of the three PoC failures were of that shape. Watch for orphaned PVCs and for resume attempts that fall back to a full clone. ## Events - [Exceptions with suspendable_environment_for_dap:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22suspendable_environment_for_dap:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with suspendable_environment_for_dap:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22suspendable_environment_for_dap:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature Flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to the team channel. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set suspendable_environment_for_dap 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set suspendable_environment_for_dap true --dev --pre --staging --staging-ref ``` **Production**, starting with named projects on the Kubernetes-executor fleet rather than a percentage, per https://gitlab.com/gitlab-org/gitlab/-/work_items/613318: ``` /chatops gitlab run feature set --project=<project-path> suspendable_environment_for_dap true ``` Then percentage rollout (wait at least 15 min between steps, watch dashboards): ``` /chatops gitlab run feature set suspendable_environment_for_dap <percentage> --actors ``` ## Before global rollout Confirm the relevant gotchas before going to 100%, see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [ ] [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [ ] [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [ ] [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [ ] [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle), see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete suspendable_environment_for_dap --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set suspendable_environment_for_dap false # production /chatops gitlab run feature set suspendable_environment_for_dap false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete suspendable_environment_for_dap --dev --pre --staging --staging-ref --production # remove entirely ``` </:robot:>