## Summary Roll out [the feature](https://gitlab.com/gitlab-org/gitlab/-/work_items/627538) currently behind the `dependency_firewall_clickhouse_reads` feature flag. This flag routes the Dependency Firewall dashboard's prevented-stats reads from PostgreSQL to the ClickHouse Siphon replica of `dependency_firewall_prevented_packages`. ClickHouse is only used when all of the following hold: analytics ClickHouse is enabled, `Gitlab::ClickHouse.siphon_enabled?('dependency_firewall_prevented_packages')` is true, and this flag is on. The flag is checked for the container's root namespace (a group), so group actors are the rollout unit. Type `beta`, default off. Group-level PostgreSQL reads measured about 2.6 seconds per dashboard load at `gitlab-org` scale on a seeded Database Lab clone. The ClickHouse path reads only the group's slice of the replica, avoiding that cost. This flag was introduced by https://gitlab.com/gitlab-org/gitlab/-/merge_requests/253946. - DRI: @arpitgogia - Team Slack channel: `#g_sscs-dependency-firewall` > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## Prerequisites Nothing in production before all of the following hold: 1. The dashboard read path is live: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/253947 (GraphQL) merged, and `dependency_firewall_dashboard_v2` enabled for the namespaces being rolled out to. 2. The write path is live, so the ledger has rows: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/257625, https://gitlab.com/gitlab-org/gitlab/-/merge_requests/257627 and https://gitlab.com/gitlab-org/gitlab/-/merge_requests/253944 merged. 3. Siphon replicates the table on GitLab.com: `Gitlab::ClickHouse.siphon_enabled?('dependency_firewall_prevented_packages')` returns true in a production Rails console, and `#f_siphon` has confirmed the initial snapshot is complete. Until the snapshot is complete, counts can be partial. 4. Parity check for a target group before enabling it, in a production Rails console: ```ruby group = Group.find_by_full_path('gitlab-org') from = 7.days.ago stats = Security::DependencyFirewall::PreventedStats stats::ClickHouseCollector.new(container: group, from: from).counts == stats::PostgresqlCollector.new(container: group, from: from).counts ``` Expect `true`. Small differences can come from replication lag; large ones mean stop. ## What could go wrong? - Wrong or partial numbers on the prevented-stats cards if the replica is incomplete or lagging. Enforcement is not affected: the flag only changes where dashboard counts are read from. - ClickHouse errors surface as a failed dashboard query for that namespace instead of falling back to PostgreSQL. `siphon_enabled?` itself returns false on ClickHouse errors. - Blast radius: only namespaces with both this flag and `dependency_firewall_dashboard_v2` enabled. - Watch: ClickHouse query latency and errors for `siphon_dependency_firewall_prevented_packages`, and the Events links below. ## Events - [Exceptions with dependency_firewall_clickhouse_reads:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22dependency_firewall_clickhouse_reads:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with dependency_firewall_clickhouse_reads:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22dependency_firewall_clickhouse_reads:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature Flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_sscs-dependency-firewall`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set dependency_firewall_clickhouse_reads 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set dependency_firewall_clickhouse_reads true --dev --pre --staging --staging-ref ``` **Production** First enable for `gitlab-org`, then roll out by percentage of actors. Wait at least 15 minutes between steps and watch dashboards. ``` /chatops gitlab run feature set --group=gitlab-org dependency_firewall_clickhouse_reads true /chatops gitlab run feature set dependency_firewall_clickhouse_reads <percentage> --actors ``` ## Before global rollout Confirm the relevant gotchas before going to 100%, see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle), see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete dependency_firewall_clickhouse_reads --dev --pre --staging --staging-ref --production ``` Removing the flag lets self-managed and Dedicated instances with ClickHouse analytics and Siphon replicating the table use the ClickHouse path automatically, so the flag should not outlive the GitLab.com rollout. ## Rollback ``` /chatops gitlab run feature set dependency_firewall_clickhouse_reads false # production /chatops gitlab run feature set dependency_firewall_clickhouse_reads false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete dependency_firewall_clickhouse_reads --dev --pre --staging --staging-ref --production # remove entirely ```