## Summary Roll out [Support data isolation on sec databases](https://gitlab.com/gitlab-org/gitlab/-/work_items/627115) currently behind the `sync_sec_mirror_tables` feature flag. - DRI: @rutgerwessels - Team Slack channel: `#g_organizations` > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What could go wrong? Extra writes to the sec database from workers `Namespaces::ProcessSyncEventsWorker` and `Projects::ProcessSyncEventsWorker` — one upsert per event per table. If writing a sec row fails, it logs to Gitlab::ErrorTracking with fields `sync_class` and `sync_event_id`, and does not stop the ci sync — the event stays and retries next run. If more than 1000 events keep failing, they fill a batch and newer events wait behind them, delaying the ci mirrors. No data loss: mirrors can be rebuilt. Backfill and consistency check are follow-up work. Events consumed while off leave gaps in the sec mirrors until backfill runs. Watch in Kibana (Sidekiq logs) and Sentry for exceptions where `json.extra.sync_class` is `Security::NamespaceMirror` or `Security::ProjectMirror`. Watch worker logs for `json.extra.failed_events` (non-zero means the same events fail every run) and `json.extra.estimated_total_events` (growing means backlog is forming). ## Events - [Exceptions with sync_sec_mirror_tables:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22sync_sec_mirror_tables:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with sync_sec_mirror_tables:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22sync_sec_mirror_tables:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature Flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_organizations`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). This is an `ops` type flag with the `:instance` actor — it can only be fully on or fully off. No percentages or per-project/group actors apply. **Non-production** ``` /chatops gitlab run feature set sync_sec_mirror_tables true --dev --pre --staging --staging-ref ``` **Production** Enable instance-wide for about one hour while watching the logs, then disable. Repeat over a few days. Always disable at the end of the DRI's working day — do not leave it running unattended overnight. Only leave it on permanently once a full window shows no failures and the backlog (estimated_total_events) stayed near zero. ``` /chatops gitlab run feature set sync_sec_mirror_tables true /chatops gitlab run feature set sync_sec_mirror_tables false ``` **Rollout log** | Date | Enabled (UTC) | Disabled (UTC) | Result | |------|---------------|----------------|--------| | — | — | — | — | ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): As an ops flag, this needs no docs update; breaking changes and external API consumers do not apply. - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/255374 19.5 /chatops gitlab run feature delete sync_sec_mirror_tables --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set sync_sec_mirror_tables false # production /chatops gitlab run feature set sync_sec_mirror_tables false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete sync_sec_mirror_tables --dev --pre --staging --staging-ref --production # remove entirely ```