## Summary Roll out [the feature](https://gitlab.com/gitlab-org/gitlab/-/work_items/611349) currently behind the `ssh_certificate_authentication_rate_limit` feature flag. - DRI: @freinink - Team Slack channel: `#g_create_source-code ` > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) The flag gates two things: 1. A per-SSH-client-IP rate limit of 300 requests per minute on `GET /api/v4/internal/authorized_certs` (rate-limit key `ssh_certificate_authentication`). 1. The `ssh_certificate_authentication_failed` audit event, which is recorded only while the flag is enabled so audit writes never happen without the limit in place. The flag uses the `:instance` actor, so it is either on or off for the whole instance. Percentage and per-actor rollout do not apply. ## Prerequisites Do not enable the flag until both GitLab Shell changes have shipped in a release and `GITLAB_SHELL_VERSION` has been bumped and deployed to GitLab.com: - [Send SSH client IP to `/authorized_certs`](https://gitlab.com/gitlab-org/gitlab-shell/-/merge_requests/1578), so Rails receives the real client address as `check_ip`. - Do not retry `429` responses from `/authorized_certs`, so a throttled login is rejected quickly instead of stalling to the SSH deadline and counting as an infrastructure failure. Before enabling, check certificate-resolution traffic in the API request logs: - Peak `/api/v4/internal/authorized_certs` requests per minute per `check_ip`, paying attention to shared NAT and runner-fleet sources. - How often `check_ip` is missing (fallback to the GitLab Shell node address). - If legitimate peaks approach 300 per minute, revisit the threshold before enabling. ## What could go wrong? - Legitimate clients behind a shared address (NAT, proxy without PROXY protocol, runner fleet) exceed 300 certificate resolutions per minute and get SSH logins rejected with `429`. Watch `ssh_certificate_authentication_request_limit` entries in `auth.log` and `429` rates on the endpoint. - An older GitLab Shell node omits `check_ip`, so all of its clients share one bucket keyed on the node address. Only possible if the prerequisite Shell bump is not fully deployed. - No data-loss risk. The limiter fails open if Redis errors. ## Events - [Exceptions with ssh_certificate_authentication_rate_limit:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22ssh_certificate_authentication_rate_limit:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with ssh_certificate_authentication_rate_limit:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22ssh_certificate_authentication_rate_limit:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature Flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_source_code`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set ssh_certificate_authentication_rate_limit true --dev --pre --staging --staging-ref ``` **Production** ``` /chatops gitlab run feature set ssh_certificate_authentication_rate_limit true ``` After enabling, monitor `ssh_certificate_authentication_request_limit` entries in `auth.log`, `429` rates on `/api/v4/internal/authorized_certs`, GitLab Shell certificate-rejection logs, and `ssh_certificate_authentication_failed` audit event volume. ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete ssh_certificate_authentication_rate_limit --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set ssh_certificate_authentication_rate_limit false # production /chatops gitlab run feature set ssh_certificate_authentication_rate_limit false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete ssh_certificate_authentication_rate_limit --dev --pre --staging --staging-ref --production # remove entirely ```