## Summary Roll out the per-user rate limit on issue, epic and work item updates, currently behind the `work_item_update_rate_limit` feature flag. The limit is the `work_item_update_limit` application setting (600 updates every minute for each user, labeled beta) and one key covers the REST API, GraphQL and the web UI. Introduced in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/268180 for https://gitlab.com/gitlab-org/gitlab/-/work_items/637477. - DRI: daniyalAD - Team Slack channel: `#g_work_items` - Follow-up MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/269378 carries the non-blocking review items: the oversized bulk edit check moves onto `Gitlab::ApplicationRateLimiter.enforced_limit_for`, the `422` message is pluralized, and the Service Desk support bot is exempt from the limit. Stacked on the MR above until it merges. > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What could go wrong? - Automation that updates issues above 600 times each minute with one token gets `429` responses. Any caller above the limit goes through the customer impact process in https://gitlab.com/gitlab-org/gitlab/-/work_items/634694 before the flag goes to 100%. - The issue, epic and work item pages show a bare `429` response when throttled. There is no friendly error yet. - Bulk edits count one update for each item, and a batch with more items than the limit is rejected with `422` once the flag is on. Membership removal, milestone deletion and the Service Desk support bot (once the follow-up MR merges) skip the limit on purpose, so they keep working past it. - Rollback is immediate: `/chatops gitlab run feature set work_item_update_rate_limit false` returns to log mode, where updates over the limit are counted by the `limit_work_item_updates_by_user_log` rule and logged, not blocked. - To see who is throttled, search the Rails auth logs in https://log.gprd.gitlab.net for `json.message: "Application_Rate_Limiter_Request" and json.env: "work_item_update_request_limit"` ## Log stage (flag off) The key is a `staged_rule`, so before enabling the flag, confirm the threshold with the log data: - The `gitlab_labkit_rate_limiter_rule_evaluations_total` metric with `rule="limit_work_item_updates_by_user_log"` and `result="log"`. - The `rate_limit_state` field on request log lines that contain `applimiter_work_item_update:limit_work_item_updates_by_user_log:log`. The `meta` fields of the same line say who made the request. If legitimate users go over the limit, raise `work_item_update_limit` before enabling the flag. Ref: https://docs.gitlab.com/development/application_limits/#roll-out-a-gitlabapplicationratelimiter-key-in-log-mode ## Events - [Exceptions with work_item_update_rate_limit:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22work_item_update_rate_limit:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with work_item_update_rate_limit:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22work_item_update_rate_limit:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature Flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_work_items`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set work_item_update_rate_limit 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set work_item_update_rate_limit true --dev --pre --staging --staging-ref ``` Check on staging that an update past the limit returns `429` through the API, GraphQL and the UI, and that a bulk edit still updates every item. **Production** — percentage rollout (wait ≥15 min between steps, watch dashboards): ``` /chatops gitlab run feature set work_item_update_rate_limit <percentage> --actors ``` Or target specific actors instead: ``` /chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss work_item_update_rate_limit true /chatops gitlab run feature set --group=gitlab-org,gitlab-com work_item_update_rate_limit true /chatops gitlab run feature set --user=daniyalAD work_item_update_rate_limit true ``` ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable - [ ] Record the customer impact for the callers above the limit in https://gitlab.com/gitlab-org/gitlab/-/work_items/634694 - [ ] Add the update limit (600 requests each minute for a user) to the "Current rate limits" table in `doc/user/gitlab_com/rate_limits.md` - [ ] Mention the limit in the issue, epic and work item user docs - [ ] Open a frontend follow-up to show a friendly error instead of the bare `429` response on the issue, epic and work item pages ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete work_item_update_rate_limit --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set work_item_update_rate_limit false # production /chatops gitlab run feature set work_item_update_rate_limit false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete work_item_update_rate_limit --dev --pre --staging --staging-ref --production # remove entirely ```