## Summary Roll out [the feature](https://gitlab.com/gitlab-org/gitlab/-/work_items/637347) currently behind the `secrets_manager_initialize_rate_limit` feature flag. - DRI: @iamricecake - Team Slack channel: `#sec-secrets-manager-application` - MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/269629 > [!note] > Process and guidance live in the docs. This issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability. It is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) · [Roll out a key in log mode](https://docs.gitlab.com/development/application_limits/#roll-out-a-gitlabapplicationratelimiter-key-in-log-mode) ## How enforcement works The `secrets_manager_initialize` rate limit allows 30 secrets manager enablements per minute for each top-level group. It applies to the `projectSecretsManagerInitialize` and `groupSecretsManagerInitialize` GraphQL mutations. Projects and groups in the same top-level group share the limit. - **Flag disabled (default):** log mode. Requests are counted, and requests over the limit are logged, but nothing is blocked. - **Flag enabled for the top-level group** (the actor is the root namespace): requests over the limit get `This endpoint has been requested too many times. Try again later.` in the mutation payload `errors`, and the UI shows that message. Not counted: requests for a project or group that already has a secrets manager, requests for a project in a user namespace, and requests rejected earlier (not authorized, inactive namespace, entitlement denied). `StartTrial` and `EnableAddOn` are not limited. ## What could go wrong? - If the limit is too low, a large top-level group that enables secrets managers with a script is blocked for up to a minute at a time. The UI shows the rate limit message. - The enforced rule and the log-mode rule use separate Redis counters. When the flag is enabled, the enforced rule starts counting from zero. This is expected. - The only new cost is one Redis increment for each Initialize request. ## Before enabling - [ ] MR merged and deployed - [ ] Watch log mode on GitLab.com for at least a week. Confirm that no legitimate top-level group goes over 30 enablements per minute. If one does, raise the limit before enabling the flag. - Metric: `gitlab_labkit_rate_limiter_rule_evaluations_total{rule="limit_secrets_manager_initializations_by_root_namespace_log", result="log"}` - Logs: [requests that would have been blocked](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-7d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.rate_limit_state:*limit_secrets_manager_initializations_by_root_namespace_log:log*'),columns:!(json.meta.root_namespace,json.meta.user,json.rate_limit_state),sort:!(!(json.time,desc)))) - [ ] Write the threshold and the data behind it in https://gitlab.com/gitlab-org/gitlab/-/work_items/637347 - [ ] Replay the incident pattern on staging: enable more than 30 secrets managers in one minute in one top-level group, and confirm the 31st is blocked ## Events - [Exceptions with secrets_manager_initialize_rate_limit:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22secrets_manager_initialize_rate_limit:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with secrets_manager_initialize_rate_limit:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22secrets_manager_initialize_rate_limit:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature Flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#sec-secrets-manager-application`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set secrets_manager_initialize_rate_limit 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set secrets_manager_initialize_rate_limit true --dev --pre --staging --staging-ref ``` **Production**, first for a test group: ``` /chatops gitlab run feature set --group=gitlab-org secrets_manager_initialize_rate_limit true ``` Then percentage rollout (wait at least 15 minutes between steps, watch dashboards): ``` /chatops gitlab run feature set secrets_manager_initialize_rate_limit <percentage> --actors ``` ## Before global rollout Confirm the relevant gotchas before going to 100%. See [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup > [!note] > After the flag is removed, the limit also applies on self-managed. Self-managed admins are more likely to script a bulk enable across many projects. Check the log-mode numbers with that in mind before removing the flag. Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle). See [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Replace `staged_rule` with `Labkit::RateLimit::Rule.new` and `action: :limit` for `secrets_manager_initialize`, keep the rule name so its counter is not reset, and remove the flag and its YAML definition. Then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete secrets_manager_initialize_rate_limit --dev --pre --staging --staging-ref --production ``` ## Rollback Disabling the flag returns the limit to log mode right away. Nothing is blocked after that. ``` /chatops gitlab run feature set secrets_manager_initialize_rate_limit false # production /chatops gitlab run feature set secrets_manager_initialize_rate_limit false --dev --pre --staging --staging-ref # non-production ```