## Summary Roll out [the feature](https://gitlab.com/gitlab-org/gitlab/-/work_items/635595) currently behind the `rate_limit_metric_definitions` feature flag, introduced in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/270522. The flag enforces a limit of 30 requests per minute per IP address on `GET /api/v4/usage_data/metric_definitions`. While the flag is disabled, requests over the limit are logged but not blocked. The flag uses the `:instance` actor, so it's on or off for the whole instance, and there's no percentage or per-actor rollout. - DRI: @pataylor - Team Slack channel: `#g_analytics_analytics_instrumentation` > [!note] > Process and guidance live in the docs. This issue is just the commands and a place to track the rollout. > "Rolling out" means enabling the flag on GitLab.com to validate stability. It is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What could go wrong? - **Legitimate callers get `429`:** clients that share an egress IP, such as GitLab.com CI runners or a corporate NAT, could together exceed 30 requests per minute. Before enabling, check how often the log-mode rule fires in production. Requests over the limit have a `rate_limit_state` entry ending in `limit_metric_definition_downloads_by_ip_log:log`. - **Blast radius:** this endpoint only. Callers that are throttled can retry after the `Retry-After` interval. Rolling back means setting the flag to `false`. ## Log stage (flag off) From deploy until the flag is enabled, every request is counted by the `limit_metric_definition_downloads_by_ip_log` rule, and requests over the limit are logged but still get `200`. Review a few days of this data before enabling the flag. See [roll out a key in log mode](https://docs.gitlab.com/development/application_limits/#roll-out-a-gitlabapplicationratelimiter-key-in-log-mode). **Kibana** (https://log.gprd.gitlab.net, index `pubsub-rails-inf-gprd*`): - Requests over the limit: ``` json.rate_limit_state:"applimiter_metric_definitions_download:limit_metric_definition_downloads_by_ip_log:log" ``` - All requests to the endpoint, for comparison: ``` json.path:"/api/v4/usage_data/metric_definitions" ``` Break both down by `json.remote_ip`. Over-limit requests from one or two heavy callers mean the limit is working. Over-limit requests spread across many ordinary IPs, or from shared egress IPs such as CI runners, mean the limit is too low. **Grafana** (https://dashboards.gitlab.net/d/rate-limiting-detail): the `gitlab_labkit_rate_limiter_rule_evaluations_total` metric with `rule="limit_metric_definition_downloads_by_ip_log"` and `result="log"`. The limit is hardcoded at 30 requests per minute per IP, so raising it takes a merge request that changes the `metric_definitions_download` rule in `lib/gitlab/application_rate_limiter/labkit_adapter/supported_rate_limits.rb`. ## Events - [Exceptions with rate_limit_metric_definitions:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22rate_limit_metric_definitions:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with rate_limit_metric_definitions:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22rate_limit_metric_definitions:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production ChatOps commands in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_analytics_analytics_instrumentation`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process). **Before enabling on production:** with the MR deployed and the flag still disabled, review a few days of data, as described in **Log stage (flag off)**. **Non-production:** - `/chatops gitlab run feature set rate_limit_metric_definitions true --dev --pre --staging --staging-ref` Then check that enforcement works on staging. The 31st request in a minute should return `429` with a `Retry-After` header: ```shell for i in $(seq 31); do curl --silent --output /dev/null --write-out '%{http_code}\n' "https://staging.gitlab.com/api/v4/usage_data/metric_definitions"; done ``` **Production:** - `/chatops gitlab run feature set rate_limit_metric_definitions true` ## Before global rollout Confirm the relevant gotchas before enabling. See [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - Log stage reviewed, and the limit of 30 confirmed or raised - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle). See [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). For this key, cleanup also replaces `staged_rule` with `Labkit::RateLimit::Rule.new` and `action: :limit` in `supported_rate_limits.rb`. Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). > [!note] > The merge request that removes the flag, or makes it enabled by default, needs a changelog entry, most likely `Changelog: added`. That's the first time API callers can get a `429` from this endpoint. The original MR, https://gitlab.com/gitlab-org/gitlab/-/merge_requests/270522, has no entry because the flag is disabled by default. See [feature flag changelog](https://docs.gitlab.com/development/feature_flags/#changelog). Remove the flag and its YAML definition from the codebase, then: - `/chatops gitlab run release check <merge-request-url> 19.6` - `/chatops gitlab run feature delete rate_limit_metric_definitions --dev --pre --staging --staging-ref --production` ## Rollback - Production: `/chatops gitlab run feature set rate_limit_metric_definitions false` - Non-production: `/chatops gitlab run feature set rate_limit_metric_definitions false --dev --pre --staging --staging-ref` - Remove entirely: `/chatops gitlab run feature delete rate_limit_metric_definitions --dev --pre --staging --staging-ref --production`