Enable legacy feature flags read-only by default

Update documentation for legacy flags

doc/operations/feature_flags.md

@@ -54,22 +54,6 @@ To create and enable a feature flag:
 You can change these settings by clicking the **{pencil}** (edit) button
 next to any feature flag in the list.
 
-## Rollout strategy (legacy)
-
-> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/8240) in GitLab 12.2.
-
-In GitLab 13.0 and earlier, the **Rollout strategy** setting affects which users will experience
-the feature as enabled. Choose the percentage of users that the feature will be enabled
-for. The rollout strategy will have no effect if the environment spec is disabled.
-
-It can be set to:
-
-- All users
-- [Percent of users](#percent-of-users)
-  - Optionally, you can click the **Include additional user IDs** checkbox and add a list
-    of specific users IDs to enable the feature for.
-- [User IDs](#user-ids)
-
 ## Feature flag strategies
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/35555) in GitLab 13.0.
@@ -208,6 +192,23 @@ To enable it:
 Feature.enable(:feature_flags_new_version)
 ```
 
+## Rollout strategy (legacy)
+
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/8240) in GitLab 12.2.
+> - [Made read-only](https://gitlab.com/gitlab-org/gitlab/-/issues/220228) in GitLab 13.4.
+
+In GitLab 13.0 and earlier, the **Rollout strategy** setting affects which users will experience
+the feature as enabled. Choose the percentage of users that the feature will be enabled
+for. The rollout strategy will have no effect if the environment spec is disabled.
+
+It can be set to:
+
+- All users
+- [Percent of users](#percent-of-users)
+  - Optionally, you can click the **Include additional user IDs** checkbox and add a list
+    of specific users IDs to enable the feature for.
+- [User IDs](#user-ids)
+
 ## Disable a feature flag for a specific environment
 
 In [GitLab 13.0 and earlier](https://gitlab.com/gitlab-org/gitlab/-/issues/8621),

ee/app/controllers/projects/feature_flags_controller.rb

@@ -15,7 +15,7 @@ class Projects::FeatureFlagsController < Projects::ApplicationController
   before_action do
     push_frontend_feature_flag(:feature_flag_permissions)
     push_frontend_feature_flag(:feature_flags_new_version, project, default_enabled: true)
-    push_frontend_feature_flag(:feature_flags_legacy_read_only, project)
+    push_frontend_feature_flag(:feature_flags_legacy_read_only, project, default_enabled: true)
     push_frontend_feature_flag(:feature_flags_legacy_read_only_override, project)
   end
 
@@ -111,7 +111,7 @@ class Projects::FeatureFlagsController < Projects::ApplicationController
   end
 
   def ensure_legacy_flags_writable!
-    if ::Feature.enabled?(:feature_flags_legacy_read_only, project) &&
+    if ::Feature.enabled?(:feature_flags_legacy_read_only, project, default_enabled: true) &&
         ::Feature.disabled?(:feature_flags_legacy_read_only_override, project) &&
         feature_flag.legacy_flag?
       render_error_json(['Legacy feature flags are read-only'])

ee/changelogs/unreleased/default-enable-legacy-read-only-flags.yml

+---
+title: Make legacy feature flags read-only
+merge_request: 40320
+author:
+type: changed