Geo: when hideRefs is defined we can't replicate every object from primary
Summary
In %8.15 we enabled hideRefs by default in omnibus: omnibus-gitlab@e7484a9b. This is used to speedup the announcement of refs in a git transfer.
While our users don't need these refs, Geo does need them to provide DR, to display commits for a deleted SHA etc.
Steps to reproduce
Trying a git clone with --mirror, which is similar to what Geo secondary does, will not provide any data in refs/keep-around when the hideRefs are defined (which is by default).
Possible fixes
We should enable either specific system groups (like admins) or enable Geo keys to be able to bypass the hideRefs configuration.
It looks like it's possible to override the configuration with the command line, prepending the call to the upload-pack with something like: git -c transfer.hideRefs=!^refs/keep-around/
This may be candidate to go to gitlab-shell / workhorse / gitaly.