Fix knowledge graph secret initializer EACCES in Omnibus

Michael Angelo Riverarequested to merge
fix-knowledge-graph-secret-omnibus-eacces into master

Summary

Fixes the Errno::EACCES: Permission denied error on .gitlab_knowledge_graph_secret that blocks all Omnibus QA jobs during gitlab-ctl reconfigure.

Closes #591610 (closed)

Root cause

The initializer ee/config/initializers/gitlab_knowledge_graph_secret.rb unconditionally calls ensure_secret! at boot, which attempts to write .gitlab_knowledge_graph_secret to Rails.root. In Omnibus, Rails.root (/opt/gitlab/embedded/service/gitlab-rails/) is owned by root, but gitlab-rake runs as the git user — causing EACCES.

Fix

Gate ensure_secret! on knowledge_graph['enabled'] (defaults to false). When the feature isn't configured, no secret file write is attempted. This follows the principle of not generating secrets for disabled features.

Uses hash-style ['enabled'] access instead of dotted .enabled to avoid GitlabSettings::MissingSetting when the setting isn't fully configured.

Test plan

  • Verify Omnibus QA pipeline passes (reconfigure no longer crashes)
  • Verify ensure_secret! is still called when knowledge_graph.enabled = true
  • New initializer spec covers enabled, disabled, and unconfigured cases
  • New ensure_secret! unit tests in jwt_auth_spec.rb

Merge request reports