Support a list of keys in gitlab_rails['db_key_base']

What does this MR do?

Prepares for db_key_base rotation by letting gitlab_rails['db_key_base'] be a list of keys. With a list, the last key encrypts and every key decrypts. This is the same convention as the Active Record Encryption keys.

• New installs generate db_key_base as a single-key list, so a key can be added later without changing its type.
• Existing installs keep their current value. A single string isn't converted to a list.
• A list set in /etc/gitlab/gitlab.rb or /etc/gitlab/gitlab-secrets.json is kept as-is and renders as a YAML list in secrets.yml. No template change is needed.
• validate_secrets no longer raises when the legacy gitlab_ci['db_key_base'] is one of the keys in the list.
• Reconfigure fails early when db_key_base is an empty list or has empty or non-string entries.
• Docs: "Rotate the secrets file" now says db_key_base rotation is in development and not ready yet. The rotation runbook will be documented once GitLab ships rotation support.

GitLab Rails reads the value with Array(Gitlab::Application.credentials.db_key_base), so a single-key list behaves like a string.

Dependency: the Terraform state and pipeline artifact uploaders used to pass the raw credential to OpenSSL::HMAC.digest, which raises TypeError on a list. gitlab!258816 (merged) fixed that and merged in 19.5. Don't backport this MR to a stable branch older than 19.5.

Related issues

Closes https://gitlab.com/gitlab-org/gitlab/-/work_items/631572

Parent: https://gitlab.com/gitlab-org/gitlab/-/work_items/631456 · Epic: https://gitlab.com/groups/gitlab-org/-/work_items/23829

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion.

Required

• MR title and description are up to date, accurate, and descriptive.
• MR targeting the appropriate branch.
• Latest Merge Result pipeline is green.
• When ready for review, MR is labeled workflowready for review per the Distribution MR workflow.
• The UBT version and corresponding checksum hash have been updated and referenced in the merge request if applicable.
  • UBT EE pipeline (Trigger:ee-package-ubt) is green

For GitLab team members

If you don't have access to this, the reviewer should trigger these jobs for you during the review process.

• The manual Trigger:ee-package jobs have a green pipeline running against latest commit.
  • To debug QA failures, refer to the Investigate QA failures section.
• If config/software or config/patches directories are changed, make sure the build-package-on-all-os job within the Trigger:ee-package downstream pipeline succeeded.
• If you are changing anything SSL related, then the Trigger:package:fips manual job within the Trigger:ee-package downstream pipeline must succeed.
• If CI configuration is changed, the branch must be pushed to dev.gitlab.org to confirm regular branch builds aren't broken.

Expected (please provide an explanation if not completing)

• Test plan indicating conditions for success has been posted and passes. (Posted, results pending.)
• Documentation created/updated.
• Tests added.
• Integration tests added to GitLab QA.
• Equivalent MR/issue for the GitLab Chart opened: https://gitlab.com/gitlab-org/gitlab/-/work_items/631573
• Validate potential values for new configuration settings. Formats such as integer 10, duration 10s, URI scheme://user:passwd@host:port may require quotation or other special handling when rendered in a template and written to a configuration file.

🤖 Generated with Claude Code