极狐Gitlab开启fast_ssh_key_lookup导致备份恢复错误解决

如果备份的实例开启了 fast_ssh_key_lookup 功能，并关闭了 authorized_keys 文件认证：

web界面 - admin - settings - network - Performance optimization - 取消勾选 Use authorized_keys file to authenticate SSH keys

恢复的时候会报错：

...
2022-09-13 17:17:09 +0800 -- Restoring terraform states ... done
2022-09-13 17:17:09 +0800 -- Restoring packages ... 
2022-09-13 17:17:09 +0800 -- Restoring packages ... done
WARNING

The "Write to authorized_keys file" setting is disabled, which prevents
the file from being rebuilt!

It should be enabled for most GitLab installations. Large installations
may wish to disable it as part of speeding up SSH operations.

See https://docs.gitlab.com/ee/administration/operations/fast_ssh_key_lookup.html

If you did not intentionally disable this option in Admin Area > Settings,
then you may have been affected by the 9.3.0 bug in which the new setting
was disabled by default.

https://gitlab.com/gitlab-org/gitlab/issues/2738

It was reverted in 9.3.1 and fixed in 9.3.3, however, if Settings were
saved while the setting was unchecked, then it is still disabled.
Do you want to permanently enable the "Write to authorized_keys file" setting now?
Do you want to continue (yes/no)? yes
Enabling the "Write to authorized_keys file" setting...
rake aborted!
OpenSSL::Cipher::CipherError: 
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:119:in `block in write_using_load_balancer'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/load_balancer.rb:112:in `block in read_write'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/load_balancer.rb:172:in `retry_with_backoff'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/load_balancer.rb:110:in `read_write'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:118:in `write_using_load_balancer'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:70:in `transaction'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:119:in `block in write_using_load_balancer'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/load_balancer.rb:112:in `block in read_write'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/load_balancer.rb:172:in `retry_with_backoff'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/load_balancer.rb:110:in `read_write'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:118:in `write_using_load_balancer'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/load_balancing/connection_proxy.rb:70:in `transaction'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/current_settings.rb:32:in `method_missing'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/shell.rake:106:in `ensure_write_to_authorized_keys_is_enabled'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/shell.rake:71:in `setup'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/shell.rake:47:in `block (3 levels) in <top (required)>'
/opt/gitlab/embedded/service/gitlab-rails/lib/backup/manager.rb:106:in `restore'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/backup.rake:20:in `block (3 levels) in <top (required)>'
/opt/gitlab/embedded/bin/bundle:23:in `load'
/opt/gitlab/embedded/bin/bundle:23:in `<main>'
Tasks: TOP => gitlab:shell:setup
(See full trace by running task with --trace)

• 这里失败中断了恢复过程，相比正常恢复就只是未正常恢复 authorized_keys 文件与清理恢复过程中的中间 tmp 文件

解决方法有 2 种

方法一：

1. 直接忽略错误
2. 删除 /var/opt/gitlab/backups/ 中残留的恢复中间 tmp 文件
3. 继续按正常流程恢复 config 与 ssh key
4. 配置 ssh，开启 fast_ssh_key_lookup
5. 最后 gitlab-ctl reconfigure && gitlab-ctl restart

方法二：

1. 备份前开启备份实例 authorized_keys 文件认证：web界面 - admin - settings - network - Performance optimization - 勾选 Use authorized_keys file to authenticate SSH keys
2. 正常备份，然后关闭备份实例 authorized_keys 文件认证：web界面 - admin - settings - network - Performance optimization - 取消勾选 Use authorized_keys file to authenticate SSH keys
3. 然后正常恢复数据、config 与 ssh key
4. 配置恢复实例 ssh，开启 fast_ssh_key_lookup
5. 恢复实例执行：gitlab-ctl reconfigure && gitlab-ctl restart
6. 最后关闭恢复实例 authorized_keys 文件认证：web界面 - admin - settings - network - Performance optimization - 取消勾选 Use authorized_keys file to authenticate SSH keys

学习了