Gitlab安装时ca.crt文件缺失导致无法访问首页如何解决？

该问题出现在非Kubernetes环境部署的Omnibus版本Gitlab中，内置Prometheus组件默认开启了Kubernetes服务发现规则，会主动读取K8s默认挂载的CA证书路径，无K8s环境时就会触发ca.crt不存在的报错，虽然通过gitlab-ctl status查看所有服务显示运行正常，但Prometheus组件初始化异常会阻塞首页加载流程。

run: alertmanager: (pid 26351) 624s; run: log: (pid 4641) 2149s
run: gitaly: (pid 26406) 623s; run: log: (pid 4638) 2149s
run: gitlab-exporter: (pid 26515) 622s; run: log: (pid 4630) 2149s
run: gitlab-workhorse: (pid 26517) 622s; run: log: (pid 4633) 2149s
run: grafana: (pid 26650) 622s; run: log: (pid 4634) 2149s
run: logrotate: (pid 26675) 621s; run: log: (pid 4629) 2149s
run: nginx: (pid 26794) 621s; run: log: (pid 4637) 2149s
run: node-exporter: (pid 26894) 620s; run: log: (pid 4636) 2149s
run: postgres-exporter: (pid 27009) 620s; run: log: (pid 4628) 2149s
run: postgresql: (pid 27018) 619s; run: log: (pid 4640) 2149s
run: prometheus: (pid 27021) 619s; run: log: (pid 4642) 2149s
run: puma: (pid 27082) 618s; run: log: (pid 4639) 2149s
run: redis: (pid 27105) 618s; run: log: (pid 4631) 2149s
run: redis-exporter: (pid 27135) 617s; run: log: (pid 4632) 2149s
run: sidekiq: (pid 27287) 614s; run: log: (pid 4635) 2149s

==> /var/log/gitlab/prometheus/current <==
2021-08-26_08:53:49.90252 level=info ts=2021-08-26T08:53:49.902Z caller=main.go:802 msg="TSDB started"
2021-08-26_08:53:49.90253 level=info ts=2021-08-26T08:53:49.902Z caller=main.go:928 msg="Loading configuration file" filename=/var/opt/gitlab/prometheus/prometheus.yml
2021-08-26_08:53:49.90450 level=error ts=2021-08-26T08:53:49.904Z caller=manager.go:314 component="discovery manager scrape" msg="Cannot create service discovery" err="unable to load specified CA cert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: open /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: no such file or directory" type=kubernetes
2021-08-26_08:53:49.90467 level=error ts=2021-08-26T08:53:49.904Z caller=manager.go:314 component="discovery manager scrape" msg="Cannot create service discovery" err="unable to load specified CA cert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: open /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: no such file or directory" type=kubernetes
2021-08-26_08:53:49.90470 level=error ts=2021-08-26T08:53:49.904Z caller=manager.go:314 component="discovery manager scrape" msg="Cannot create service discovery" err="unable to load specified CA cert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: open /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: no such file or directory" type=kubernetes
2021-08-26_08:53:49.91260 level=info ts=2021-08-26T08:53:49.912Z caller=main.go:959 msg="Completed loading of configuration file" filename=/var/opt/gitlab/prometheus/prometheus.yml totalDuration=10.013055ms remote_storage=2.512µs web_handler=754ns query_engine=1.237µs scrape=76.398µs scrape_sd=490.692µs notify=27.166µs notify_sd=19.689µs rules=7.607982ms
2021-08-26_08:53:49.91262 level=info ts=2021-08-26T08:53:49.912Z caller=main.go:751 msg="Server is ready to receive web requests."
2021-08-26_08:53:54.91465 level=error ts=2021-08-26T08:53:54.914Z caller=manager.go:188 component="scrape manager" msg="error creating new scrape pool" err="error creating HTTP client: unable to load specified CA cert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: open /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: no such file or directory" scrape_pool=kubernetes-nodes
2021-08-26_08:53:54.91483 level=error ts=2021-08-26T08:53:54.914Z caller=manager.go:188 component="scrape manager" msg="error creating new scrape pool" err="error creating HTTP client: unable to load specified CA cert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: open /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: no such file or directory" scrape_pool=kubernetes-cadvisor
2021-08-26_08:53:54.91549 level=error ts=2021-08-26T08:53:54.914Z caller=manager.go:188 component="scrape manager" msg="error creating new scrape pool" err="error creating HTTP client: unable to load specified CA cert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: open /var/run/secrets/kubernetes.io/serviceaccount/ca.crt: no such file or directory" scrape_pool=kubernetes-pods

两种可选方案，根据使用需求选择即可：

方案一：保留Prometheus监控功能，仅关闭K8s服务发现 #

• 打开Gitlab配置文件 /etc/gitlab/gitlab.rb
• 新增如下配置：

prometheus['kubernetes_sd_disabled'] = true

• 保存文件后执行配置生效命令：gitlab-ctl reconfigure
• 执行完成后重启Gitlab服务：gitlab-ctl restart

方案二：完全禁用Prometheus监控（不需要监控功能时使用） #

• 打开Gitlab配置文件 /etc/gitlab/gitlab.rb
• 找到prometheus['enable']配置项，修改为：

prometheus['enable'] = false

• 保存文件后执行配置生效命令：gitlab-ctl reconfigure
• 执行完成后重启Gitlab服务：gitlab-ctl restart

操作完成后再次访问Gitlab首页即可正常加载。

内容的提问来源于stack exchange，提问作者YixiaoXu