Gracefully catch incorrect db key on primary

When the primary isn't using the correct `db_key_base`, the
/admin/geo_nodes should gracefully show this exception.

Closes gitlab-org/gitlab-ee#2869.

app/services/geo/node_status_service.rb

@@ -35,6 +35,8 @@ module Geo
 
             Array([message, details].compact.join("\n"))
           end
+        rescue OpenSSL::Cipher::CipherError
+          ['Error decrypting the Geo secret from the database. Check that the primary uses the correct db_key_base.']
         rescue HTTParty::Error, Timeout::Error, SocketError, Errno::ECONNRESET, Errno::ECONNREFUSED => e
           [e.message]
         end

changelogs/unreleased-ee/tc-geo-faulty-primary-db-key.yml

+---
+title: 'Geo: Gracefully catch incorrect db key on primary'
+merge_request: 2819
+author:
+type: fixed

spec/services/geo/node_status_service_spec.rb

@@ -52,5 +52,15 @@ describe Geo::NodeStatusService do
 
       expect(status.health).to eq("Could not connect to Geo node - HTTP Status Code: 401 Unauthorized\n")
     end
+
+    it 'returns meaningful error message when primary uses incorrect db key' do
+      secondary # create it before mocking GeoNode#secret_access_key
+
+      allow_any_instance_of(GeoNode).to receive(:secret_access_key).and_raise(OpenSSL::Cipher::CipherError)
+
+      status = subject.call(secondary)
+
+      expect(status.health).to eq('Error decrypting the Geo secret from the database. Check that the primary uses the correct db_key_base.')
+    end
   end
 end