Encode Redis Sentinel passwords inside runtime ERB

What does this MR do?

Encode Redis Sentinel passwords after reading the secret, so quotes, backslashes, and embedded newlines survive YAML parsing. The shared helper now uses to_json inside ERB, and the Rails, gitlab-exporter, and Mailroom consumers no longer add outer quotes.

The regression renders the runtime YAML for webservice, sidekiq, toolbox, exporter, incoming email, and Service Desk. All eight password cases pass; the quote, backslash, and newline cases failed before the fix. The full Redis, exporter, Mailroom, and regression suites pass all 99 examples with seed 17. Ruby lint passes.

AI assistance: prepared with OpenAI Codex and tested locally.

Local checks used Ruby 3.2.3, Psych 5.5.0, Helm 4.2.3, and Gomplate 5.0.0. Local dependency adjustments are kept outside the patch. Cluster validation remains pending because the local Docker daemon is unavailable; these checks cover Helm rendering, runtime ERB evaluation, and YAML parsing. The supported configuration and secret mounts are unchanged, so no documentation update is needed. No Omnibus equivalent is proposed here because this fixes the shared Helm ERB helper and its consumers.

Closes #6697 (closed)

Author checklist

For general guidance, please follow our Contributing guide.

Required

For anything in this list which will not be completed, please provide a reason in the MR discussion.

  • Merge Request Title and Description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • MR has a green pipeline.
  • Documentation created/updated.
  • Tests added/updated.
  • Have you validated that your change works end-to-end on a real cluster deployment?
    • Describe how you did it in a comment.
  • Equivalent MR/issue for omnibus-gitlab opened.
  • When ready for review, MR is marked as ready (not a draft) and assigned to a reviewer.

Reviewers checklist

Edited by Clemens Beck

Merge request reports

Loading
Loading