Skip to content

Replace Secret generator functions with shared-secrets Helm chart

As opposed to any other resource, e.g. ConfigMap, Deployment, etc, GitLab Chart creates the Secrets with a script that runs in a container. This is done in shared-secret sub-chart. Basically Secrets do not exist when the templates are rendered. They will be created when the rendered template is deployed on the cluster.

The Operator must deploy the shared-secret (or at least part of it) to get access to the Secrets. This will affect the way the Operator reconciles the Secrets.

Here is an initial idea to implement this:

  1. Operator runs shared-secrets Job. The job description and its requirements, including ServiceAccount, are rendered with the template or created/manipulated by the Operator.
  2. The Job creates any required Secret.
  3. Operator waits for the Job to finish before creating other resources. This is very similar to pre-install and pre-upgrade hooks in shared-secrets sub-chart.
  4. Once the Job is done, Operator checks the Secrets and fetches them to update the reference to the GitLab CR and proceeds to create other resources.