Skip to content

Add a secret generation command to gitlab-ctl

Summary

We want to make some iterative improvements to omnibus secrets handling to let us start rolling out some new secrets management changes for specific HA roles. https://gitlab.com/gitlab-org/gitlab/-/issues/393092

Once Add options to control secret generation and w... (#7700 - closed) is completed, secrets generation won't be handled by omnibus reconfigure. Long term we might want to explore some of the options in https://gitlab.com/gitlab-org/charts/gitlab/-/issues/2898 but short term we can provide some options to enable the GitLab environment toolkit to continue to use the omnibus codebase's secret generation.

Proposal

  • Introduce a new gitlab-ctl command, similar to show-config that reads the gitlab.rb, parses config and secrets, and calls the secret helper to generate the secrets.
  • Introduce a flag for this new command, that allows you to specific the output file, including support for also only output to stdout.

References

Edited by DJ Mountney