Gitaly secrets file differs between Gitaly and non-Gitaly nodes
Summary
After changes in !8164 (merged), the gitlab-secrets.json file differs between Gitaly nodes and other nodes, causing customer confusion since documentation states all secrets files should be the same.
Current Behavior
All other nodes have:
"gitaly": {
"gitlab_secret": "xxxxx",
"configuration": {
"auth": {
"token": null
}
}
}
Gitaly Nodes have:
"gitaly": {
"gitlab_secret": "xxxxx",
"configuration": {
"auth": {
"token": "<praefect internal token>"
}
}
}
Problem
Customers expect secrets files to be identical across all nodes based on documentation. The null token on non-Gitaly nodes creates unnecessary differences and causes confusion even though Gitaly cluster works fine with this change.
Proposed Solution
Add a conditional to avoid rendering the null token on non-Gitaly nodes to make the secrets files more consistent and less confusing. Non-Gitaly nodes cannot know about the actual token unless it was synced over, so rendering null does not provide value.
Context
- Reported by customer running 3K architecture on 18.4.1
- Related MR: !8164 (merged) (changes made to support FIPS on Ubuntu 22)
- Gitaly cluster functionality is not affected