Gitaly secrets file differs between Gitaly and non-Gitaly nodes

Summary

After changes in !8164 (merged), the gitlab-secrets.json file differs between Gitaly nodes and other nodes, causing customer confusion since documentation states all secrets files should be the same.

Current Behavior

All other nodes have:

"gitaly": {
    "gitlab_secret": "xxxxx",
    "configuration": {
        "auth": {
           "token": null
        }   
    }
}

Gitaly Nodes have:

"gitaly": {
    "gitlab_secret": "xxxxx",
    "configuration": {
        "auth": {
           "token": "<praefect internal token>"
        }   
    }
}

Problem

Customers expect secrets files to be identical across all nodes based on documentation. The null token on non-Gitaly nodes creates unnecessary differences and causes confusion even though Gitaly cluster works fine with this change.

Proposed Solution

Add a conditional to avoid rendering the null token on non-Gitaly nodes to make the secrets files more consistent and less confusing. Non-Gitaly nodes cannot know about the actual token unless it was synced over, so rendering null does not provide value.

Context

  • Reported by customer running 3K architecture on 18.4.1
  • Related MR: !8164 (merged) (changes made to support FIPS on Ubuntu 22)
  • Gitaly cluster functionality is not affected