Replace Secret generator functions with shared-secrets Helm chart
As opposed to any other resource, e.g. ConfigMap, Deployment, etc, GitLab Chart creates the Secrets with a script that runs in a container. This is done in shared-secret
sub-chart. Basically Secrets do not exist when the templates are rendered. They will be created when the rendered template is deployed on the cluster.
The Operator must deploy the shared-secret
(or at least part of it) to get access to the Secrets. This will affect the way the Operator reconciles the Secrets.
Here is an initial idea to implement this:
- Operator runs
shared-secrets
Job. The job description and its requirements, including ServiceAccount, are rendered with the template or created/manipulated by the Operator. - The Job creates any required Secret.
- Operator waits for the Job to finish before creating other resources. This is very similar to
pre-install
andpre-upgrade
hooks inshared-secrets
sub-chart. - Once the Job is done, Operator checks the Secrets and fetches them to update the reference to the GitLab CR and proceeds to create other resources.