apiVersion: v1
data:
  generate-secrets: "# vim: set filetype=sh:\n\nnamespace=default\nrelease=RELEASE-NAME\nenv=production\n\npushd
    $(mktemp -d)\n\n# Args pattern, length\nfunction gen_random(){\n  head -c 4096
    /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2\n}\n\n# Args: yaml file, search
    path\nfunction fetch_rails_value(){\n  local value=$(yq read $1 \"${2}\")\n  #
    Don't return null values\n  if [ \"${value}\" != \"null\" ]; then echo \"${value}\";
    fi\n}\n\n# Args: secretname\nfunction label_secret(){\n  local secret_name=$1\n#
    Remove application labels if they exist\n  kubectl --namespace=$namespace label
    \\\n    secret $secret_name $(echo 'app.kubernetes.io/name=RELEASE-NAME' | sed
    -E 's/=[^ ]*/-/g')\n\n  kubectl --namespace=$namespace label \\\n    --overwrite
    \\\n    secret $secret_name app=gitlab chart=gitlab-5.7.0 release=RELEASE-NAME
    heritage=Helm \n}\n\n# Args: secretname, args\nfunction generate_secret_if_needed(){\n
    \ local secret_args=( \"${@:2}\")\n  local secret_name=$1\n\n  if ! $(kubectl
    --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then\n    kubectl
    --namespace=$namespace create secret generic $secret_name ${secret_args[@]}\n
    \ else\n    echo \"secret \\\"$secret_name\\\" already exists.\"\n\n    for arg
    in \"${secret_args[@]}\"; do\n      local from=$(echo -n ${arg} | cut -d '=' -f1)\n\n
    \     if [ -z \"${from##*literal*}\" ]; then\n        local key=$(echo -n ${arg}
    | cut -d '=' -f2)\n        local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-)\n
    \       local flags=\"--namespace=$namespace --allow-missing-template-keys=false\"\n\n
    \       if ! $(kubectl $flags get secret $secret_name -ojsonpath=\"{.data.${key}}\"
    > /dev/null 2>&1); then\n          echo \"key \\\"${key}\\\" does not exist. patching
    it in.\"\n\n          if [ \"${desiredValue}\" != \"\" ]; then\n            desiredValue=$(echo
    -n \"${desiredValue}\" | base64 -w 0)\n          fi\n\n          kubectl --namespace=$namespace
    patch secret ${secret_name} -p \"{\\\"data\\\":{\\\"$key\\\":\\\"${desiredValue}\\\"}}\"\n
    \       fi\n      fi\n    done\n  fi\n\n  label_secret $secret_name\n}\n\n# Initial
    root password\ngenerate_secret_if_needed \"RELEASE-NAME-gitlab-initial-root-password\"
    --from-literal=\"password\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Redis password\ngenerate_secret_if_needed
    \"RELEASE-NAME-redis-secret\" --from-literal=\"secret\"=$(gen_random 'a-zA-Z0-9'
    64)\n\n\n# Postgres password\ngenerate_secret_if_needed \"RELEASE-NAME-postgresql-password\"
    --from-literal=postgresql-password=$(gen_random 'a-zA-Z0-9' 64) --from-literal=postgresql-postgres-password=$(gen_random
    'a-zA-Z0-9' 64)\n\n\n# Gitlab shell\ngenerate_secret_if_needed \"RELEASE-NAME-gitlab-shell-secret\"
    --from-literal=\"secret\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Gitaly secret\ngenerate_secret_if_needed
    \"RELEASE-NAME-gitaly-secret\" --from-literal=\"token\"=$(gen_random 'a-zA-Z0-9'
    64)\n\n# Minio secret\ngenerate_secret_if_needed \"RELEASE-NAME-minio-secret\"
    --from-literal=accesskey=$(gen_random 'a-zA-Z0-9' 64) --from-literal=secretkey=$(gen_random
    'a-zA-Z0-9' 64)\n\n\n# Gitlab runner secret\ngenerate_secret_if_needed \"RELEASE-NAME-gitlab-runner-secret\"
    --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token=\"\"\n\n#
    GitLab Pages API secret\n\n\n# GitLab Pages auth secret for hashing cookie store
    when using access control\n\n\n# GitLab Pages OAuth secret\n\n\n\n\n# Registry
    certificates\nmkdir -p certs\nopenssl req -new -newkey rsa:4096 -subj \"/CN=gitlab-issuer\"
    -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt
    -days 3650\ngenerate_secret_if_needed \"RELEASE-NAME-registry-secret\" --from-file=registry-auth.key=certs/registry-example-com.key
    --from-file=registry-auth.crt=certs/registry-example-com.crt\n\n# config/secrets.yaml\nif
    [ -n \"$env\" ]; then\n  rails_secret=\"RELEASE-NAME-rails-secret\"\n\n  # Fetch
    the values from the existing secret if it exists\n  if $(kubectl --namespace=$namespace
    get secret $rails_secret > /dev/null 2>&1); then\n    kubectl --namespace=$namespace
    get secret $rails_secret -o jsonpath=\"{.data.secrets\\.yml}\" | base64 --decode
    > secrets.yml\n    secret_key_base=$(fetch_rails_value secrets.yml \"${env}.secret_key_base\")\n
    \   otp_key_base=$(fetch_rails_value secrets.yml \"${env}.otp_key_base\")\n    db_key_base=$(fetch_rails_value
    secrets.yml \"${env}.db_key_base\")\n    openid_connect_signing_key=$(fetch_rails_value
    secrets.yml \"${env}.openid_connect_signing_key\")\n    ci_jwt_signing_key=$(fetch_rails_value
    secrets.yml \"${env}.ci_jwt_signing_key\")\n    encrypted_settings_key_base=$(fetch_rails_value
    secrets.yml \"${env}.encrypted_settings_key_base\")\n  fi;\n\n  # Generate defaults
    for any unset secrets\n  secret_key_base=\"${secret_key_base:-$(gen_random 'a-f0-9'
    128)}\" # equavilent to secureRandom.hex(64)\n  otp_key_base=\"${otp_key_base:-$(gen_random
    'a-f0-9' 128)}\" # equavilent to secureRandom.hex(64)\n  db_key_base=\"${db_key_base:-$(gen_random
    'a-f0-9' 128)}\" # equavilent to secureRandom.hex(64)\n  openid_connect_signing_key=\"${openid_connect_signing_key:-$(openssl
    genrsa 2048)}\"\n  ci_jwt_signing_key=\"${ci_jwt_signing_key:-$(openssl genrsa
    2048)}\"\n  encrypted_settings_key_base=\"${encrypted_settings_key_base:-$(gen_random
    'a-f0-9' 128)}\" # equavilent to secureRandom.hex(64)\n\n  # Update the existing
    secret\n  cat << EOF > rails-secrets.yml\napiVersion: v1\nkind: Secret\nmetadata:\n
    \ name: $rails_secret\ntype: Opaque\nstringData:\n  secrets.yml: |-\n    $env:\n
    \     secret_key_base: $secret_key_base\n      otp_key_base: $otp_key_base\n      db_key_base:
    $db_key_base\n      encrypted_settings_key_base: $encrypted_settings_key_base\n
    \     openid_connect_signing_key: |\n$(echo \"${openid_connect_signing_key}\"
    | awk '{print \"        \" $0}')\n      ci_jwt_signing_key: |\n$(echo \"${ci_jwt_signing_key}\"
    | awk '{print \"        \" $0}')\nEOF\n  kubectl --validate=false --namespace=$namespace
    apply -f rails-secrets.yml\n  label_secret $rails_secret\nfi\n\n# Shell ssh host
    keys\nssh-keygen -A\nmkdir -p host_keys\ncp /etc/ssh/ssh_host_* host_keys/\ngenerate_secret_if_needed
    \"RELEASE-NAME-gitlab-shell-host-keys\" --from-file host_keys\n\n# Gitlab-workhorse
    secret\ngenerate_secret_if_needed \"RELEASE-NAME-gitlab-workhorse-secret\" --from-literal=\"shared_secret\"=$(gen_random
    'a-zA-Z0-9' 32 | base64)\n\n# Registry http.secret secret\ngenerate_secret_if_needed
    \"RELEASE-NAME-registry-httpsecret\" --from-literal=\"secret\"=$(gen_random 'a-z0-9'
    128 | base64 -w 0)\n\n# Container Registry notification_secret\ngenerate_secret_if_needed
    \"RELEASE-NAME-registry-notification\" --from-literal=\"secret\"=[\\\"$(gen_random
    'a-zA-Z0-9' 32)\\\"]\n"
kind: ConfigMap
metadata:
  annotations:
    helm.sh/hook: pre-install,pre-upgrade
    helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation
    helm.sh/hook-weight: "-3"
  labels:
    app: gitlab
    chart: gitlab-5.7.0
    heritage: Helm
    release: RELEASE-NAME
  name: RELEASE-NAME-shared-secrets
  namespace: default
