Location of Hetzner Secret

[christianhuth]

/kind feature

Describe the solution you'd like
Currently the Secret for accessing hetzner is automatically created in the kube-system namespace. I would like to be able to configure the namespace where the Secret is getting created.

Probably the attribute should be part of the HetznerCluster specification.

Suggestion:

hetznerSecretInWorkloadCluster:
  create: true <-- could become the successor to skipCreatingHetznerSecretInWorkloadCluster
  name: hetzner
  namespace: kube-sytem

[janiskemper]

Thanks for the feature request!

I believe that we have two options:
a) add a new struct, as you suggested, which also contains the existing boolean skipCreatingHetznerSecretInWorkloadCluster
b) add a new property next to the boolean

Right now, b) would be easier. We could then make the API in a potential v1beta2 API more concise. However, since there are no concrete plans in that direction, we could also argue that it makes sense to deprecate that boolean and to add a new struct.

@batistein @guettli what are your opinions?

[guettli]

Yes, looks good to me.

@christianhuth Can you give me your goal why you want to put the secret into a different namespace?

[christianhuth]

@guettli: Installing the hcloud-ccm and hcloud-csi charts into another namespace than kube-system.

[janiskemper]

And which of the two ways would you guys prefer @guettli @batistein ?

[guettli]

@janiskemper

I would prefer:

skipCreatingHetznerSecretInWorkloadCluster: false # (unchanged)

# new
hetznerSecretInWorkloadCluster:
  name: hetzner
  namespace: kube-sytem

We can add validation, that if skipCreatingHetznerSecretInWorkloadCluster is true, hetznerSecretInWorkloadCluster must not be set.