[Github Action] Check all secrets are replaced by bin/generate-secrets

[pvannierop]

When new secret placeholders are defined in base-secrets.yaml the bin/generate-secrets script (that should replace secret placeholders with randomized values) is sometimes not updated accordingly. This will result in the use of the word secret as a weak password.

This PR will implement a check on the occurrence of the word secret in the secrets.yaml file left after running the bin/generate-secrets script. If detect this will cause the action to fail with a message on which secrets to update.

This PR also updates the generate-secrets script to replace any field with value secret with a password.

Example output:

Not all 'secret' fields were replaced by bin/generate-secrets script. Please make sure to cover the following fields with a 'insert_secret' entry: 
management_portal.smtp.password: secret
fitbit_api_client: "secret"
fitbit_api_secret: "secret"
oura_api_client: "secret"
oura_api_secret: "secret"
radar_push_endpoint.garmin.consumerKey: "secret"
radar_push_endpoint.garmin.consumerSecret: "secret"
velero.backup.accessKey: secret
velero.backup.secretKey: secret

[keyvaann]

Thanks for the PR!
Since these secrets have to be provided via the user it will be a bit confusing if they're generated automatically. I suggest changing their default value to something like change_me and not generating a default value for them.

[pvannierop]

@keyvaann I was just discussing this with @Bdegraaf1234 yesterday. I have updated the PR with the change_me pattern. The commit that added replacement of these external secrets to the generate-secrets script was dropped.

On a side note. Would it not be safer to change the generate-secrets script to change any field that it recognizes with value secret?

[keyvaann]

@keyvaann I was just discussing this with @Bdegraaf1234 yesterday. I have updated the PR with the change_me pattern. The commit that added replacement of these external secrets to the generate-secrets script was dropped.

On a side note. Would it not be safer to change the generate-secrets script to change any field that it recognizes with value secret?

Thanks! Yes if we can add the secrets automatically it would be even better.

[pvannierop]

@keyvaann The generate-secrets script was updated to automatically replace all remaining secret fields.

[keyvaann]

Thanks!
LGTM