diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644
--- a/files/gitlab-config-template/gitlab.rb.template
+++ b/files/gitlab-config-template/gitlab.rb.template
@@ -2708,6 +2708,13 @@
 ##! Note: We do not recommend changing these values unless absolutely necessary
 # package['systemd_after'] = 'multi-user.target'
 # package['systemd_wanted_by'] = 'multi-user.target'
+
+##! Settings to control secret generation and storage
+##! Note: We do not recommend changing these values unless absolutely necessary
+##! Set to false to only parse secrets from `gitlab-secrets.json` file but not generate them.
+# package['generate_default_secrets'] = true
+##! Set to false to prevent creating `gitlab-secrets.json` file
+# package['generate_secrets_json_file'] = true
 ################################################################################
 ################################################################################
 ##                  Configuration Settings for GitLab EE only                 ##
diff --git a/files/gitlab-cookbooks/gitlab-ee/libraries/suggested_reviewers.rb b/files/gitlab-cookbooks/gitlab-ee/libraries/suggested_reviewers.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItZWUvbGlicmFyaWVzL3N1Z2dlc3RlZF9yZXZpZXdlcnMucmI=..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItZWUvbGlicmFyaWVzL3N1Z2dlc3RlZF9yZXZpZXdlcnMucmI= 100644
--- a/files/gitlab-cookbooks/gitlab-ee/libraries/suggested_reviewers.rb
+++ b/files/gitlab-cookbooks/gitlab-ee/libraries/suggested_reviewers.rb
@@ -1,5 +1,6 @@
 module SuggestedReviewers
   class << self
     def parse_secrets
-      # Suggested Reviewers and GitLab expects exactly 32 bytes, encoded with base64
+      Gitlab['suggested_reviewers']['api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16))
+    end
 
@@ -5,5 +6,8 @@
 
-      Gitlab['suggested_reviewers']['api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16))
+    def validate_secrets
+      return unless Gitlab['suggested_reviewers']['api_secret_key']
+
+      # Suggested Reviewers and GitLab expects exactly 32 bytes, encoded with base64
       api_secret_key = Base64.strict_decode64(Gitlab['suggested_reviewers']['api_secret_key'])
       raise "suggested_reviewers['api_secret_key'] should be exactly 32 bytes" if api_secret_key.length != 32
     end
diff --git a/files/gitlab-cookbooks/gitlab-kas/libraries/gitlab_kas.rb b/files/gitlab-cookbooks/gitlab-kas/libraries/gitlab_kas.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL2xpYnJhcmllcy9naXRsYWJfa2FzLnJi..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL2xpYnJhcmllcy9naXRsYWJfa2FzLnJi 100644
--- a/files/gitlab-cookbooks/gitlab-kas/libraries/gitlab_kas.rb
+++ b/files/gitlab-cookbooks/gitlab-kas/libraries/gitlab_kas.rb
@@ -88,5 +88,7 @@
     end
 
     def parse_secrets
-      # KAS and GitLab expects exactly 32 bytes, encoded with base64
+      Gitlab['gitlab_kas']['api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16))
+      Gitlab['gitlab_kas']['private_api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16))
+    end
 
@@ -92,5 +94,8 @@
 
-      Gitlab['gitlab_kas']['api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16))
-      api_secret_key = Base64.strict_decode64(Gitlab['gitlab_kas']['api_secret_key'])
-      raise "gitlab_kas['api_secret_key'] should be exactly 32 bytes" if api_secret_key.length != 32
+    def validate_secrets
+      if Gitlab['gitlab_kas']['api_secret_key']
+        # KAS and GitLab expects exactly 32 bytes, encoded with base64
+        api_secret_key = Base64.strict_decode64(Gitlab['gitlab_kas']['api_secret_key'])
+        raise "gitlab_kas['api_secret_key'] should be exactly 32 bytes" if api_secret_key.length != 32
+      end
 
@@ -96,5 +101,6 @@
 
-      Gitlab['gitlab_kas']['private_api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16))
+      return unless Gitlab['gitlab_kas']['private_api_secret_key']
+
       private_api_secret_key = Base64.strict_decode64(Gitlab['gitlab_kas']['private_api_secret_key'])
       raise "gitlab_kas['private_api_secret_key'] should be exactly 32 bytes" if private_api_secret_key.length != 32
     end
diff --git a/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb b/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvbGlicmFyaWVzL2dpdGxhYl9wYWdlcy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvbGlicmFyaWVzL2dpdGxhYl9wYWdlcy5yYg== 100644
--- a/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb
+++ b/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb
@@ -17,6 +17,7 @@
 
 require_relative '../../gitlab/libraries/helpers/authorizer_helper'
 require_relative '../../package/libraries/helpers/shell_out_helper'
+require_relative '../../package/libraries/helpers/logging_helper'
 
 module GitlabPages
   class << self
@@ -27,6 +28,7 @@
       parse_pages_external_url
       parse_gitlab_pages_daemon
       parse_secrets
+      parse_automatic_oauth_registration
     end
 
     def parse_pages_external_url
@@ -109,5 +111,10 @@
       Gitlab['gitlab_pages']['auth_secret'] ||= SecretsHelper.generate_hex(64) if Gitlab['gitlab_pages']['access_control']
       Gitlab['gitlab_pages']['gitlab_id'] ||= SecretsHelper.generate_urlsafe_base64
       Gitlab['gitlab_pages']['gitlab_secret'] ||= SecretsHelper.generate_urlsafe_base64
+      Gitlab['gitlab_pages']['api_secret_key'] ||= Base64.strict_encode64(SecureRandom.random_bytes(32))
+    end
+
+    def validate_secrets
+      return unless Gitlab['gitlab_pages']['api_secret_key']
 
       # Pages and GitLab expects exactly 32 bytes, encoded with base64
@@ -112,12 +119,20 @@
 
       # Pages and GitLab expects exactly 32 bytes, encoded with base64
-      if Gitlab['gitlab_pages']['api_secret_key']
-        bytes = Base64.strict_decode64(Gitlab['gitlab_pages']['api_secret_key'])
-        raise "gitlab_pages['api_secret_key'] should be exactly 32 bytes" if bytes.length != 32
-      else
-        bytes = SecureRandom.random_bytes(32)
-        Gitlab['gitlab_pages']['api_secret_key'] = Base64.strict_encode64(bytes)
-      end
+      bytes = Base64.strict_decode64(Gitlab['gitlab_pages']['api_secret_key'])
+      raise "gitlab_pages['api_secret_key'] should be exactly 32 bytes" if bytes.length != 32
+    end
+
+    def parse_automatic_oauth_registration
+      # If GitLab Pages isn't enabled, do nothing.
+      return unless Gitlab['gitlab_pages']['enable']
+
+      # If writing to gitlab-secrets.json file is not explicitly disabled, do
+      # nothing.
+      return if Gitlab['package']['generate_secrets_json_file'] != false
+
+      Gitlab['gitlab_pages']['register_as_oauth_app'] = false
+
+      LoggingHelper.warning("Writing secrets to `gitlab-secrets.json` file is disabled. Hence, not automatically registering GitLab Pages as an Oauth App. So, GitLab SSO will not be available as a login option.")
     end
   end
 end
diff --git a/files/gitlab-cookbooks/gitlab/libraries/gitlab_mattermost.rb b/files/gitlab-cookbooks/gitlab/libraries/gitlab_mattermost.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL2dpdGxhYl9tYXR0ZXJtb3N0LnJi..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL2dpdGxhYl9tYXR0ZXJtb3N0LnJi 100644
--- a/files/gitlab-cookbooks/gitlab/libraries/gitlab_mattermost.rb
+++ b/files/gitlab-cookbooks/gitlab/libraries/gitlab_mattermost.rb
@@ -17,6 +17,7 @@
 
 require_relative 'nginx.rb'
 require_relative '../../package/libraries/deprecations'
+require_relative '../../package/libraries/helpers/logging_helper'
 require_relative '../../letsencrypt/libraries/helper'
 
 module GitlabMattermost
@@ -24,6 +25,7 @@
     def parse_variables
       parse_mattermost_external_url
       parse_gitlab_mattermost
+      parse_automatic_oauth_registration
     end
 
     def parse_secrets
@@ -92,5 +94,18 @@
 
       Gitlab['mattermost_nginx']['enable'] = true if Gitlab['mattermost_nginx']['enable'].nil?
     end
+
+    def parse_automatic_oauth_registration
+      # If Mattermost isn't enabled, do nothing.
+      return unless Gitlab['mattermost']['enable']
+
+      # If writing to gitlab-secrets.json file is not explicitly disabled, do
+      # nothing.
+      return if Gitlab['package']['generate_secrets_json_file'] != false
+
+      Gitlab['mattermost']['register_as_oauth_app'] = false
+
+      LoggingHelper.warning("Writing secrets to `gitlab-secrets.json` file is disabled. Hence, not automatically registering Mattermost as an Oauth App. So, GitLab SSO will not be available as a login option.")
+    end
   end
 end
diff --git a/files/gitlab-cookbooks/gitlab/libraries/gitlab_rails.rb b/files/gitlab-cookbooks/gitlab/libraries/gitlab_rails.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL2dpdGxhYl9yYWlscy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL2dpdGxhYl9yYWlscy5yYg== 100644
--- a/files/gitlab-cookbooks/gitlab/libraries/gitlab_rails.rb
+++ b/files/gitlab-cookbooks/gitlab/libraries/gitlab_rails.rb
@@ -53,7 +53,15 @@
       parse_repository_storage
     end
 
-    # rubocop:disable Metrics/AbcSize
-    # rubocop:disable Metrics/CyclomaticComplexity
-    # rubocop:disable Metrics/PerceivedComplexity
+    def transform_secrets
+      # Transform legacy key names to new key names
+      Gitlab['gitlab_rails']['db_key_base'] ||= Gitlab['gitlab_ci']['db_key_base'] # Changed in 8.11
+      Gitlab['gitlab_rails']['secret_key_base'] ||= Gitlab['gitlab_ci']['db_key_base'] # Changed in 8.11
+      Gitlab['gitlab_rails']['otp_key_base'] ||= Gitlab['gitlab_rails']['secret_token']
+      Gitlab['gitlab_rails']['openid_connect_signing_key'] ||= Gitlab['gitlab_rails']['jws_private_key'] # Changed in 10.1
+
+      # Environment variable gets priority over gitlab.rb setting
+      Gitlab['gitlab_rails']['initial_root_password'] = ENV['GITLAB_ROOT_PASSWORD'] || Gitlab['gitlab_rails']['initial_root_password']
+    end
+
     def parse_secrets
@@ -59,4 +67,23 @@
     def parse_secrets
+      transform_secrets
+
+      # Note: If you add another secret to generate here make sure it gets written to disk in SecretsHelper.write_to_gitlab_secrets
+      Gitlab['gitlab_rails']['db_key_base'] ||= SecretsHelper.generate_hex(64)
+      Gitlab['gitlab_rails']['secret_key_base'] ||= SecretsHelper.generate_hex(64)
+      Gitlab['gitlab_rails']['otp_key_base'] ||= SecretsHelper.generate_hex(64)
+      Gitlab['gitlab_rails']['encrypted_settings_key_base'] ||= SecretsHelper.generate_hex(64)
+      Gitlab['gitlab_rails']['openid_connect_signing_key'] ||= SecretsHelper.generate_rsa(4096).to_pem
+      Gitlab['gitlab_rails']['ci_jwt_signing_key'] ||= SecretsHelper.generate_rsa(4096).to_pem
+
+      return unless Gitlab['gitlab_rails']['initial_root_password'].nil?
+
+      Gitlab['gitlab_rails']['initial_root_password'] = SecretsHelper.generate_base64(32)
+      Gitlab['gitlab_rails']['store_initial_root_password'] = true if Gitlab['gitlab_rails']['store_initial_root_password'].nil?
+    end
+
+    def validate_secrets
+      transform_secrets
+
       # Blow up when the existing configuration is ambiguous, so we don't accidentally throw away important secrets
       ci_db_key_base = Gitlab['gitlab_ci']['db_key_base']
       rails_db_key_base = Gitlab['gitlab_rails']['db_key_base']
@@ -71,9 +98,5 @@
         raise message.join("\n\n")
       end
 
-      # Transform legacy key names to new key names
-      Gitlab['gitlab_rails']['db_key_base'] ||= Gitlab['gitlab_ci']['db_key_base'] # Changed in 8.11
-      Gitlab['gitlab_rails']['secret_key_base'] ||= Gitlab['gitlab_ci']['db_key_base'] # Changed in 8.11
-      Gitlab['gitlab_rails']['otp_key_base'] ||= Gitlab['gitlab_rails']['secret_token']
-      Gitlab['gitlab_rails']['openid_connect_signing_key'] ||= Gitlab['gitlab_rails']['jws_private_key'] # Changed in 10.1
+      raise 'initial_root_password: Length is too short, minimum is 8 characters' if Gitlab['gitlab_rails']['initial_root_password'] && Gitlab['gitlab_rails']['initial_root_password'].length < 8
 
@@ -79,8 +102,3 @@
 
-      # Note: If you add another secret to generate here make sure it gets written to disk in SecretsHelper.write_to_gitlab_secrets
-      Gitlab['gitlab_rails']['db_key_base'] ||= SecretsHelper.generate_hex(64)
-      Gitlab['gitlab_rails']['secret_key_base'] ||= SecretsHelper.generate_hex(64)
-      Gitlab['gitlab_rails']['otp_key_base'] ||= SecretsHelper.generate_hex(64)
-      Gitlab['gitlab_rails']['encrypted_settings_key_base'] ||= SecretsHelper.generate_hex(64)
-      Gitlab['gitlab_rails']['openid_connect_signing_key'] ||= SecretsHelper.generate_rsa(4096).to_pem
+      return unless Gitlab['gitlab_rails']['ci_jwt_signing_key']
 
@@ -86,20 +104,8 @@
 
-      Gitlab['gitlab_rails']['initial_root_password'] = ENV['GITLAB_ROOT_PASSWORD'] || Gitlab['gitlab_rails']['initial_root_password']
-      if Gitlab['gitlab_rails']['initial_root_password'].nil?
-        Gitlab['gitlab_rails']['initial_root_password'] = SecretsHelper.generate_base64(32)
-        Gitlab['gitlab_rails']['store_initial_root_password'] = true if Gitlab['gitlab_rails']['store_initial_root_password'].nil?
-      elsif Gitlab['gitlab_rails']['initial_root_password'].length < 8
-        raise 'initial_root_password: Length is too short, minimum is 8 characters'
-      end
-
-      if Gitlab['gitlab_rails']['ci_jwt_signing_key']
-        begin
-          key = OpenSSL::PKey::RSA.new(Gitlab['gitlab_rails']['ci_jwt_signing_key'])
-          raise 'ci_jwt_signing_key: The provided key is not private RSA key' unless key.private?
-        rescue OpenSSL::PKey::RSAError
-          raise 'ci_jwt_signing_key: The provided key is not valid RSA key'
-        end
-      else
-        Gitlab['gitlab_rails']['ci_jwt_signing_key'] ||= SecretsHelper.generate_rsa(4096).to_pem
+      begin
+        key = OpenSSL::PKey::RSA.new(Gitlab['gitlab_rails']['ci_jwt_signing_key'])
+        raise 'ci_jwt_signing_key: The provided key is not private RSA key' unless key.private?
+      rescue OpenSSL::PKey::RSAError
+        raise 'ci_jwt_signing_key: The provided key is not valid RSA key'
       end
     end
@@ -104,8 +110,5 @@
       end
     end
-    # rubocop:enable Metrics/AbcSize
-    # rubocop:enable Metrics/CyclomaticComplexity
-    # rubocop:enable Metrics/PerceivedComplexity
 
     def parse_external_url
       return unless Gitlab['external_url']
diff --git a/files/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb b/files/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9saWJyYXJpZXMvbGV0c19lbmNyeXB0LnJi..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9saWJyYXJpZXMvbGV0c19lbmNyeXB0LnJi 100644
--- a/files/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb
+++ b/files/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb
@@ -14,6 +14,8 @@
 # limitations under the License.
 #
 
+require_relative '../../package/libraries/helpers/logging_helper'
+
 class LetsEncrypt
   class << self
     def parse_variables
@@ -28,6 +30,11 @@
       # else leave it alone.
       return unless Gitlab['letsencrypt']['enable'].nil?
 
+      if should_auto_enable? && Gitlab['package']['generate_secrets_json_file'] == false
+        LoggingHelper.warning("Writing secrets to `gitlab-secrets.json` file is disabled. Hence, not automatically enabling Let's Encrypt integration.")
+        return
+      end
+
       # We get to make a 'guess' as to if we should enable based on other parsed
       # values
       Gitlab['letsencrypt']['enable'] = should_auto_enable?
diff --git a/files/gitlab-cookbooks/monitoring/libraries/grafana.rb b/files/gitlab-cookbooks/monitoring/libraries/grafana.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL2xpYnJhcmllcy9ncmFmYW5hLnJi..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL2xpYnJhcmllcy9ncmFmYW5hLnJi 100644
--- a/files/gitlab-cookbooks/monitoring/libraries/grafana.rb
+++ b/files/gitlab-cookbooks/monitoring/libraries/grafana.rb
@@ -15,6 +15,8 @@
 # limitations under the License.
 #
 
+require_relative '../../package/libraries/helpers/logging_helper'
+
 module Grafana
   class << self
     def parse_secrets
@@ -30,6 +32,7 @@
     def parse_variables
       disable_unless_forced
       parse_grafana_datasources
+      parse_automatic_oauth_registration
     end
 
     def disable_unless_forced
@@ -63,5 +66,18 @@
 
       Gitlab['grafana']['datasources'] = datasources
     end
+
+    def parse_automatic_oauth_registration
+      # If Grafana isn't enabled, do nothing.
+      return unless Gitlab['grafana']['enable'] && Gitlab['grafana']['enable_deprecated_service']
+
+      # If writing to gitlab-secrets.json file is not explicitly disabled, do
+      # nothing.
+      return if Gitlab['package']['generate_secrets_json_file'] != false
+
+      Gitlab['grafana']['register_as_oauth_app'] = false
+
+      LoggingHelper.warning("Writing secrets to `gitlab-secrets.json` file is disabled. Hence, not automatically registering Grafana as an Oauth App. So, GitLab SSO will not be available as a login option.")
+    end
   end
 end
diff --git a/files/gitlab-cookbooks/package/attributes/default.rb b/files/gitlab-cookbooks/package/attributes/default.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2F0dHJpYnV0ZXMvZGVmYXVsdC5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2F0dHJpYnV0ZXMvZGVmYXVsdC5yYg== 100644
--- a/files/gitlab-cookbooks/package/attributes/default.rb
+++ b/files/gitlab-cookbooks/package/attributes/default.rb
@@ -26,6 +26,9 @@
 default['package']['systemd_wanted_by'] = 'multi-user.target'
 default['package']['systemd_after'] = 'multi-user.target'
 
+default['package']['generate_default_secrets'] = true
+default['package']['generate_secrets_json_file'] = true
+
 # We only want to generate the public attributes file on specific calls to Chef.
 # Normally, you will not want to change this
 default['package']['public_attributes'] = false
diff --git a/files/gitlab-cookbooks/package/libraries/settings_dsl.rb b/files/gitlab-cookbooks/package/libraries/settings_dsl.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9zZXR0aW5nc19kc2wucmI=..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9zZXR0aW5nc19kc2wucmI= 100644
--- a/files/gitlab-cookbooks/package/libraries/settings_dsl.rb
+++ b/files/gitlab-cookbooks/package/libraries/settings_dsl.rb
@@ -202,4 +202,5 @@
   def generate_secrets(node_name)
     # guards against creating secrets on non-bootstrap node
     SecretsHelper.read_gitlab_secrets
+    generate_default_secrets = Gitlab['package']['generate_default_secrets'] != false
 
@@ -205,4 +206,5 @@
 
+    Chef::Log.info("Generating default secrets") if generate_default_secrets
     # Parse secrets using the handlers
     sorted_settings.each do |_key, value|
       handler = value.handler
@@ -206,6 +208,7 @@
     # Parse secrets using the handlers
     sorted_settings.each do |_key, value|
       handler = value.handler
-      handler.parse_secrets if handler.respond_to?(:parse_secrets)
+      handler.parse_secrets if handler.respond_to?(:parse_secrets) && generate_default_secrets
+      handler.validate_secrets if handler.respond_to?(:validate_secrets)
     end
 
@@ -210,6 +213,18 @@
     end
 
-    SecretsHelper.write_to_gitlab_secrets
+    if Gitlab['package']['generate_secrets_json_file'] == false
+      return unless generate_default_secrets
+
+      warning_message = <<~EOS
+        You've enabled generating default secrets but have disabled writing them to gitlab-secrets.json file.
+        This results in secrets not persisting across `gitlab-ctl reconfigure` runs and can cause issues with functionality.
+      EOS
+
+      LoggingHelper.warning(warning_message)
+    else
+      Chef::Log.info("Generating gitlab-secrets.json file")
+      SecretsHelper.write_to_gitlab_secrets
+    end
   end
 
   def generate_config(node_name)
diff --git a/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb b/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWItcGFnZXMvcmVjaXBlcy9naXRsYWItcGFnZXNfc3BlYy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWItcGFnZXMvcmVjaXBlcy9naXRsYWItcGFnZXNfc3BlYy5yYg== 100644
--- a/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb
+++ b/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb
@@ -147,6 +147,28 @@
           }
         end
       end
+
+      context 'when generating gitlab-secrets.json file is disabled' do
+        before do
+          stub_gitlab_rb(
+            package: {
+              generate_secrets_json_file: false
+            }
+          )
+
+          allow(LoggingHelper).to receive(:warning).and_call_original
+        end
+
+        it 'does not register as an oauth app with GitLab' do
+          expect(chef_run).not_to run_ruby_block('authorize pages with gitlab')
+        end
+
+        it 'displays a warning about disabling automatic oauth registration' do
+          expect(LoggingHelper).to receive(:warning).with(/not automatically registering GitLab Pages as an Oauth App/)
+
+          chef_run
+        end
+      end
     end
 
     context 'with custom port' do
diff --git a/spec/chef/cookbooks/gitlab/libraries/suggested_reviewers_spec.rb b/spec/chef/cookbooks/gitlab/libraries/suggested_reviewers_spec.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL3N1Z2dlc3RlZF9yZXZpZXdlcnNfc3BlYy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL3N1Z2dlc3RlZF9yZXZpZXdlcnNfc3BlYy5yYg== 100644
--- a/spec/chef/cookbooks/gitlab/libraries/suggested_reviewers_spec.rb
+++ b/spec/chef/cookbooks/gitlab/libraries/suggested_reviewers_spec.rb
@@ -1,7 +1,4 @@
-# This spec is to test the Redis helper and whether the values parsed
-# are the ones we expect
-require 'spec_helper'
 require 'chef_helper'
 
 RSpec.describe SuggestedReviewers do
   describe '.parse_secrets' do
@@ -4,9 +1,7 @@
 require 'chef_helper'
 
 RSpec.describe SuggestedReviewers do
   describe '.parse_secrets' do
-    let(:some_hex) { '4ecd22c031fee5c7368a5a102f76dc41' }
-
-    subject { described_class.parse_secrets }
+    let(:chef_run) { converge_config(is_ee: true) }
 
     before do
@@ -11,6 +6,14 @@
 
     before do
-      allow(Gitlab).to receive(:[]).and_return({ 'suggested_reviewers': [] })
-      allow(SecretsHelper).to receive(:generate_hex).and_return(some_hex)
+      allow(SecretsHelper).to receive(:generate_hex).and_return('4ecd22c031fee5c7368a5a102f76dc41')
+      allow(Gitlab).to receive(:[]).and_call_original
+    end
+
+    context 'by default' do
+      it 'generates a secret' do
+        node = chef_run.node
+
+        expect(node['gitlab']['suggested_reviewers']['api_secret_key']).to eq('NGVjZDIyYzAzMWZlZTVjNzM2OGE1YTEwMmY3NmRjNDE=')
+      end
     end
 
@@ -15,6 +18,15 @@
     end
 
-    it 'raises no length error' do
-      expect { subject }.not_to raise_error
-    end
+    context 'with user specified values' do
+      context 'of sufficient length' do
+        before do
+          stub_gitlab_rb(
+            suggested_reviewers: {
+              api_secret_key: 'NTliMjc2ZDkxMTZhZGZiZGE4ZWEzODI3NTczODQ5ZjI='
+            }
+          )
+        end
+
+        it 'uses the specified value' do
+          node = chef_run.node
 
@@ -20,4 +32,5 @@
 
-    context 'secret key length is wrong' do
-      let(:some_hex) { '123456' }
+          expect(node['gitlab']['suggested_reviewers']['api_secret_key']).to eq('NTliMjc2ZDkxMTZhZGZiZGE4ZWEzODI3NTczODQ5ZjI=')
+        end
+      end
 
@@ -23,6 +36,16 @@
 
-      it 'raises no length error' do
-        expect { subject }.to raise_error "suggested_reviewers['api_secret_key'] should be exactly 32 bytes"
+      context 'of insufficient length' do
+        before do
+          stub_gitlab_rb(
+            suggested_reviewers: {
+              api_secret_key: 'MTIzNDU2'
+            }
+          )
+        end
+
+        it 'raises an error' do
+          expect { chef_run }.to raise_error.with_message("suggested_reviewers['api_secret_key'] should be exactly 32 bytes")
+        end
       end
     end
   end
diff --git a/spec/chef/cookbooks/mattermost/recipes/mattermost_spec.rb b/spec/chef/cookbooks/mattermost/recipes/mattermost_spec.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9tYXR0ZXJtb3N0L3JlY2lwZXMvbWF0dGVybW9zdF9zcGVjLnJi..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9tYXR0ZXJtb3N0L3JlY2lwZXMvbWF0dGVybW9zdF9zcGVjLnJi 100644
--- a/spec/chef/cookbooks/mattermost/recipes/mattermost_spec.rb
+++ b/spec/chef/cookbooks/mattermost/recipes/mattermost_spec.rb
@@ -314,4 +314,34 @@
       end
     end
   end
+
+  describe 'registering as an OAuth app with GitLab' do
+    context 'by default when Mattermost is enabled' do
+      it 'registers as an oauth app with GitLab' do
+        expect(chef_run).to run_ruby_block('authorize mattermost with gitlab')
+      end
+    end
+
+    context 'when generating gitlab-secrets.json file is disabled' do
+      before do
+        stub_gitlab_rb(
+          package: {
+            generate_secrets_json_file: false
+          }
+        )
+
+        allow(LoggingHelper).to receive(:warning).and_call_original
+      end
+
+      it 'does not register as an oauth app with GitLab' do
+        expect(chef_run).not_to run_ruby_block('authorize mattermost with gitlab')
+      end
+
+      it 'displays a warning about disabling automatic oauth registration' do
+        expect(LoggingHelper).to receive(:warning).with(/not automatically registering Mattermost as an Oauth App/)
+
+        chef_run
+      end
+    end
+  end
 end
diff --git a/spec/chef/cookbooks/monitoring/recipes/grafana_spec.rb b/spec/chef/cookbooks/monitoring/recipes/grafana_spec.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ3JhZmFuYV9zcGVjLnJi..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ3JhZmFuYV9zcGVjLnJi 100644
--- a/spec/chef/cookbooks/monitoring/recipes/grafana_spec.rb
+++ b/spec/chef/cookbooks/monitoring/recipes/grafana_spec.rb
@@ -120,6 +120,49 @@
       expect(chef_run).to render_file('/var/opt/gitlab/grafana/provisioning/datasources/gitlab_datasources.yml')
         .with_content(default_datasources_yml_output)
     end
+
+    describe 'registering as an OAuth app with GitLab' do
+      context 'by default Grafana is enabled' do
+        before do
+          stub_gitlab_rb(
+            grafana: {
+              enable: true,
+              enable_deprecated_service: true
+            }
+          )
+        end
+
+        it 'registers as an oauth app with GitLab' do
+          expect(chef_run).to run_ruby_block('authorize Grafana with GitLab')
+        end
+      end
+
+      context 'when generating gitlab-secrets.json file is disabled' do
+        before do
+          stub_gitlab_rb(
+            grafana: {
+              enable: true,
+              enable_deprecated_service: true
+            },
+            package: {
+              generate_secrets_json_file: false
+            }
+          )
+
+          allow(LoggingHelper).to receive(:warning).and_call_original
+        end
+
+        it 'does not register as an oauth app with GitLab' do
+          expect(chef_run).not_to run_ruby_block('authorize Grafana with gitlab')
+        end
+
+        it 'displays a warning about disabling automatic oauth registration' do
+          expect(LoggingHelper).to receive(:warning).with(/not automatically registering Grafana as an Oauth App/)
+
+          chef_run
+        end
+      end
+    end
   end
 
   context 'when grafana is enabled (forced) and prometheus is disabled' do
@@ -156,25 +199,6 @@
     end
   end
 
-  it 'authorizes Grafana with gitlab' do
-    stub_gitlab_rb(
-      external_url: 'http://gitlab.example.com',
-      grafana: {
-        enable: true,
-        enable_deprecated_service: true
-      }
-    )
-
-    allow(GrafanaHelper).to receive(:authorize_with_gitlab)
-
-    expect(chef_run).to run_ruby_block('authorize Grafana with GitLab')
-      .at_converge_time
-    expect(GrafanaHelper).to receive(:authorize_with_gitlab)
-      .with 'http://gitlab.example.com'
-
-    chef_run.ruby_block('authorize Grafana with GitLab').block.call
-  end
-
   context 'with user provided settings' do
     before do
       stub_gitlab_rb(
diff --git a/spec/chef/cookbooks/package/libraries/settings_dsl_spec.rb b/spec/chef/cookbooks/package/libraries/settings_dsl_spec.rb
index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9zZXR0aW5nc19kc2xfc3BlYy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9zZXR0aW5nc19kc2xfc3BlYy5yYg== 100644
--- a/spec/chef/cookbooks/package/libraries/settings_dsl_spec.rb
+++ b/spec/chef/cookbooks/package/libraries/settings_dsl_spec.rb
@@ -70,4 +70,80 @@
       end
     end
   end
+
+  describe 'secrets generation' do
+    let(:chef_run) { ChefSpec::SoloRunner.new.converge('gitlab::default') }
+
+    before do
+      allow(Gitlab).to receive(:[]).and_call_original
+    end
+
+    describe 'default secrets' do
+      context 'by default' do
+        it 'generates default secrets' do
+          expect(GitlabRails).to receive(:parse_secrets)
+
+          chef_run
+        end
+      end
+
+      context 'when explicitly disabled' do
+        before do
+          stub_gitlab_rb(
+            package: {
+              generate_default_secrets: false
+            }
+          )
+        end
+
+        it 'does not generate default secrets' do
+          expect(GitlabRails).not_to receive(:parse_secrets)
+
+          chef_run
+        end
+      end
+    end
+
+    describe 'gitlab-secrets.json file' do
+      let(:file) { double(:file, puts: true, chmod: true) }
+
+      before do
+        allow(::File).to receive(:directory?).and_call_original
+        allow(::File).to receive(:directory?).with('/etc/gitlab').and_return(true)
+        allow(::File).to receive(:open).with('/etc/gitlab/gitlab-secrets.json', 'w', 0600).and_yield(file).once
+      end
+
+      context 'by default' do
+        it 'generates gitlab-secrets.json file' do
+          expect(::File).to receive(:open).with('/etc/gitlab/gitlab-secrets.json', 'w', 0600)
+
+          chef_run
+        end
+      end
+
+      context 'when explicitly disabled' do
+        before do
+          stub_gitlab_rb(
+            package: {
+              generate_secrets_json_file: false
+            }
+          )
+
+          allow(LoggingHelper).to receive(:warning).and_call_original
+        end
+
+        it 'does not generate gitlab-secrets.json file' do
+          expect(::File).not_to receive(:open).with('/etc/gitlab/gitlab-secrets.json', 'w', 0600)
+
+          chef_run
+        end
+
+        it 'generates warning about secrets not persisting' do
+          expect(LoggingHelper).to receive(:warning).with(/You've enabled generating default secrets but have disabled writing them to gitlab-secrets.json file/)
+
+          chef_run
+        end
+      end
+    end
+  end
 end