cluster should get secrets from secrets repo