netbird: move authSecret out of git into k8s secret (netbird-relay-auth), render via init container

modules/k3s/netbird/server.yaml

@@ -13,6 +13,25 @@ spec:
       labels:
         app: netbird-server
     spec:
+      initContainers:
+        - name: render-config
+          image: busybox
+          env:
+            - name: AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-relay-auth
+                  key: authSecret
+          command:
+            - sh
+            - -c
+            - |
+              sed "s|__AUTH_SECRET__|$AUTH_SECRET|g" /tpl/config.yaml.tpl > /etc/netbird/config.yaml
+          volumeMounts:
+            - name: config-tpl
+              mountPath: /tpl
+            - name: config-rendered
+              mountPath: /etc/netbird
       containers:
         - name: netbird-server
           image: netbirdio/netbird-server:latest
@@ -29,14 +48,16 @@ spec:
                   name: netbird-encryption
                   key: encryptionKey
           volumeMounts:
-            - name: config
+            - name: config-rendered
               mountPath: /etc/netbird
             - name: data
               mountPath: /var/lib/netbird
       volumes:
-        - name: config
+        - name: config-tpl
           configMap:
             name: netbird-server-config
+        - name: config-rendered
+          emptyDir: {}
         - name: data
           persistentVolumeClaim:
             claimName: netbird-data