netbird: move authSecret out of git into k8s secret (netbird-relay-auth), render via init container

modules/k3s/netbird/config.yaml

@@ -4,7 +4,7 @@ metadata:
   name: netbird-server-config
   namespace: netbird
 data:
-  config.yaml: |
+  config.yaml.tpl: |
     server:
       listenAddress: ":80"
       exposedAddress: "https://netbird.archfox.org:443"
@@ -23,7 +23,7 @@ data:
           domains: []
           email: ""
           awsRoute53: false
-      authSecret: "4bd2ecf3f8be38cd6e640d4eb5f844d8d73c094be7e036b7c6ce1e1b67396e1b"
+      authSecret: "__AUTH_SECRET__"
       dataDir: "/var/lib/netbird/"
       disableAnonymousMetrics: false
       disableGeoliteUpdate: false

modules/k3s/netbird/server.yaml

@@ -13,6 +13,25 @@ spec:
       labels:
         app: netbird-server
     spec:
+      initContainers:
+        - name: render-config
+          image: busybox
+          env:
+            - name: AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-relay-auth
+                  key: authSecret
+          command:
+            - sh
+            - -c
+            - |
+              sed "s|__AUTH_SECRET__|$AUTH_SECRET|g" /tpl/config.yaml.tpl > /etc/netbird/config.yaml
+          volumeMounts:
+            - name: config-tpl
+              mountPath: /tpl
+            - name: config-rendered
+              mountPath: /etc/netbird
       containers:
         - name: netbird-server
           image: netbirdio/netbird-server:latest
@@ -29,14 +48,16 @@ spec:
                   name: netbird-encryption
                   key: encryptionKey
           volumeMounts:
-            - name: config
+            - name: config-rendered
               mountPath: /etc/netbird
             - name: data
               mountPath: /var/lib/netbird
       volumes:
-        - name: config
+        - name: config-tpl
           configMap:
             name: netbird-server-config
+        - name: config-rendered
+          emptyDir: {}
         - name: data
           persistentVolumeClaim:
             claimName: netbird-data