From 6e7efd7f88f56c18e6e95b9039fdf744bb663097 Mon Sep 17 00:00:00 2001
From: Ben Konicek <ben.konicek@gmail.com>
Date: Fri, 2 Oct 2026 14:54:33 -0400
Subject: [PATCH] Split AUTH_SECRET into its own ExternalSecret for
 group-wishlist

The Password generator backing AUTH_SECRET re-ran on every
refreshInterval tick of the combined app-secrets ExternalSecret,
rotating the value hourly under already-running pods and
invalidating every active session. Giving it a dedicated
ExternalSecret with refreshInterval: 0 generates it once, while
app-secrets keeps syncing the 1Password-sourced Google OAuth
creds normally.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../templates/externalsecret-app-secrets.yaml |  6 ------
 .../templates/externalsecret-auth-secret.yaml | 21 +++++++++++++++++++
 2 files changed, 21 insertions(+), 6 deletions(-)
 create mode 100644 charts/group-wishlist/templates/externalsecret-auth-secret.yaml

diff --git a/charts/group-wishlist/templates/externalsecret-app-secrets.yaml b/charts/group-wishlist/templates/externalsecret-app-secrets.yaml
index 7d22600..c55e3fa 100644
--- a/charts/group-wishlist/templates/externalsecret-app-secrets.yaml
+++ b/charts/group-wishlist/templates/externalsecret-app-secrets.yaml
@@ -11,14 +11,8 @@ spec:
     template:
       type: Opaque
       data:
-        AUTH_SECRET: "{{ "{{" }} .authSecretRaw | b64enc {{ "}}" }}"
         AUTH_GOOGLE_ID: "{{ "{{" }} .AUTH_GOOGLE_ID {{ "}}" }}"
         AUTH_GOOGLE_SECRET: "{{ "{{" }} .AUTH_GOOGLE_SECRET {{ "}}" }}"
   dataFrom:
-    - sourceRef:
-        generatorRef:
-          apiVersion: generators.external-secrets.io/v1alpha1
-          kind: Password
-          name: auth-secret
     - extract:
         key: group-wishlist-config
diff --git a/charts/group-wishlist/templates/externalsecret-auth-secret.yaml b/charts/group-wishlist/templates/externalsecret-auth-secret.yaml
new file mode 100644
index 0000000..feea05b
--- /dev/null
+++ b/charts/group-wishlist/templates/externalsecret-auth-secret.yaml
@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: auth-secret
+spec:
+  refreshInterval: 0
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: 1password
+  target:
+    name: auth-secret
+    template:
+      type: Opaque
+      data:
+        AUTH_SECRET: "{{ "{{" }} .authSecretRaw | b64enc {{ "}}" }}"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: auth-secret