{{- if not .Values.secrets.existingSecret }}
{{- if not .Values.secrets.sessionSecret }}
{{- fail "Either secrets.sessionSecret must be set or secrets.existingSecret must be specified" }}
{{- end }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "passkey-auth.secretName" . }}
  labels:
    {{- include "passkey-auth.labels" . | nindent 4 }}
type: Opaque
data:
  #  Use openssl rand -base64 32 to generate a secure random string
  session-secret: {{ .Values.secrets.sessionSecret | b64enc | quote }}
{{- end }}
