add

deploy/k8s/08-secret-apikey.yaml

@@ -4,10 +4,9 @@
 #   kubectl -n dns create secret generic fancy-dns-apikey \
 #     --from-literal=api-key="$(openssl rand -hex 32)"
 #
-# With auth.mode: apikey and api_keys: ["${FANCYDNS_API_KEY}"] in the config,
-# a missing FANCYDNS_API_KEY is a startup error rather than an empty key, so a
-# forgotten secret shows up as a CrashLoopBackOff and not as an unauthenticated
-# console on the network.
+# With api_keys: ["${FANCYDNS_API_KEY}"] in the config, a missing
+# FANCYDNS_API_KEY is a startup error rather than an empty key. These keys
+# remain available for machine clients when the console uses OIDC.
 apiVersion: v1
 kind: Secret
 metadata: