From d2d2132ac079170f3200f262bf1644506f54e22d Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 14:31:57 +0200
Subject: [PATCH 01/13] lower Jetstream retention & deduplication window

---
 internal/aggregator/nats.go | 4 ++--
 internal/irc-reader/nats.go | 7 +++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/internal/aggregator/nats.go b/internal/aggregator/nats.go
index 3c15742..43abb51 100644
--- a/internal/aggregator/nats.go
+++ b/internal/aggregator/nats.go
@@ -113,11 +113,11 @@ func (s *Service) ensureStream(js nats.JetStreamContext) error {
 	cfg := &nats.StreamConfig{
 		Name:      s.cfg.Nats.Stream,
 		Subjects:  []string{s.cfg.Nats.Topic.Raw + ".>"},
-		MaxAge:    12 * time.Hour,
+		MaxAge:    1 * time.Hour,
 		Retention: nats.InterestPolicy,
 		Discard:   nats.DiscardNew,
 		// TODO: 0 seconds sets this to default value (2 min), find optimal value for our case
-		Duplicates: 0 * time.Second,
+		Duplicates: 1 * time.Minute,
 	}
 
 	_, err := js.StreamInfo(cfg.Name)
diff --git a/internal/irc-reader/nats.go b/internal/irc-reader/nats.go
index 03d88b4..53e9a86 100644
--- a/internal/irc-reader/nats.go
+++ b/internal/irc-reader/nats.go
@@ -3,7 +3,6 @@ package irc_reader
 import (
 	"encoding/json"
 	"errors"
-	"fmt"
 	"time"
 
 	"github.com/nats-io/nats.go"
@@ -19,12 +18,12 @@ import (
 func (c *Controller) ensureStream(js nats.JetStreamContext) error {
 	cfg := &nats.StreamConfig{
 		Name:      c.cfg.Nats.Stream,
-		Subjects:  []string{fmt.Sprintf("%v.>", c.cfg.Nats.Topic.Raw)},
-		MaxAge:    12 * time.Hour,
+		Subjects:  []string{c.cfg.Nats.Topic.Raw + ".>"},
+		MaxAge:    1 * time.Hour,
 		Retention: nats.InterestPolicy,
 		Discard:   nats.DiscardNew,
 		// TODO: 0 seconds sets this to default value (2 min), find optimal value for our case
-		Duplicates: 0 * time.Second,
+		Duplicates: 1 * time.Minute,
 	}
 
 	_, err := js.StreamInfo(cfg.Name)

From a8d9357521b3e583f36dc0512e98600de35b1f1e Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 14:32:37 +0200
Subject: [PATCH 02/13] increase aggregator resources

---
 terraform/aggregator/aggregator.tf | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/terraform/aggregator/aggregator.tf b/terraform/aggregator/aggregator.tf
index 8b74bfa..5ed795d 100644
--- a/terraform/aggregator/aggregator.tf
+++ b/terraform/aggregator/aggregator.tf
@@ -46,6 +46,7 @@ resource "kubernetes_deployment" "app" {
     name      = "stats-aggregator"
     namespace = data.kubernetes_namespace.app.metadata[0].name
     labels    = {
+      k8slens-edit-resource-version = "v1"
       app = "stats-aggregator"
     }
   }
@@ -67,7 +68,7 @@ resource "kubernetes_deployment" "app" {
       }
     }
 
-    replicas = 5
+    replicas = 4
 
     template {
       metadata {
@@ -84,13 +85,13 @@ resource "kubernetes_deployment" "app" {
 
           resources {
             limits = {
-              cpu    = "500m"
-              memory = "1.25Gi"
+              cpu    = "2"
+              memory = "2Gi"
             }
 
             requests = {
               cpu    = "10m"
-              memory = "1Gi"
+              memory = "2Gi"
             }
           }
 

From 8ae33b2e0706813db76fa379532e29bf208b1e29 Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 14:54:32 +0200
Subject: [PATCH 03/13] periodically clear expired cache from aggregator

---
 internal/aggregator/emote.go   | 19 +++++++++++++++++++
 internal/aggregator/service.go |  2 ++
 2 files changed, 21 insertions(+)

diff --git a/internal/aggregator/emote.go b/internal/aggregator/emote.go
index bb650e2..f20c7c1 100644
--- a/internal/aggregator/emote.go
+++ b/internal/aggregator/emote.go
@@ -56,6 +56,25 @@ type emoteCache struct {
 	emotes  []model.ActiveEmoteModel
 }
 
+func initCache() {
+	go func() {
+		for range time.Tick(1 * time.Minute) {
+			cleanCache()
+		}
+	}()
+}
+
+func cleanCache() {
+	mx.Lock()
+	defer mx.Unlock()
+
+	for channelID, cache := range activeEmotesCache {
+		if time.Since(cache.expires) > 0 {
+			delete(activeEmotesCache, channelID)
+		}
+	}
+}
+
 func getEmotesForChannel(channelID string) ([]model.ActiveEmoteModel, error) {
 	mx.Lock()
 	defer mx.Unlock()
diff --git a/internal/aggregator/service.go b/internal/aggregator/service.go
index 40467ca..b61fcad 100644
--- a/internal/aggregator/service.go
+++ b/internal/aggregator/service.go
@@ -38,5 +38,7 @@ func (s *Service) Init() error {
 		},
 	)
 	emotedb.SetCollections(coll)
+
+	initCache()
 	return s.subscribe(context.TODO(), s.handleMessage)
 }

From a205131233571c5164ef0ad49773754cb105bb96 Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 15:06:51 +0200
Subject: [PATCH 04/13] reduce amount of data cached by aggregator

---
 internal/aggregator/emote.go  | 45 +++++++++++++++++++++++++++++------
 pkg/database/emotes/emotes.go | 13 ++++------
 pkg/types/emote.go            | 15 ++++++++++--
 3 files changed, 56 insertions(+), 17 deletions(-)

diff --git a/internal/aggregator/emote.go b/internal/aggregator/emote.go
index f20c7c1..2f0913a 100644
--- a/internal/aggregator/emote.go
+++ b/internal/aggregator/emote.go
@@ -53,7 +53,7 @@ var mx = sync.Mutex{}
 
 type emoteCache struct {
 	expires time.Time
-	emotes  []model.ActiveEmoteModel
+	emotes  []types.Emote
 }
 
 func initCache() {
@@ -75,7 +75,7 @@ func cleanCache() {
 	}
 }
 
-func getEmotesForChannel(channelID string) ([]model.ActiveEmoteModel, error) {
+func getEmotesForChannel(channelID string) ([]types.Emote, error) {
 	mx.Lock()
 	defer mx.Unlock()
 
@@ -85,19 +85,34 @@ func getEmotesForChannel(channelID string) ([]model.ActiveEmoteModel, error) {
 			return cache.emotes, nil
 		}
 	}
-	emotes, err := getEmotesByChannelId(channelID)
+	response, err := getEmotesByChannelId(channelID)
 	if err != nil {
 		if errors.Is(err, ErrEmotesNotEnabled) {
 			// set empty slice, so we don't spam the API with requests in the future
 			activeEmotesCache[channelID] = emoteCache{
-				emotes:  []model.ActiveEmoteModel{},
+				emotes:  []types.Emote{},
 				expires: time.Now().Add(5 * time.Minute),
 			}
-			return []model.ActiveEmoteModel{}, nil
+			return []types.Emote{}, nil
 		}
 		return nil, err
 	}
 
+	// convert response to save some memory
+	var emotes []types.Emote
+	for _, emote := range response {
+		if emote.Data == nil {
+			continue
+		}
+		emotes = append(emotes, types.Emote{
+			Name:    emote.Name,
+			EmoteID: emote.ID,
+			Flags:   emote.Flags,
+			State:   emote.Data.State,
+			URL:     emote.Data.Host.URL,
+		})
+	}
+
 	activeEmotesCache[channelID] = emoteCache{
 		emotes:  emotes,
 		expires: time.Now().Add(5 * time.Minute),
@@ -142,7 +157,7 @@ func getEmotesByChannelId(channelID string) ([]model.ActiveEmoteModel, error) {
 	return userModel.EmoteSet.Emotes, nil
 }
 
-func getGlobalEmotes() ([]model.ActiveEmoteModel, error) {
+func getGlobalEmotes() ([]types.Emote, error) {
 	mx.Lock()
 	defer mx.Unlock()
 
@@ -153,10 +168,26 @@ func getGlobalEmotes() ([]model.ActiveEmoteModel, error) {
 		}
 	}
 
-	emotes, err := requestGlobalEmotes()
+	response, err := requestGlobalEmotes()
 	if err != nil {
 		return nil, err
 	}
+
+	// convert response to save some memory
+	var emotes []types.Emote
+	for _, emote := range response {
+		if emote.Data == nil {
+			continue
+		}
+		emotes = append(emotes, types.Emote{
+			Name:    emote.Name,
+			EmoteID: emote.ID,
+			Flags:   emote.Flags,
+			State:   emote.Data.State,
+			URL:     emote.Data.Host.URL,
+		})
+	}
+
 	activeEmotesCache["global"] = emoteCache{
 		expires: time.Now().Add(5 * time.Minute),
 		emotes:  emotes,
diff --git a/pkg/database/emotes/emotes.go b/pkg/database/emotes/emotes.go
index e85659a..4986d59 100644
--- a/pkg/database/emotes/emotes.go
+++ b/pkg/database/emotes/emotes.go
@@ -11,18 +11,15 @@ import (
 )
 
 func IncrementEmote(ctx context.Context, emote types.CountedEmote) error {
-	if emote.Emote.Data == nil {
-		return ErrMissingData
-	}
 	res, err := collections.GlobalStats.UpdateOne(
 		ctx,
-		bson.D{{"emote_id", emote.Emote.ID}},
+		bson.D{{"emote_id", emote.Emote.EmoteID}},
 		bson.M{"$setOnInsert": EmoteCount{
 			Name:      emote.Emote.Name,
-			EmoteID:   emote.Emote.ID,
+			EmoteID:   emote.Emote.EmoteID,
 			Flags:     emote.Emote.Flags,
-			State:     emote.Emote.Data.State,
-			URL:       emote.Emote.Data.Host.URL,
+			State:     emote.Emote.State,
+			URL:       emote.Emote.URL,
 			CreatedAt: time.Now().UTC(),
 			UpdatedAt: time.Now().UTC(),
 			Count:     emote.Count,
@@ -37,7 +34,7 @@ func IncrementEmote(ctx context.Context, emote types.CountedEmote) error {
 
 	_, err = collections.GlobalStats.UpdateOne(
 		ctx,
-		bson.D{{"emote_id", emote.Emote.ID}},
+		bson.D{{"emote_id", emote.Emote.EmoteID}},
 		bson.M{
 			"$inc": bson.M{
 				"count": emote.Count,
diff --git a/pkg/types/emote.go b/pkg/types/emote.go
index 7ca2c07..04a0487 100644
--- a/pkg/types/emote.go
+++ b/pkg/types/emote.go
@@ -1,8 +1,19 @@
 package types
 
-import "github.com/seventv/api/data/model"
+import (
+	"github.com/seventv/api/data/model"
+	"go.mongodb.org/mongo-driver/bson/primitive"
+)
 
 type CountedEmote struct {
 	Count int
-	Emote model.ActiveEmoteModel
+	Emote Emote
+}
+
+type Emote struct {
+	Name    string                     `bson:"name"`
+	EmoteID primitive.ObjectID         `bson:"emote_id"`
+	Flags   model.ActiveEmoteFlagModel `bson:"flags"`
+	State   []model.EmoteVersionState  `bson:"state,omitempty"`
+	URL     string                     `bson:"url"`
 }

From 727c19b030557696e9adf6ba7afa3440c41440b0 Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 15:08:36 +0200
Subject: [PATCH 05/13] add logging for missing data in API response

---
 internal/aggregator/emote.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/internal/aggregator/emote.go b/internal/aggregator/emote.go
index 2f0913a..079f435 100644
--- a/internal/aggregator/emote.go
+++ b/internal/aggregator/emote.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/seventv/api/data/model"
+	"go.uber.org/zap"
 
 	"github.com/seventv/7tv-bot/pkg/types"
 )
@@ -102,6 +103,7 @@ func getEmotesForChannel(channelID string) ([]types.Emote, error) {
 	var emotes []types.Emote
 	for _, emote := range response {
 		if emote.Data == nil {
+			zap.S().Infof("emote %v has no data field, skipping", emote.Name)
 			continue
 		}
 		emotes = append(emotes, types.Emote{
@@ -177,6 +179,7 @@ func getGlobalEmotes() ([]types.Emote, error) {
 	var emotes []types.Emote
 	for _, emote := range response {
 		if emote.Data == nil {
+			zap.S().Infof("emote %v has no data field, skipping", emote.Name)
 			continue
 		}
 		emotes = append(emotes, types.Emote{

From 6847617e7810236d9c84ab4fbd9dee66e4f74542 Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 15:21:39 +0200
Subject: [PATCH 06/13] fix handling of empty emote set

---
 internal/aggregator/emote.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/internal/aggregator/emote.go b/internal/aggregator/emote.go
index 079f435..7a1f047 100644
--- a/internal/aggregator/emote.go
+++ b/internal/aggregator/emote.go
@@ -153,7 +153,7 @@ func getEmotesByChannelId(channelID string) ([]model.ActiveEmoteModel, error) {
 	}
 
 	if userModel.EmoteSet == nil {
-		return nil, ErrIncompleteResponse
+		return nil, ErrEmotesNotEnabled
 	}
 
 	return userModel.EmoteSet.Emotes, nil

From ceff4c085e2c2a6c36d6a5de1a53368406a80720 Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 15:22:00 +0200
Subject: [PATCH 07/13] scale down aggregator

---
 terraform/aggregator/aggregator.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/aggregator/aggregator.tf b/terraform/aggregator/aggregator.tf
index 5ed795d..dd14a2b 100644
--- a/terraform/aggregator/aggregator.tf
+++ b/terraform/aggregator/aggregator.tf
@@ -68,7 +68,7 @@ resource "kubernetes_deployment" "app" {
       }
     }
 
-    replicas = 4
+    replicas = 3
 
     template {
       metadata {

From 84a0aa92656d4b67dfa745e5073c8f1c8de0dc39 Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 17:34:10 +0200
Subject: [PATCH 08/13] lower requested resources for aggregator

---
 terraform/aggregator/aggregator.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/terraform/aggregator/aggregator.tf b/terraform/aggregator/aggregator.tf
index dd14a2b..9d7d024 100644
--- a/terraform/aggregator/aggregator.tf
+++ b/terraform/aggregator/aggregator.tf
@@ -90,8 +90,8 @@ resource "kubernetes_deployment" "app" {
             }
 
             requests = {
-              cpu    = "10m"
-              memory = "2Gi"
+              cpu    = "100m"
+              memory = "250Mi"
             }
           }
 

From c5940a9d1f6bdb2c7f2020a8842cd2955cacf5b7 Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 17:39:34 +0200
Subject: [PATCH 09/13] add config for kubernetes to the irc-reader

---
 cmd/irc-reader/example.config.yaml   | 4 ++++
 internal/irc-reader/config/config.go | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/cmd/irc-reader/example.config.yaml b/cmd/irc-reader/example.config.yaml
index 6d2802c..36e2866 100644
--- a/cmd/irc-reader/example.config.yaml
+++ b/cmd/irc-reader/example.config.yaml
@@ -1,5 +1,9 @@
 loglevel: info
 
+kube:
+  namespace: default
+  oauthsecret: twitch-irc-oauth
+
 ratelimit:
   join: 20
   auth: 20
diff --git a/internal/irc-reader/config/config.go b/internal/irc-reader/config/config.go
index 3b7b626..a25553f 100644
--- a/internal/irc-reader/config/config.go
+++ b/internal/irc-reader/config/config.go
@@ -16,6 +16,10 @@ type Config struct {
 	LogLevel string
 	Replicas int
 
+	Kube struct {
+		Namespace   string
+		Oauthsecret string
+	}
 	RateLimit struct {
 		Join  int64
 		Auth  int64

From 95e0db1d85b0bcea6b35baececd222c1ebae9553 Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 17:47:23 +0200
Subject: [PATCH 10/13] add support for kubernetes watcher, to update the oauth
 token used in irc-reader

---
 internal/irc-reader/kube.go    | 79 ++++++++++++++++++++++++++++++++++
 internal/irc-reader/service.go | 20 ++++++++-
 2 files changed, 98 insertions(+), 1 deletion(-)
 create mode 100644 internal/irc-reader/kube.go

diff --git a/internal/irc-reader/kube.go b/internal/irc-reader/kube.go
new file mode 100644
index 0000000..0fb3e52
--- /dev/null
+++ b/internal/irc-reader/kube.go
@@ -0,0 +1,79 @@
+package irc_reader
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"go.uber.org/zap"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+var (
+	ErrNoOAuthToken = errors.New("no OAuth token found in kubernetes secret data")
+	ErrNoSecret     = errors.New("no secret found")
+)
+
+func (c *Controller) kubeInit() error {
+	config, err := rest.InClusterConfig()
+	if err != nil {
+		return err
+	}
+	c.kube, err = kubernetes.NewForConfig(config)
+	if err != nil {
+		return err
+	}
+	return c.watchKube(context.Background(), c.updateOauthFromKubeSecret)
+}
+
+func (c *Controller) watchKube(ctx context.Context, cb func() error) error {
+	watcher, err := c.kube.CoreV1().Secrets(c.cfg.Kube.Namespace).Watch(
+		ctx,
+		metav1.SingleObject(metav1.ObjectMeta{
+			Name: c.cfg.Kube.Oauthsecret,
+		}),
+	)
+	if err != nil {
+		return err
+	}
+	go func() {
+		for range watcher.ResultChan() {
+			err = cb()
+			if err != nil {
+				zap.S().Infow("failed to update OAuth token from kubernetes secret", err)
+			}
+		}
+	}()
+	return nil
+}
+
+func (c *Controller) updateOauthFromKubeSecret() error {
+	oauth, err := c.getOauthFromKubeSecret(context.Background())
+	if err != nil {
+		return err
+	}
+	c.twitch.UpdateOauth(oauth)
+	zap.S().Info("updated OAuth token from kubernetes secret")
+	return nil
+}
+
+func (c *Controller) getOauthFromKubeSecret(ctx context.Context) (string, error) {
+	secret, err := c.kube.CoreV1().Secrets(c.cfg.Kube.Namespace).Get(
+		ctx,
+		c.cfg.Kube.Oauthsecret,
+		metav1.GetOptions{},
+	)
+	if err != nil {
+		return "", err
+	}
+	if secret == nil {
+		return "", ErrNoSecret
+	}
+	data, ok := secret.Data["access-token"]
+	if !ok || len(data) == 0 {
+		return "", ErrNoOAuthToken
+	}
+	return fmt.Sprintf("oauth:%v", string(data)), nil
+}
diff --git a/internal/irc-reader/service.go b/internal/irc-reader/service.go
index 2437d9d..4a2d5d6 100644
--- a/internal/irc-reader/service.go
+++ b/internal/irc-reader/service.go
@@ -9,6 +9,7 @@ import (
 	"github.com/nats-io/nats.go"
 	"github.com/redis/go-redis/v9"
 	"go.uber.org/zap"
+	"k8s.io/client-go/kubernetes"
 
 	"github.com/seventv/7tv-bot/internal/database"
 	"github.com/seventv/7tv-bot/internal/irc-reader/config"
@@ -19,6 +20,7 @@ import (
 type Controller struct {
 	cfg       *config.Config
 	jetStream nats.JetStreamContext
+	kube      *kubernetes.Clientset
 	twitch    *manager.IRCManager
 
 	shardID int
@@ -59,8 +61,21 @@ func (c *Controller) Init() error {
 		return err
 	}
 
+	err = c.kubeInit()
+	if err != nil {
+		return err
+	}
+
+	oauth := c.cfg.Twitch.Oauth
+	if oauth == "" {
+		oauth, err = c.getOauthFromKubeSecret(context.Background())
+		if err != nil {
+			return err
+		}
+	}
+
 	// initialize twitch IRC manager with ratelimit
-	c.twitch = manager.New(c.cfg.Twitch.User, c.cfg.Twitch.Oauth).
+	c.twitch = manager.New(c.cfg.Twitch.User, oauth).
 		WithLimit(ratelimit.New(
 			redisClient,
 			c.cfg.RateLimit.Join,
@@ -70,6 +85,9 @@ func (c *Controller) Init() error {
 
 	// watch for config changes to OAuth
 	config.OnChange = func() {
+		if c.cfg.Twitch.Oauth == "" {
+			return
+		}
 		c.twitch.UpdateOauth(c.cfg.Twitch.Oauth)
 	}
 

From 012d8d72ad5f171d8099a8076cec5ae9bc72680e Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 21:50:41 +0200
Subject: [PATCH 11/13] change irc-reader deployment to get oauth through
 kubernetes secrets, rather than config

---
 terraform/irc-reader/config.template.yaml |  5 ++-
 terraform/irc-reader/irc-reader.tf        | 46 +++++++++++++++++------
 2 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/terraform/irc-reader/config.template.yaml b/terraform/irc-reader/config.template.yaml
index 84d0215..498cf63 100644
--- a/terraform/irc-reader/config.template.yaml
+++ b/terraform/irc-reader/config.template.yaml
@@ -1,6 +1,10 @@
 loglevel: info
 replicas: ${replicas}
 
+kube:
+  namespace: ${namespace}
+  oauthsecret: ${oauthsecret}
+
 ratelimit:
   join: ${ratelimit_join}
   auth: ${ratelimit_auth}
@@ -16,7 +20,6 @@ ratelimit:
 
 twitch:
   user: ${twitch_username}
-  oauth: ${twitch_oauth}
 
 nats:
   url: ${nats_url}
diff --git a/terraform/irc-reader/irc-reader.tf b/terraform/irc-reader/irc-reader.tf
index 107eb1f..1f2590a 100644
--- a/terraform/irc-reader/irc-reader.tf
+++ b/terraform/irc-reader/irc-reader.tf
@@ -18,16 +18,6 @@ data "kubernetes_namespace" "app" {
   }
 }
 
-data "kubernetes_secret" "oauth" {
-  metadata {
-    name = var.oauth_secret
-    namespace = var.namespace
-  }
-  binary_data = {
-    "access-token" = ""
-  }
-}
-
 // Define config secret
 resource "kubernetes_secret" "app" {
   metadata {
@@ -37,9 +27,10 @@ resource "kubernetes_secret" "app" {
 
   data = {
     "config.yaml" = templatefile("${path.module}/config.template.yaml", {
+      namespace = data.kubernetes_namespace.app.metadata[0].name
+      oauthsecret = var.oauth_secret
       replicas = var.replicas
       twitch_username  = var.twitch_username
-      twitch_oauth     = join(":", ["oauth", base64decode(data.kubernetes_secret.oauth.binary_data["access-token"])])
       ratelimit_join   = var.ratelimit_join
       ratelimit_auth   = var.ratelimit_auth
       ratelimit_reset  = var.ratelimit_reset
@@ -148,3 +139,36 @@ resource "kubernetes_stateful_set" "app" {
     }
   }
 }
+
+resource "kubernetes_role" "app" {
+  metadata {
+    name      = "stats-irc-reader"
+    namespace = data.kubernetes_namespace.app.metadata[0].name
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["secrets"]
+    verbs      = ["watch", "get", "list"]
+  }
+}
+
+resource "kubernetes_role_binding" "app" {
+  // bind to kubernetes_role.app
+  metadata {
+    name      = "stats-irc-reader"
+    namespace = data.kubernetes_namespace.app.metadata[0].name
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    name      = "default"
+    namespace = data.kubernetes_namespace.app.metadata[0].name
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = kubernetes_role.app.metadata[0].name
+  }
+}
\ No newline at end of file

From 858fd6af2ef4578a376120fd25a6da206ce64fe9 Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 22:04:03 +0200
Subject: [PATCH 12/13] fix nil pointer

---
 internal/irc-reader/kube.go    | 5 +----
 internal/irc-reader/service.go | 6 ++++++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/internal/irc-reader/kube.go b/internal/irc-reader/kube.go
index 0fb3e52..c83d4d8 100644
--- a/internal/irc-reader/kube.go
+++ b/internal/irc-reader/kube.go
@@ -22,10 +22,7 @@ func (c *Controller) kubeInit() error {
 		return err
 	}
 	c.kube, err = kubernetes.NewForConfig(config)
-	if err != nil {
-		return err
-	}
-	return c.watchKube(context.Background(), c.updateOauthFromKubeSecret)
+	return err
 }
 
 func (c *Controller) watchKube(ctx context.Context, cb func() error) error {
diff --git a/internal/irc-reader/service.go b/internal/irc-reader/service.go
index 4a2d5d6..8385f3f 100644
--- a/internal/irc-reader/service.go
+++ b/internal/irc-reader/service.go
@@ -91,6 +91,12 @@ func (c *Controller) Init() error {
 		c.twitch.UpdateOauth(c.cfg.Twitch.Oauth)
 	}
 
+	// watch for changes to OAuth in kubernetes secret
+	err = c.watchKube(context.Background(), c.updateOauthFromKubeSecret)
+	if err != nil {
+		return err
+	}
+
 	// feed back twitch channels that got disconnected to the IRC
 	go c.handleOrphanedChannels()
 

From a212c4e13a81ebe1d69db3510af6ae6e8122a6db Mon Sep 17 00:00:00 2001
From: bread <75878656+broadeditz@users.noreply.github.com>
Date: Tue, 10 Oct 2023 22:07:33 +0200
Subject: [PATCH 13/13] only watch kubernetes if it is configured

---
 internal/irc-reader/service.go | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/internal/irc-reader/service.go b/internal/irc-reader/service.go
index 8385f3f..f634714 100644
--- a/internal/irc-reader/service.go
+++ b/internal/irc-reader/service.go
@@ -92,9 +92,11 @@ func (c *Controller) Init() error {
 	}
 
 	// watch for changes to OAuth in kubernetes secret
-	err = c.watchKube(context.Background(), c.updateOauthFromKubeSecret)
-	if err != nil {
-		return err
+	if c.cfg.Kube.Oauthsecret != "" {
+		err = c.watchKube(context.Background(), c.updateOauthFromKubeSecret)
+		if err != nil {
+			return err
+		}
 	}
 
 	// feed back twitch channels that got disconnected to the IRC