yeah, in most cases we aren't in between the secret being generated and passed to spicedb. just a

secretKeyRef

in a kubernetes manifiest