Move one more bootstrap comment

README.md

@@ -20,6 +20,7 @@ Or `make apply` to deploy locally.
 After installing k3s there are a few steps that don't make sense to automate since they (hopefully) won't need to happen again.
 
 ```bash
+kubectl create secret generic oauth-cookie-secret --from-literal=secret=$(openssl rand -base64 24)
 kubectl create secret generic keycloak-admin --from-literal=KEYCLOAK_ADMIN_PASSWORD=$(openssl rand -base64 16)
 kubectl create secret generic profile-file-token-key --from-literal=key=$(openssl rand -base64 32)
 kubectl create secret generic reporting-psql --from-literal=password=$(openssl rand -base64 24)

patches/oauth-sidecar.yaml

@@ -1,7 +1,3 @@
-# Assumes the cookie secret has been generated like this:
-#
-# > kubectl create secret generic oauth-cookie-secret --from-literal=secret=$(openssl rand -base64 24)
-
 apiVersion: apps/v1
 kind: Deployment
 metadata: