docs: show how to mount GitHub App private key in Kubernetes

[mindymo]

Summary

• The self-hosted setup guide references BATON_APP_PRIVATEKEY_PATH but never shows how the key file gets onto the connector container's filesystem at that path.
• Adds a Secret manifest holding the key file contents, plus a volumeMounts/volumes example in the Deployment manifest.
• Notes that this is only needed for BATON_APP_PRIVATEKEY_PATH — the BATON_APP_PRIVATEKEY (raw PEM) alternative doesn't need a volume mount.
• Reported by an SRE who noticed the gap while configuring the connector in service mode. Mirrors the same fix applied in the ConductorOne/docs repo.

Test plan

• Docs-only change; visually reviewed rendered YAML blocks for correct indentation/fencing.

[github-actions]

🟡 Suggestion: A GitHub App private key mounted from a Secret gets Kubernetes' default file mode of 0644, making it readable by any non-root process in the container. Since this is credential material, consider setting defaultMode: 0400 in the example so users copying this manifest get a tighter default.

Suggested change

	volumes:
	- name: github-app-key
	secret:
	secretName: baton-github-app-key
	volumes:
	- name: github-app-key
	secret:
	secretName: baton-github-app-key
	defaultMode: 0400

[github-actions]

Connector PR Review: docs: show how to mount GitHub App private key in Kubernetes

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 5d37fcd21d8a.
Review mode: full
View review run

Review Summary

Scanned the full PR diff for security and correctness. This is a docs-only change to docs/connector.mdx adding a second Secret manifest for the GitHub App private key plus matching volumeMounts/volumes entries in the Deployment example. I verified the env var names and precedence against pkg/config/config.go and pkg/connector/connector.go: BATON_APP_PRIVATEKEY_PATH is a FileUploadField whose contents are read from disk, and BATON_APP_PRIVATEKEY does take precedence when both are set, so the new prose is accurate. No code, dependency, or generated-file changes; YAML indentation and the multi-document separator in both blocks are valid, and no blocking issues were found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• docs/connector.mdx:456-459 — the private-key Secret volume inherits Kubernetes' default 0644 file mode; consider defaultMode: 0400 in the example.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `docs/connector.mdx`:
- Around line 456-459: The Deployment example mounts the GitHub App private key from
  the `baton-github-app-key` Secret without specifying a file mode, so Kubernetes
  applies the default 0644 and the PEM is world-readable inside the container. Add
  `defaultMode: 0400` under the `secret:` key (as a sibling of `secretName`) in the
  `volumes` entry so users copying this manifest get a least-privilege default for
  credential material.

[github-actions]

No blocking issues found.