From 2af58aa0aaab080d0702eade714a3c4235773bb9 Mon Sep 17 00:00:00 2001
From: Melinda Moreland <mindy.moreland@conductorone.com>
Date: Thu, 20 Aug 2026 15:31:18 -0700
Subject: [PATCH] docs: show how to mount GitHub App private key in Kubernetes

BATON_APP_PRIVATEKEY_PATH was documented without showing how the key
file actually gets onto the container filesystem. Add a Secret +
volume mount example, consistent with the pattern already used in
other connector docs.
---
 docs/connector.mdx | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/docs/connector.mdx b/docs/connector.mdx
index 2d2e0b8b..d1179a1a 100644
--- a/docs/connector.mdx
+++ b/docs/connector.mdx
@@ -387,7 +387,7 @@ stringData:
   # GitHub credentials if configuring with a GitHub app
   BATON_APP_ID: <GitHub app ID>
   # Supply the private key one of two ways:
-  BATON_APP_PRIVATEKEY_PATH: <Path to the private key file for the GitHub app>
+  BATON_APP_PRIVATEKEY_PATH: /etc/baton-github/keys/private-key.pem
   # ...or pass the raw PEM contents directly (takes precedence when both are set):
   # BATON_APP_PRIVATEKEY: <Raw PEM contents of the private key for the GitHub app>
   BATON_ORGS: <Name of the single GitHib org the app was created for>
@@ -401,8 +401,21 @@ stringData:
   # Optional: enable for orgs with thousands of repos or members to reduce sync time.
   # See "Optimize sync for large organizations" below for trade-offs.
   BATON_DIRECT_COLLABORATORS_ONLY: true
+
+---
+# baton-github-app-key-secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: baton-github-app-key
+type: Opaque
+stringData:
+  private-key.pem: |
+    <Contents of the GitHub app's private key (.pem) file>
 ```
 
+If you're using `BATON_APP_PRIVATEKEY_PATH`, the private key must be mounted into the container as a file rather than passed as an environment variable. The manifest above stores the key in its own Secret so it can be mounted as a volume in the deployment configuration below. Set `BATON_APP_PRIVATEKEY_PATH` to the path where the key will be mounted. If you use `BATON_APP_PRIVATEKEY` instead, the raw PEM contents are passed directly and no volume mount is needed.
+
 See the connector's README or run `--help` to see all available configuration flags and environment variables.
 
 #### Deployment configuration
@@ -436,8 +449,18 @@ spec:
         envFrom:
         - secretRef:
             name: baton-github-secrets
+        volumeMounts:
+        - name: github-app-key
+          mountPath: /etc/baton-github/keys
+          readOnly: true
+      volumes:
+      - name: github-app-key
+        secret:
+          secretName: baton-github-app-key
 ```
 
+The `volumeMounts` and `volumes` entries above are only needed if you're configuring the connector with a GitHub app using `BATON_APP_PRIVATEKEY_PATH`. Omit them if you're using an access token or `BATON_APP_PRIVATEKEY` instead.
+
 ### Step 3: Deploy the connector
 
 <Steps>