Skip to content

docs: show how to mount GitHub App private key in Kubernetes #183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mindymo merged 1 commit into from
Aug 20, 2026
Merged

docs: show how to mount GitHub App private key in Kubernetes #183

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 24 additions & 1 deletion docs/connector.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,7 +387,7 @@ stringData:
# GitHub credentials if configuring with a GitHub app
BATON_APP_ID: <GitHub app ID>
# Supply the private key one of two ways:
BATON_APP_PRIVATEKEY_PATH: <Path to the private key file for the GitHub app>
BATON_APP_PRIVATEKEY_PATH: /etc/baton-github/keys/private-key.pem
# ...or pass the raw PEM contents directly (takes precedence when both are set):
# BATON_APP_PRIVATEKEY: <Raw PEM contents of the private key for the GitHub app>
BATON_ORGS: <Name of the single GitHib org the app was created for>
Expand All @@ -401,8 +401,21 @@ stringData:
# Optional: enable for orgs with thousands of repos or members to reduce sync time.
# See "Optimize sync for large organizations" below for trade-offs.
BATON_DIRECT_COLLABORATORS_ONLY: true

---
# baton-github-app-key-secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: baton-github-app-key
type: Opaque
stringData:
private-key.pem: |
<Contents of the GitHub app's private key (.pem) file>
```

If you're using `BATON_APP_PRIVATEKEY_PATH`, the private key must be mounted into the container as a file rather than passed as an environment variable. The manifest above stores the key in its own Secret so it can be mounted as a volume in the deployment configuration below. Set `BATON_APP_PRIVATEKEY_PATH` to the path where the key will be mounted. If you use `BATON_APP_PRIVATEKEY` instead, the raw PEM contents are passed directly and no volume mount is needed.

See the connector's README or run `--help` to see all available configuration flags and environment variables.

#### Deployment configuration
Expand Down Expand Up @@ -436,8 +449,18 @@ spec:
envFrom:
- secretRef:
name: baton-github-secrets
volumeMounts:
- name: github-app-key
mountPath: /etc/baton-github/keys
readOnly: true
volumes:
- name: github-app-key
secret:
secretName: baton-github-app-key
Comment on lines +456 to +459

@github-actions github-actions Bot Aug 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Suggestion: A GitHub App private key mounted from a Secret gets Kubernetes' default file mode of 0644, making it readable by any non-root process in the container. Since this is credential material, consider setting defaultMode: 0400 in the example so users copying this manifest get a tighter default.

Suggested change
volumes:
- name: github-app-key
secret:
secretName: baton-github-app-key
volumes:
- name: github-app-key
secret:
secretName: baton-github-app-key
defaultMode: 0400

```

The `volumeMounts` and `volumes` entries above are only needed if you're configuring the connector with a GitHub app using `BATON_APP_PRIVATEKEY_PATH`. Omit them if you're using an access token or `BATON_APP_PRIVATEKEY` instead.

### Step 3: Deploy the connector

<Steps>
Expand Down
Loading