From 25d4edadc4387d2fbbb16a2ac0caf64bfaf46642 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 20 Aug 2026 14:28:09 -0700 Subject: [PATCH] docs(baton): show how to mount GitHub App private key in Kubernetes Both the GitHub and GitHub Enterprise Cloud self-hosted setup guides referenced BATON_APP_PRIVATEKEY_PATH without showing how the key file actually gets onto the container filesystem. Add a Secret + volume mount example, consistent with the pattern already used in successfactors-scim.mdx. Co-Authored-By: Claude Sonnet 5 --- baton/github-enterprise-cloud.mdx | 112 ++++++++++++++++++++++++------ baton/github.mdx | 25 ++++++- 2 files changed, 113 insertions(+), 24 deletions(-) diff --git a/baton/github-enterprise-cloud.mdx b/baton/github-enterprise-cloud.mdx index c966822c..c1737202 100644 --- a/baton/github-enterprise-cloud.mdx +++ b/baton/github-enterprise-cloud.mdx @@ -179,33 +179,99 @@ API access. generate a new Client ID and Client Secret. Store these values securely for your deployment. + + + ### Step 2: Create Kubernetes configuration files + + Create two Kubernetes manifest files for your GitHub Enterprise Cloud connector deployment: + + #### Secrets configuration + + ```yaml expandable + # baton-github-enterprise-cloud-secrets.yaml + apiVersion: v1 + kind: Secret + metadata: + name: baton-github-enterprise-cloud-secrets + type: Opaque + stringData: + # C1 credentials + BATON_CLIENT_ID: + BATON_CLIENT_SECRET: + + # GitHub Enterprise Cloud credentials + BATON_ENTERPRISE_SLUG: + BATON_APP_ID: + BATON_INSTALLATION_ID: + BATON_APP_PRIVATEKEY_PATH: /etc/baton-github-enterprise-cloud/keys/private-key.pem + + --- + # baton-github-enterprise-cloud-app-key-secret.yaml + apiVersion: v1 + kind: Secret + metadata: + name: baton-github-enterprise-cloud-app-key + type: Opaque + stringData: + private-key.pem: | + + ``` + + The private key must be mounted into the container as a file rather than passed as an environment variable. The manifest above stores the key in its own Secret so it can be mounted as a volume in the deployment configuration below. Set `BATON_APP_PRIVATEKEY_PATH` to the path where the key will be mounted. + + See the connector's README or run `--help` to see all available configuration flags and environment variables. + + #### Deployment configuration + + ```yaml expandable + # baton-github-enterprise-cloud.yaml + apiVersion: apps/v1 + kind: Deployment + metadata: + name: baton-github-enterprise-cloud + labels: + app: baton-github-enterprise-cloud + spec: + selector: + matchLabels: + app: baton-github-enterprise-cloud + template: + metadata: + labels: + app: baton-github-enterprise-cloud + baton: true + baton-app: github-enterprise-cloud + spec: + containers: + - name: baton-github-enterprise-cloud + image: public.ecr.aws/conductorone/baton-github-enterprise-cloud:latest + imagePullPolicy: IfNotPresent + env: + - name: BATON_HOST_ID + value: baton-github-enterprise-cloud + envFrom: + - secretRef: + name: baton-github-enterprise-cloud-secrets + volumeMounts: + - name: github-app-key + mountPath: /etc/baton-github-enterprise-cloud/keys + readOnly: true + volumes: + - name: github-app-key + secret: + secretName: baton-github-enterprise-cloud-app-key + ``` + + Use a version tag without the leading `v`, such as `0.0.3`, in place of `latest` if you want to pin to a specific release. + + ### Step 3: Deploy the connector + - Configure C1 credentials and GitHub Enterprise Cloud settings as - environment variables: - - ```bash - BATON_CLIENT_ID= - BATON_CLIENT_SECRET= - BATON_HOST_ID=baton-github-enterprise-cloud - BATON_ENTERPRISE_SLUG= - BATON_APP_ID= - BATON_INSTALLATION_ID= - BATON_APP_PRIVATEKEY_PATH=/var/run/secrets/github-app-private-key.pem - ``` - - Mount the GitHub App private key at the path configured in - `BATON_APP_PRIVATEKEY_PATH`. + Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files. - - Deploy the connector using the Public ECR image: - - ```bash - public.ecr.aws/conductorone/baton-github-enterprise-cloud: - ``` - - Use a version tag without the leading `v`, such as `0.0.3`. + Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the GitHub Enterprise Cloud connector to. diff --git a/baton/github.mdx b/baton/github.mdx index fbe68030..c806e0a9 100644 --- a/baton/github.mdx +++ b/baton/github.mdx @@ -386,7 +386,7 @@ stringData: # GitHub credentials if configuring with a GitHub app BATON_APP_ID: - BATON_APP_PRIVATEKEY_PATH: + BATON_APP_PRIVATEKEY_PATH: /etc/baton-github/keys/private-key.pem BATON_ORGS: # Optional: include if you want C1 to provision access using this connector @@ -398,8 +398,21 @@ stringData: # Optional: enable for orgs with thousands of repos or members to reduce sync time. # See "Optimize sync for large organizations" below for trade-offs. BATON_DIRECT_COLLABORATORS_ONLY: true + +--- +# baton-github-app-key-secret.yaml +apiVersion: v1 +kind: Secret +metadata: + name: baton-github-app-key +type: Opaque +stringData: + private-key.pem: | + ``` +If you're configuring the connector with a GitHub app, the private key must be mounted into the container as a file rather than passed as an environment variable. The manifest above stores the key in its own Secret so it can be mounted as a volume in the deployment configuration below. Set `BATON_APP_PRIVATEKEY_PATH` to the path where the key will be mounted. + See the connector's README or run `--help` to see all available configuration flags and environment variables. #### Deployment configuration @@ -433,8 +446,18 @@ spec: envFrom: - secretRef: name: baton-github-secrets + volumeMounts: + - name: github-app-key + mountPath: /etc/baton-github/keys + readOnly: true + volumes: + - name: github-app-key + secret: + secretName: baton-github-app-key ``` +The `volumeMounts` and `volumes` entries above are only needed if you're configuring the connector with a GitHub app. Omit them if you're using an access token instead. + ### Step 3: Deploy the connector