Skip to content

docs(baton): show how to mount GitHub App private key in Kubernetes #465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mindymo merged 1 commit into from
Aug 20, 2026
+113 −24
Merged

docs(baton): show how to mount GitHub App private key in Kubernetes #465

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
112 changes: 89 additions & 23 deletions baton/github-enterprise-cloud.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
title: "Set up a GitHub Enterprise Cloud connector"
og:title: "Set up a GitHub Enterprise Cloud connector"
description: "C1 provides identity governance and just-in-time provisioning for GitHub Enterprise Cloud. Integrate your GitHub Enterprise Cloud instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access."
og:description: "C1 provides identity governance and just-in-time provisioning for GitHub Enterprise Cloud. Integrate your GitHub Enterprise Cloud instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access."

Check warning on line 5 in baton/github-enterprise-cloud.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github-enterprise-cloud.mdx#L5 

Did you really mean 'UARs'?

Check warning on line 5 in baton/github-enterprise-cloud.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github-enterprise-cloud.mdx#L5 

Did you really mean 'deprovision'?
sidebarTitle: "GitHub Enterprise Cloud"
---

Expand Down Expand Up @@ -179,33 +179,99 @@
generate a new Client ID and Client Secret. Store these values
securely for your deployment.
</Step>
</Steps>

### Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your GitHub Enterprise Cloud connector deployment:

#### Secrets configuration

```yaml expandable
# baton-github-enterprise-cloud-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
name: baton-github-enterprise-cloud-secrets
type: Opaque
stringData:
# C1 credentials
BATON_CLIENT_ID: <C1 client ID>
BATON_CLIENT_SECRET: <C1 client secret>

# GitHub Enterprise Cloud credentials
BATON_ENTERPRISE_SLUG: <GitHub enterprise slug>
BATON_APP_ID: <GitHub App ID>
BATON_INSTALLATION_ID: <GitHub App enterprise installation ID>
BATON_APP_PRIVATEKEY_PATH: /etc/baton-github-enterprise-cloud/keys/private-key.pem

---
# baton-github-enterprise-cloud-app-key-secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: baton-github-enterprise-cloud-app-key
type: Opaque
stringData:
private-key.pem: |
<Contents of the GitHub app's private key (.pem) file>
```

The private key must be mounted into the container as a file rather than passed as an environment variable. The manifest above stores the key in its own Secret so it can be mounted as a volume in the deployment configuration below. Set `BATON_APP_PRIVATEKEY_PATH` to the path where the key will be mounted.

See the connector's README or run `--help` to see all available configuration flags and environment variables.

#### Deployment configuration

```yaml expandable
# baton-github-enterprise-cloud.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: baton-github-enterprise-cloud
labels:
app: baton-github-enterprise-cloud
spec:
selector:
matchLabels:
app: baton-github-enterprise-cloud
template:
metadata:
labels:
app: baton-github-enterprise-cloud
baton: true
baton-app: github-enterprise-cloud
spec:
containers:
- name: baton-github-enterprise-cloud
image: public.ecr.aws/conductorone/baton-github-enterprise-cloud:latest
imagePullPolicy: IfNotPresent
env:
- name: BATON_HOST_ID
value: baton-github-enterprise-cloud
envFrom:
- secretRef:
name: baton-github-enterprise-cloud-secrets
volumeMounts:
- name: github-app-key
mountPath: /etc/baton-github-enterprise-cloud/keys
readOnly: true
volumes:
- name: github-app-key
secret:
secretName: baton-github-enterprise-cloud-app-key
```

Use a version tag without the leading `v`, such as `0.0.3`, in place of `latest` if you want to pin to a specific release.

### Step 3: Deploy the connector

<Steps>
<Step>
Configure C1 credentials and GitHub Enterprise Cloud settings as
environment variables:

```bash
BATON_CLIENT_ID=<C1 client ID>
BATON_CLIENT_SECRET=<C1 client secret>
BATON_HOST_ID=baton-github-enterprise-cloud
BATON_ENTERPRISE_SLUG=<GitHub enterprise slug>
BATON_APP_ID=<GitHub App ID>
BATON_INSTALLATION_ID=<GitHub App enterprise installation ID>
BATON_APP_PRIVATEKEY_PATH=/var/run/secrets/github-app-private-key.pem
```

Mount the GitHub App private key at the path configured in
`BATON_APP_PRIVATEKEY_PATH`.
Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
</Step>

<Step>
Deploy the connector using the Public ECR image:

```bash
public.ecr.aws/conductorone/baton-github-enterprise-cloud:<version>
```

Use a version tag without the leading `v`, such as `0.0.3`.
Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the GitHub Enterprise Cloud connector to.
</Step>
</Steps>

Expand Down
25 changes: 24 additions & 1 deletion baton/github.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
title: "Set up a GitHub connector"
og:title: "Set up a GitHub connector"
description: "C1 provides identity governance and just-in-time provisioning for GitHub. Integrate your GitHub instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access."
og:description: "C1 provides identity governance and just-in-time provisioning for GitHub. Integrate your GitHub instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access."

Check warning on line 5 in baton/github.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github.mdx#L5 

Did you really mean 'UARs'?

Check warning on line 5 in baton/github.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github.mdx#L5 

Did you really mean 'deprovision'?
sidebarTitle: "GitHub"
---

Expand All @@ -19,7 +19,7 @@
| Accounts | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Repositories | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Teams | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |
| Orgs | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> |

Check warning on line 22 in baton/github.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github.mdx#L22 

Did you really mean 'Orgs'?
| GitHub Apps (NHI) | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | |
| Secrets - API keys | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | |

Expand Down Expand Up @@ -71,7 +71,7 @@
- **user** - select all

<Warning>
The **write::org** scope is used by C1 when automatically provisioning and deprovisioning GitHub access on your behalf. **If you do not want C1 to perform these tasks for you, do not give your token this scope.**

Check warning on line 74 in baton/github.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github.mdx#L74 

Did you really mean 'deprovisioning'?
</Warning>
</Step>
<Step>
Expand Down Expand Up @@ -182,7 +182,7 @@
Check the **Expire user authorization tokens** and **Enable Device Flow** checkboxes to enable these settings.
</Step>
<Step>
In the **Webhook** section of the page, uncheck the **Active** checkbox to disable this setting.

Check warning on line 185 in baton/github.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github.mdx#L185 

Did you really mean 'uncheck'?
</Step>
<Step>
In the **Permissions** section of the page, give the app the following permissions:
Expand Down Expand Up @@ -257,7 +257,7 @@
<Step>
Choose how to set up the new GitHub connector:

* Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)

Check warning on line 260 in baton/github.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github.mdx#L260 

Did you really mean 'unmanaged'?

* Add the connector to a managed app (select from the list of existing managed apps)

Expand Down Expand Up @@ -300,7 +300,7 @@

1. **Optional.** Click to enable **Sync secrets**. [Synced secrets](/product/admin/inventory) are displayed on the **Inventory** page.

1. **Optional.** If you do not want to include archived repos in syncs, click to enable **Omit archived repositories**.

Check warning on line 303 in baton/github.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github.mdx#L303 

Did you really mean 'repos'?

1. **Optional.** If your GitHub organization has thousands of repositories or members, click to enable **Optimize sync for large organizations**. See [Optimize sync for large organizations](#optimize-sync-for-large-organizations) for what changes when this option is enabled.
</Step>
Expand Down Expand Up @@ -338,7 +338,7 @@
<Step>
Choose how to set up the new GitHub connector:

* Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)

Check warning on line 341 in baton/github.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github.mdx#L341 

Did you really mean 'unmanaged'?

* Add the connector to a managed app (select from the list of existing managed apps)

Expand Down Expand Up @@ -386,7 +386,7 @@

# GitHub credentials if configuring with a GitHub app
BATON_APP_ID: <GitHub app ID>
BATON_APP_PRIVATEKEY_PATH: <Path to the private key file for the GitHub app>
BATON_APP_PRIVATEKEY_PATH: /etc/baton-github/keys/private-key.pem
BATON_ORGS: <Name of the single GitHib org the app was created for>

# Optional: include if you want C1 to provision access using this connector
Expand All @@ -398,8 +398,21 @@
# Optional: enable for orgs with thousands of repos or members to reduce sync time.
# See "Optimize sync for large organizations" below for trade-offs.
BATON_DIRECT_COLLABORATORS_ONLY: true

---
# baton-github-app-key-secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: baton-github-app-key
type: Opaque
stringData:
private-key.pem: |
<Contents of the GitHub app's private key (.pem) file>
```

If you're configuring the connector with a GitHub app, the private key must be mounted into the container as a file rather than passed as an environment variable. The manifest above stores the key in its own Secret so it can be mounted as a volume in the deployment configuration below. Set `BATON_APP_PRIVATEKEY_PATH` to the path where the key will be mounted.

See the connector's README or run `--help` to see all available configuration flags and environment variables.

#### Deployment configuration
Expand Down Expand Up @@ -433,13 +446,23 @@
envFrom:
- secretRef:
name: baton-github-secrets
volumeMounts:
- name: github-app-key
mountPath: /etc/baton-github/keys
readOnly: true
volumes:
- name: github-app-key
secret:
secretName: baton-github-app-key
```

The `volumeMounts` and `volumes` entries above are only needed if you're configuring the connector with a GitHub app. Omit them if you're using an access token instead.

### Step 3: Deploy the connector

<Steps>
<Step>
Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check warning on line 465 in baton/github.mdx

View check run for this annotation

Mintlify / Mintlify Validation (conductorone) - vale-spellcheck

baton/github.mdx#L465 

Did you really mean 'namespace'?
</Step>
<Step>
Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the GitHub connector to. GitHub data should be found on the **Entitlements** and **Accounts** tabs.
Expand Down