Hardening: Finalized K3s deployment with relative secret paths and agi namespace

k3s/configmap.yaml

@@ -12,7 +12,7 @@ data:
       "version": 1,
       "agents": {
         "defaults": {
-          "workspace": "",
+          "workspace": "/home/picoclaw/.picoclaw",
           "restrict_to_workspace": true,
           "allow_read_outside_workspace": false,
           "provider": "",
@@ -46,7 +46,7 @@ data:
         },
         "telegram": {
           "enabled": true,
-          "token": "file:///etc/picoclaw/secrets/telegram-token",
+          "token": "file://secrets/telegram-token",
           "base_url": "",
           "proxy": "",
           "allow_from": [
@@ -285,13 +285,13 @@ data:
           "model_name": "nemotron-3-super-120b-a12b",
           "model": "nvidia/nemotron-3-super-120b-a12b",
           "api_base": "https://integrate.api.nvidia.com/v1",
-          "api_key": "file:///etc/picoclaw/secrets/nvidia-api-key"
+          "api_key": "file://secrets/nvidia-api-key"
         },
         {
           "model_name": "azure-grok",
           "model": "openai/grok-4-fast-non-reasoning",
           "api_base": "https://TestSJF.openai.azure.com/openai/v1/",
-          "api_key": "file:///etc/picoclaw/secrets/azure-api-key"
+          "api_key": "file://secrets/azure-api-key"
         },
         {
           "model_name": "cerebras-llama-3.3-70b",

k3s/deployment.yaml

@@ -47,7 +47,7 @@ spec:
         - name: picoclaw-data
           mountPath: /home/picoclaw/.picoclaw
         - name: picoclaw-secrets
-          mountPath: /etc/picoclaw/secrets
+          mountPath: /home/picoclaw/.picoclaw/secrets
           readOnly: true
       volumes:
       - name: picoclaw-data

k3s/secrets.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: picoclaw-secrets
-  namespace: default
+  namespace: agi
 type: Opaque
 stringData:
   # Base64 encoding is handled automatically by K8s when using stringData