Security: Migrated API keys to K8s Secrets via file:// scheme

k3s/configmap.yaml

@@ -46,7 +46,7 @@ data:
         },
         "telegram": {
           "enabled": true,
-          "token": "<TELEGRAM_TOKEN>",
+          "token": "file:///etc/picoclaw/secrets/telegram-token",
           "base_url": "",
           "proxy": "",
           "allow_from": [
@@ -285,13 +285,13 @@ data:
           "model_name": "nemotron-3-super-120b-a12b",
           "model": "nvidia/nemotron-3-super-120b-a12b",
           "api_base": "https://integrate.api.nvidia.com/v1",
-          "api_key": "<NVIDIA_API_KEY>"
+          "api_key": "file:///etc/picoclaw/secrets/nvidia-api-key"
         },
         {
           "model_name": "azure-grok",
           "model": "openai/grok-4-fast-non-reasoning",
           "api_base": "https://TestSJF.openai.azure.com/openai/v1/",
-          "api_key": "<AZURE_API_KEY>"
+          "api_key": "file:///etc/picoclaw/secrets/azure-api-key"
         },
         {
           "model_name": "cerebras-llama-3.3-70b",

k3s/deployment.yaml

@@ -46,6 +46,9 @@ spec:
         volumeMounts:
         - name: picoclaw-data
           mountPath: /home/picoclaw/.picoclaw
+        - name: picoclaw-secrets
+          mountPath: /etc/picoclaw/secrets
+          readOnly: true
       volumes:
       - name: picoclaw-data
         persistentVolumeClaim:
@@ -53,3 +56,6 @@ spec:
       - name: picoclaw-config-source
         configMap:
           name: picoclaw-config
+      - name: picoclaw-secrets
+        secret:
+          secretName: picoclaw-secrets

k3s/secrets.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: picoclaw-secrets
+  namespace: default
+type: Opaque
+stringData:
+  # Base64 encoding is handled automatically by K8s when using stringData
+  telegram-token: "YOUR_TELEGRAM_TOKEN_HERE"
+  nvidia-api-key: "YOUR_NVIDIA_API_KEY_HERE"
+  azure-api-key: "YOUR_AZURE_API_KEY_HERE"