From dd55ada73a2f9724d857c4dea42323ca569b9295 Mon Sep 17 00:00:00 2001
From: stevef <stevef@omen.home>
Date: Sat, 28 Mar 2026 15:43:15 +0100
Subject: [PATCH] Security: Migrated API keys to K8s Secrets via file:// scheme

---
 k3s/configmap.yaml  |  6 +++---
 k3s/deployment.yaml |  6 ++++++
 k3s/secrets.yaml    | 11 +++++++++++
 3 files changed, 20 insertions(+), 3 deletions(-)
 create mode 100644 k3s/secrets.yaml

diff --git a/k3s/configmap.yaml b/k3s/configmap.yaml
index f8d2310f1..4a3b759db 100644
--- a/k3s/configmap.yaml
+++ b/k3s/configmap.yaml
@@ -46,7 +46,7 @@ data:
         },
         "telegram": {
           "enabled": true,
-          "token": "<TELEGRAM_TOKEN>",
+          "token": "file:///etc/picoclaw/secrets/telegram-token",
           "base_url": "",
           "proxy": "",
           "allow_from": [
@@ -285,13 +285,13 @@ data:
           "model_name": "nemotron-3-super-120b-a12b",
           "model": "nvidia/nemotron-3-super-120b-a12b",
           "api_base": "https://integrate.api.nvidia.com/v1",
-          "api_key": "<NVIDIA_API_KEY>"
+          "api_key": "file:///etc/picoclaw/secrets/nvidia-api-key"
         },
         {
           "model_name": "azure-grok",
           "model": "openai/grok-4-fast-non-reasoning",
           "api_base": "https://TestSJF.openai.azure.com/openai/v1/",
-          "api_key": "<AZURE_API_KEY>"
+          "api_key": "file:///etc/picoclaw/secrets/azure-api-key"
         },
         {
           "model_name": "cerebras-llama-3.3-70b",
diff --git a/k3s/deployment.yaml b/k3s/deployment.yaml
index e0cb96ac8..5af999b4c 100644
--- a/k3s/deployment.yaml
+++ b/k3s/deployment.yaml
@@ -46,6 +46,9 @@ spec:
         volumeMounts:
         - name: picoclaw-data
           mountPath: /home/picoclaw/.picoclaw
+        - name: picoclaw-secrets
+          mountPath: /etc/picoclaw/secrets
+          readOnly: true
       volumes:
       - name: picoclaw-data
         persistentVolumeClaim:
@@ -53,3 +56,6 @@ spec:
       - name: picoclaw-config-source
         configMap:
           name: picoclaw-config
+      - name: picoclaw-secrets
+        secret:
+          secretName: picoclaw-secrets
diff --git a/k3s/secrets.yaml b/k3s/secrets.yaml
new file mode 100644
index 000000000..328926b2e
--- /dev/null
+++ b/k3s/secrets.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: picoclaw-secrets
+  namespace: default
+type: Opaque
+stringData:
+  # Base64 encoding is handled automatically by K8s when using stringData
+  telegram-token: "YOUR_TELEGRAM_TOKEN_HERE"
+  nvidia-api-key: "YOUR_NVIDIA_API_KEY_HERE"
+  azure-api-key: "YOUR_AZURE_API_KEY_HERE"