From 5a0a765b28050899c2631bb2f852d84a6ccc7cc1 Mon Sep 17 00:00:00 2001
From: Chris Lovering <chris.lovering.95@gmail.com>
Date: Sun, 4 Oct 2026 18:53:52 +0100
Subject: [PATCH 1/2] Remove pre-shared token for polonium

---
 kubernetes/namespaces/modmail/secrets.yaml | Bin 1038 -> 976 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/kubernetes/namespaces/modmail/secrets.yaml b/kubernetes/namespaces/modmail/secrets.yaml
index 96148274f69cd8c04e54d7bc1b11296109bccb8e..4bef758a39081b8b8330ab1cfc0b3153b480c5d1 100644
GIT binary patch
literal 976
zcmV;>126mlM@dveQdv+`0AzI^Rn?(?Sg`BPOr<IBdx`vBC|d*vd!_zI3+yI8V2?<D
zW{Y{9xEX70Yfp3HLuO#;K^wm>iv<+k{;=7}6~#$!Q1WOnFJKmkin#!Q_?8Dk#+TIJ
zG0zh(du+~?{SQuHRpm(E;Jky%nX`p6oY&hBGjaqdL-H>OBlv10+NO?h;aKXE5oD(}
zl(DRqPes8>h7JTGz&9*R{CwT*1|tWZzxk<UF3Af?<8%S?&IW}N=T?SCijBDG%Z{WN
z;@qj?U|<WIJkm<F3c4x{b3||lKUN7}*CXmdpcj4U;65vPb*r*b)U(#_YXEcuA71|n
zLhQg64>(e85jX;)93_UP7TlkycD+}n-SRh!l%#4%|Bg8kt$Q1>-$fVO&B}(OMDS`8
z^E)WPcR4gj(d*rY;vNkXFBB#fh4mQ_kZW^-X~ML;nZfT;V{d=;(gUsS56=ks#Q&lh
z_rTD6rqoJeh1Z<{ZK00Q)qvM-0Ajn{4bIw8Z>Voj-AIYrwmZv^SC@tF;|)OICFtMD
zU^X?h?9J9j_?|H$+alkRR*2dHHDdax;VqzsS?d>0lN-qQg-4fo)fY(h_FZ)*s+u5W
z_7>^$Na#@7na>}HNLu6a=U%*uIie^@!GUm^Zt>r9ksH=sfL139<bwg_h=vTBbxzKi
z|B|GP&38|0ZTul#Pg`|(Q6YdkEf}trg7*BwI_mwi&H?dtJw3^gF;>D>>H)l=^Obr#
zY}|(gO$$#658gsPZTfaWif!tFvoKVTMr);uKK9?O14K%TLaarm3^86>Wo?Nh63b<3
zE22qZa!E}s#AM3PpOiLtbS4J*Na66>Al}l>?1;QT|7z#7>3R<$Z@I`4Z}{GYxCgyY
zFf#RrXJ>g7D!M6VYFNh4&B@yQ^O<~Uk;Y*tkSNh8&6^OItN`q}$lAnubl_2$VJ*mP
zPO@??wHKs<S7oYZkz+<@3(o=9Jn|+T%AuRymOCh0-3U_o&fzY{&gV~L?YdcTmy4?v
zHG`p}hM_AewUTCeA?Hv389Q2IzweN7KMa)R+jD6$$ABAha7aHqU;V;QQ=#o*0jwEe
zP5SYqadSA#hV;wx7BR+c3$`n%xM-?G)&0GAV$A#E+exE=5S_lsBN|#_IUXN62L?dW
z<Le%QLCI$-Jtb=PgRIv&sBOv;EF8PXZAanB+LGoqem=Y182rQ$_9Sq?24`)DE7`L<
ya5r2q<Lb2xK5==hr}O}sl1hezv*#H|`Lz6x6(D*iDZUuG&&&$z&YWCamzGC>Kjdow

literal 1038
zcmV+p1o8U-M@dveQdv+`03lCLBJ5e!gpGb+@Ey~4i3zk{yy7t9RxZ2@JZ6ab3+$U+
z_p+vM9R?S##F90koW9rO+tXB176`}at?g<#7H&*ynqU(s!spuK0?X)!G@f<3%hNqT
zTcDT^so5!{Ni8EpsFi)_5E9`40+tB0J$3CBt(HPM(ioYDhw5<}7Rb!X*mj}V)J%w2
z`z8K8iU(Wr=Ta=|qSGJmJovW>Bc|+(fI}dG8^JY;P>)>#OOeR?7?eQGCAuIciAb>>
zA^VdPz^^&WhI7)Zk0DKi%EWK-GP%CP3x(%63T+kE;N2p~m1V%Jv0F-62};P!HZ|KH
zPMA<dA;9?P#e9y1-IKaY+uj}tls!<8vxlgEI<h>9YYSh>#AiYFRoW(7`UD@&I2YWy
z8L{|IG>opzAhO8F&xks$WF3E6agkl!<wCMN@Zx?RH{ZYJ%EE95U`0!Ml#t2IKw-|j
zJyU1gSm*xn2nPwP=UW1Tk@RS7E<{mc7mRLDJL$4U-a62@L#M0M7Mo{ZyGRV4Wce%G
zpjV1=G}_^~R9m&fT)e`fAEH)--};tFyIUc!-G7l%<bVKx>^0I~*95ysMAwMnI%ymw
zq^gfCWtM_Fxa-~VZ~f4YevWHh24$9snZ6vS=T`y&${YXex&VItO^Lao`;QFYITyvc
zjfV(wahdZHTXD8n0&$2tT!Tk8#(QTiZH6+AZ`y9V^<YQ^Lp|D-K8RYnVa@rg?T2|o
z!5yAb3CFt2o;4~jG7S^G(_kH`#HNLsTNOFDZKCcN-C>1jDg=Iu63T(A3FsjH{&o$J
z*PT@C4zJFgRHl_1?Ek&;p}d&jaatkhnt##9I7823;#E2-VgO^TIF0;@0IhAr4hawo
z!WdT6;BW4L0Stp8x<3<7`t_02S_=K<U2tZ<?YWAa*KzrD#Q4N>Q|ij`ND-U=J}Ib8
zWXDjcet<L;J8#zOWLZ2ISMQC)P2=<pDtR{SIY<!VhsjVBeYT_(Xj>4#x>iTlm>dl<
zA|PD#o-Z_prj8h%TpDvhFT=ZX<e-QwGx)PEGLRVBv{DN>cT1Wbb+)3ZMW3r;REEVz
zJhX~}*<}2LNHGMeNnY&K(@5bUW#-Ih6;%fF*00MU%16MTT<a;_{zh^IenNWkv26`A
zSB1udMvle-z~_v?_;Tbdvit-w*z1k+>*45Fe&6(<(SgaLNzlU<N!qp!WL@1jQYiP4
zILecxNV8*TKraV@A_E36ooZry?p*NYLy!#FGD;yb3jX=|f<M>8W<ZWadAHKBT>Kz_
zQ7$@tD+M-^A4SqVH6PksE^IP6IGxUs&ip?Yq$1ZFISXZ$++dwqdjj|eHkasvT#q~1
I`>f9~t5dxKWB>pF


From d79cce90565b0589a368b74dcfd187145fe06f27 Mon Sep 17 00:00:00 2001
From: Chris Lovering <chris.lovering.95@gmail.com>
Date: Sun, 4 Oct 2026 18:54:16 +0100
Subject: [PATCH 2/2] Give bot a bearer token for polonium

---
 kubernetes/namespaces/bots/bot/deployment.yaml      | 12 ++++++++++++
 kubernetes/namespaces/bots/bot/service-account.yaml |  5 +++++
 2 files changed, 17 insertions(+)
 create mode 100644 kubernetes/namespaces/bots/bot/service-account.yaml

diff --git a/kubernetes/namespaces/bots/bot/deployment.yaml b/kubernetes/namespaces/bots/bot/deployment.yaml
index d61d3ad2..0ab8e5be 100644
--- a/kubernetes/namespaces/bots/bot/deployment.yaml
+++ b/kubernetes/namespaces/bots/bot/deployment.yaml
@@ -17,6 +17,8 @@ spec:
         fsGroup: 2000
         runAsUser: 1000
         runAsNonRoot: true
+      serviceAccountName: bot
+      automountServiceAccountToken: false
       containers:
       - name: bot
         image: ghcr.io/python-discord/bot:latest
@@ -40,6 +42,9 @@ spec:
           name: logs-vol
         - mountPath: /.cache/python-tldextract
           name: tldextract-cache
+        - mountPath: /var/run/secrets/polonium-api
+          name: polonium-api-token
+          readOnly: true
         securityContext:
           readOnlyRootFilesystem: true
       volumes:
@@ -47,3 +52,10 @@ spec:
         emptyDir: {}
       - name: tldextract-cache
         emptyDir: {}
+      - name: polonium-api-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              audience: external-read
+              expirationSeconds: 600
diff --git a/kubernetes/namespaces/bots/bot/service-account.yaml b/kubernetes/namespaces/bots/bot/service-account.yaml
new file mode 100644
index 00000000..93f39fe7
--- /dev/null
+++ b/kubernetes/namespaces/bots/bot/service-account.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bot
+  namespace: bots