Jwks auth to polonium

kubernetes/namespaces/bots/bot/deployment.yaml

@@ -17,6 +17,8 @@ spec:
         fsGroup: 2000
         runAsUser: 1000
         runAsNonRoot: true
+      serviceAccountName: bot
+      automountServiceAccountToken: false
       containers:
       - name: bot
         image: ghcr.io/python-discord/bot:latest
@@ -40,10 +42,20 @@ spec:
           name: logs-vol
         - mountPath: /.cache/python-tldextract
           name: tldextract-cache
+        - mountPath: /var/run/secrets/polonium-api
+          name: polonium-api-token
+          readOnly: true
         securityContext:
           readOnlyRootFilesystem: true
       volumes:
       - name: logs-vol
         emptyDir: {}
       - name: tldextract-cache
         emptyDir: {}
+      - name: polonium-api-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              audience: external-read
+              expirationSeconds: 600

kubernetes/namespaces/bots/bot/service-account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bot
+  namespace: bots