Managed GitHub worker credentials

Self-hosted Kubernetes

Enrolled workspaces use separate browser control and background worker credentials.

Managed GitHub connections are available only for workspaces enrolled in the staged rollout. Existing customer-managed GitHub Apps and personal access tokens continue to use their current configuration.

For an enrolled workspace, the optional githubConnect.worker Helm values mount a dedicated worker credential separately from the browser control credential:

githubConnect:
  worker:
    enabled: true
    tenantID: replace-with-enrolled-broker-tenant-id
    existingSecret: workspace-github-worker
    credentialKey: worker

These values supplement the workspace's enrolled githubConnect configuration. The worker Secret must differ from the control Secret. The chart projects only the selected key, and credential updates propagate through a read-only directory mount. Keep staging and production enrollment IDs, App identities, and Secrets separate. Leave the worker disabled until your rollout procedure calls for it. Mounting a credential alone does not connect GitHub, migrate repository data, or complete repository onboarding. See Managed GitHub App connection.