Fallback to K8s SA token for PLATFORM_SERVICE_JWT

Use the Kubernetes pod service account token as a fallback for PLATFORM_SERVICE_JWT when no explicit env var is provided. Adds K8S_SA_TOKEN_PATH (with a default of /var/run/secrets/kubernetes.io/serviceaccount/token) and a helper _read_k8s_sa_token() that safely reads the token file (handling missing/permission errors). PLATFORM_SERVICE_JWT is now populated from the env var or the token file, allowing in-cluster authentication without injecting a JWT.

Author: edwinjosechittilappilly

src/config/settings.py

@@ -71,7 +71,21 @@
 # OPENRAG_BOOTSTRAP_OS_SECURITY_ON_STARTUP is on, lifespan decodes this
 # token to derive the admin username used to bootstrap the OpenSearch
 # security context (roles + all_access mapping).
-PLATFORM_SERVICE_JWT = os.getenv("PLATFORM_SERVICE_JWT")
+# Falls back to the pod's Kubernetes service account token when running
+# inside a cluster and no explicit JWT is injected.
+_DEFAULT_K8S_SA_TOKEN_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+K8S_SA_TOKEN_PATH = os.getenv("K8S_SA_TOKEN_PATH", _DEFAULT_K8S_SA_TOKEN_PATH)
+
+
+def _read_k8s_sa_token() -> str | None:
+    try:
+        with open(K8S_SA_TOKEN_PATH) as f:
+            return f.read().strip() or None
+    except (FileNotFoundError, PermissionError):
+        return None
+
+
+PLATFORM_SERVICE_JWT = os.getenv("PLATFORM_SERVICE_JWT") or _read_k8s_sa_token()
 IBM_JWT_PUBLIC_KEY_URL = os.getenv("IBM_JWT_PUBLIC_KEY_URL", "")
 IBM_SESSION_COOKIE_NAME = os.getenv("IBM_SESSION_COOKIE_NAME", "ibm-openrag-session")
 IBM_CREDENTIALS_HEADER = os.getenv("IBM_CREDENTIALS_HEADER", "X-IBM-LH-Credentials")