Stéphane Tailland
0847e11713
Every webhook on this instance was answering unauthenticated requests, the stock watchlist included — it returned references and stock levels and let anyone clear entries. The A2A facade in front of these workflows enforces a bearer, but the workflows stayed reachable directly, facade bypassed. Keycloak's userinfo is the authenticator: 200 for a valid bearer in the realm, 401 otherwise, which is the auth-request contract exactly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
56 lines
2.3 KiB
YAML
56 lines
2.3 KiB
YAML
# This estate's n8n: the template from infra-n8n, with our values.
|
|
#
|
|
# Everything specific lives here rather than in that repo, so the same template
|
|
# deploys somebody else's n8n without carrying ours.
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: n8n
|
|
namespace: n8n
|
|
spec:
|
|
interval: 10m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: infra-n8n
|
|
path: ./k8s
|
|
prune: true
|
|
wait: true
|
|
timeout: 5m
|
|
postBuild:
|
|
substitute:
|
|
NAMESPACE: n8n
|
|
N8N_HOSTNAME: n8n.sttlab.local
|
|
N8N_IMAGE: docker.n8n.io/n8nio/n8n:2.37.4
|
|
POSTGRES_IMAGE: postgres:16.10-alpine
|
|
N8N_STORAGE: 2Gi
|
|
POSTGRES_STORAGE: 5Gi
|
|
TIMEZONE: Europe/Paris
|
|
INGRESS_CLASS: nginx
|
|
INGRESS_BODY_SIZE: "50m"
|
|
# Every trigger endpoint is gated by this. Keycloak's userinfo answers 200
|
|
# for a valid bearer in the realm and 401 otherwise, which is exactly the
|
|
# auth-request contract, so nothing had to be built for it. In-cluster,
|
|
# over http: the subrequest never leaves the cluster and needs no CA.
|
|
#
|
|
# It authenticates, it does not authorise: any token this realm issued
|
|
# gets through, including an agent's own service account. The finer grain
|
|
# belongs to the workflow, which exchanges the caller's token and is
|
|
# refused by the domain if the caller may not read it.
|
|
N8N_WEBHOOK_AUTH_URL: http://keycloak.keycloak.svc.cluster.local:8080/realms/classic-models/protocol/openid-connect/userinfo
|
|
TLS_ISSUER_NAME: sttlab-local-ca
|
|
TLS_ISSUER_KIND: ClusterIssuer
|
|
VAULT_SERVER: https://vault.sttlab.eu
|
|
VAULT_MOUNT: secrets
|
|
VAULT_SECRET_PATH: n8n/instance
|
|
VAULT_STORE_NAME: vault-n8n
|
|
VAULT_APPROLE_SECRET: vault-approle-n8n
|
|
# The agents' Keycloak client secrets, so a workflow can exchange tokens
|
|
# as the agent it represents. Created by agent-secrets.yaml beside this.
|
|
EXTRA_ENV_SECRET: n8n-agent-secrets
|
|
EXTRA_CA_CONFIGMAP: sttlab-ca
|
|
# "false" so a workflow can read $env.<AGENT>_CLIENT_SECRET. It means any
|
|
# workflow on this instance can read any variable in the pod — acceptable
|
|
# while it runs only this estate's agents, and not a moment longer.
|
|
BLOCK_ENV_ACCESS: "false"
|
|
EXECUTIONS_MAX_AGE_HOURS: "336"
|