Stéphane Tailland
f9511fd15d
The values that infra-n8n deliberately does not carry: our hostname, issuer, Vault path and images, plus the two things that are ours alone — the lab CA the workflows need to verify internal TLS, and the agents' Keycloak client secrets, read from the realm's own Vault entry so there is one source per secret. Self-managing after three applies, like the rest of the estate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
846 B
YAML
25 lines
846 B
YAML
# The agents' Keycloak client secrets, for the workflows that act as those
|
|
# agents. Read from the realm's own Vault entry rather than copied into n8n's
|
|
# path: there is one source for a client secret, and rotating it in Vault
|
|
# rotates it everywhere instead of leaving a stale twin behind.
|
|
#
|
|
# A narrow grant — this names the properties it wants, so the namespace receives
|
|
# those and nothing else of the realm.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: n8n-agent-secrets
|
|
namespace: n8n
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-keycloak
|
|
target:
|
|
name: n8n-agent-secrets
|
|
data:
|
|
- secretKey: APPROVISIONNEMENT_CLIENT_SECRET
|
|
remoteRef:
|
|
key: keycloak/classic-models-realm
|
|
property: KC_SECRET_CLASSIC_MODELS_AGENT_APPROVISIONNEMENT
|