Stéphane Tailland
7ec4ffad37
Its Keycloak client, audience scope, client-secret key, workflow names and file names, and the A2A card. Kafka moved first, under its own account and consumer group. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
824 B
YAML
25 lines
824 B
YAML
# The agents' Keycloak client secrets, for the workflows that act as those
|
|
# agents. Read from the realm's own Vault entry rather than copied into n8n's
|
|
# path: there is one source for a client secret, and rotating it in Vault
|
|
# rotates it everywhere instead of leaving a stale twin behind.
|
|
#
|
|
# A narrow grant — this names the properties it wants, so the namespace receives
|
|
# those and nothing else of the realm.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: n8n-agent-secrets
|
|
namespace: n8n
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-keycloak
|
|
target:
|
|
name: n8n-agent-secrets
|
|
data:
|
|
- secretKey: SUPPLY_CLIENT_SECRET
|
|
remoteRef:
|
|
key: keycloak/classic-models-realm
|
|
property: KC_SECRET_CLASSIC_MODELS_AGENT_SUPPLY
|