From c4747a61495e748f337e333ead8168c72d867dc2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Sat, 29 Aug 2026 12:57:48 +0200 Subject: [PATCH] fix: add the file the previous commit referenced git commit -a stages tracked files only, so the Kustomization shipped a reference to a manifest that was never pushed. Co-Authored-By: Claude Opus 5 --- k8s/secrets/agent-externalsecret.yaml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 k8s/secrets/agent-externalsecret.yaml diff --git a/k8s/secrets/agent-externalsecret.yaml b/k8s/secrets/agent-externalsecret.yaml new file mode 100644 index 0000000..658b86f --- /dev/null +++ b/k8s/secrets/agent-externalsecret.yaml @@ -0,0 +1,24 @@ +# The agents' Keycloak client secrets, for the workflows that act as those +# agents. Read from the realm's own Vault entry through the keycloak store, not +# copied into `n8n/*`: there is one source for a client secret, and rotating it +# in Vault rotates it everywhere rather than leaving a stale twin behind. +# +# It is a narrow grant — this ExternalSecret names the properties it wants, so +# the n8n namespace receives those and nothing else of the realm. +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: n8n-agent-secrets + namespace: n8n +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: vault-keycloak + target: + name: n8n-agent-secrets + data: + - secretKey: APPROVISIONNEMENT_CLIENT_SECRET + remoteRef: + key: keycloak/classic-models-realm + property: KC_SECRET_CLASSIC_MODELS_AGENT_APPROVISIONNEMENT