feat: deploy n8n on the cluster

The runtime for the estate's autonomous agents. Postgres as a StatefulSet with
its own claim, n8n behind a cert-manager certificate and the nginx ingress, and
both secrets in Vault behind an AppRole scoped to n8n/* alone.

The certificate is issued into the cluster rather than copied into the repo, so
the private key never reaches git. The CA certificate is committed and mounted
as NODE_EXTRA_CA_CERTS, so a workflow can reach keycloak and the domain
gateways without anyone disabling verification to make it work.

One replica and strategy: Recreate, both deliberate — n8n needs Redis and queue
mode before a second scheduler is safe, and a ReadWriteOnce volume deadlocks a
rolling update.

N8N_ENCRYPTION_KEY is generated once and kept in Vault. Regenerating it does not
re-encrypt the stored credentials, it orphans them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

This commit is contained in:

Stéphane Tailland

2026-08-29 12:34:40 +02:00

commit dc13738e86

17 changed files with 552 additions and 0 deletions

									
										k8s/postgres/service.yaml
									
		+12
		
												View File
												
				@@ -0,0 +1,12 @@

				apiVersion: v1

				kind: Service

				metadata:

				  name: n8n-postgres

				  namespace: n8n

				spec:

				  selector:

				    app: n8n-postgres

				  ports:

				    - name: postgres

				      port: 5432

				      targetPort: postgres