stt/infra-n8n
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: a second environment-secret slot

Browse Source 
A deployment's workflow environment usually comes from more than one owner —
credentials the platform holds, and credentials the workflows' own estate holds.
Both slots are optional, so an unused one needs no placeholder Secret.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Stéphane Tailland
2026-08-29 17:42:31 +02:00
parent d68d20c6f4
commit f0363748b6
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -51,7 +51,7 @@ The namespace must exist first, and so must the AppRole Secret the store reads.
| `TLS_ISSUER_NAME`, `TLS_ISSUER_KIND` | a cert-manager issuer, e.g. `ClusterIssuer` | | `TLS_ISSUER_NAME`, `TLS_ISSUER_KIND` | a cert-manager issuer, e.g. `ClusterIssuer` |
| `VAULT_SERVER`, `VAULT_MOUNT`, `VAULT_SECRET_PATH` | where the two secrets live | | `VAULT_SERVER`, `VAULT_MOUNT`, `VAULT_SECRET_PATH` | where the two secrets live |
| `VAULT_STORE_NAME`, `VAULT_APPROLE_SECRET` | the `ClusterSecretStore` this creates, and the AppRole Secret in `external-secrets` it authenticates with | | `VAULT_STORE_NAME`, `VAULT_APPROLE_SECRET` | the `ClusterSecretStore` this creates, and the AppRole Secret in `external-secrets` it authenticates with |
| `EXTRA_ENV_SECRET` | a Secret whose keys become environment variables for workflows. Optional in intent — supply an empty Secret if there is nothing | | `EXTRA_ENV_SECRET`, `EXTRA_ENV_SECRET_2` | Secrets whose keys become environment variables for workflows. Two slots, because a deployment's environment usually comes from more than one owner. Both `optional`, so an unused slot needs no placeholder |
| `EXTRA_CA_CONFIGMAP` | a ConfigMap with `ca.crt`, mounted and set as `NODE_EXTRA_CA_CERTS`, so workflows can call internal TLS endpoints without verification being disabled. Marked `optional`, so an absent one is not an error | | `EXTRA_CA_CONFIGMAP` | a ConfigMap with `ca.crt`, mounted and set as `NODE_EXTRA_CA_CERTS`, so workflows can call internal TLS endpoints without verification being disabled. Marked `optional`, so an absent one is not an error |
| `BLOCK_ENV_ACCESS` | `"true"` blocks `$env` in workflow expressions. n8n's default, and the right one wherever more than one team writes workflows: any workflow can otherwise read any variable in the pod. `"false"` is how a secret reaches a workflow without being committed in its JSON | | `BLOCK_ENV_ACCESS` | `"true"` blocks `$env` in workflow expressions. n8n's default, and the right one wherever more than one team writes workflows: any workflow can otherwise read any variable in the pod. `"false"` is how a secret reaches a workflow without being committed in its JSON |
| `EXECUTIONS_MAX_AGE_HOURS` | how long executions are kept. n8n keeps them for ever by default, which turns the database into a log | | `EXECUTIONS_MAX_AGE_HOURS` | how long executions are kept. n8n keeps them for ever by default, which turns the database into a log |
k8s/n8n/deployment.yaml
+9
View File
@@ -78,8 +78,17 @@ spec:
# Whatever else this deployment's workflows need in their # Whatever else this deployment's workflows need in their
# environment. Provided by the deployment, not by this repo: an # environment. Provided by the deployment, not by this repo: an
# empty Secret of that name is a valid answer. # empty Secret of that name is a valid answer.
#
# Two slots rather than one, because a deployment's environment
# usually comes from more than one owner — credentials the platform
# holds, and credentials a workflow's own estate holds. Both are
# marked optional, so an unused slot needs no placeholder Secret.
- secretRef: - secretRef:
name: ${EXTRA_ENV_SECRET} name: ${EXTRA_ENV_SECRET}
optional: true
- secretRef:
name: ${EXTRA_ENV_SECRET_2}
optional: true
volumeMounts: volumeMounts:
- name: data - name: data
mountPath: /home/node/.n8n mountPath: /home/node/.n8n