optional: true covers a Secret that does not exist; it does not cover the
variable being unset. Flux substitutes in strict mode, so the unused second
slot failed the whole build and every change to this repo since has silently
stopped reaching the cluster.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
n8n's webhook, form and mcp endpoints carry no authentication of their own, and
for an automation platform those endpoints are the platform: whatever a
workflow reads or changes answers an unauthenticated request. The editor's
login protects the editor and nothing else.
N8N_WEBHOOK_AUTH_URL is required rather than optional — there is no way to
deploy this without naming an authenticator.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A deployment's workflow environment usually comes from more than one owner —
credentials the platform holds, and credentials the workflows' own estate holds.
Both slots are optional, so an unused one needs no placeholder Secret.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Every environment value is a ${VAR} for the caller to substitute: hostname,
images, storage, ingress class, TLS issuer, Vault server and path, timezone,
retention. Nothing in k8s/ names a host, a realm, an agent or an estate.
Removed: the Flux plumbing under dev/, which described one deployment, and the
ExternalSecret pulling a specific agent's Keycloak client secret. Both belong to
whoever deploys this. The lab CA ConfigMap goes with them — the mount stays,
parameterised and marked optional, because 'trust a private CA' is a property of
an environment and not of n8n.
The README is now the template's: how to consume it, what every variable means,
and the three things it deliberately does not do.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
git commit -a stages tracked files only, so the Kustomization shipped a
reference to a manifest that was never pushed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The agents' Keycloak client secrets reach the pod through the keycloak store,
naming the one property each workflow needs rather than copying it into n8n's
own Vault path — one source for a client secret, so rotating it in Vault
rotates it everywhere.
N8N_BLOCK_ENV_ACCESS_IN_NODE=false so a workflow can read them as $env, which
keeps them out of the committed workflow JSON. The trade-off is written down in
the ConfigMap: any workflow can then read any variable in the pod, which is
acceptable while this instance runs only this estate's agents.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The runtime for the estate's autonomous agents. Postgres as a StatefulSet with
its own claim, n8n behind a cert-manager certificate and the nginx ingress, and
both secrets in Vault behind an AppRole scoped to n8n/* alone.
The certificate is issued into the cluster rather than copied into the repo, so
the private key never reaches git. The CA certificate is committed and mounted
as NODE_EXTRA_CA_CERTS, so a workflow can reach keycloak and the domain
gateways without anyone disabling verification to make it work.
One replica and strategy: Recreate, both deliberate — n8n needs Redis and queue
mode before a second scheduler is safe, and a ReadWriteOnce volume deadlocks a
rolling update.
N8N_ENCRYPTION_KEY is generated once and kept in Vault. Regenerating it does not
re-encrypt the stored credentials, it orphans them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Stéphane Tailland