A ConfigMap's data values must be strings. EXECUTIONS_DATA_MAX_AGE and
N8N_BLOCK_ENV_ACCESS_IN_NODE resolved to a number and a boolean, and the apply
failed on the type.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
optional: true covers a Secret that does not exist; it does not cover the
variable being unset. Flux substitutes in strict mode, so the unused second
slot failed the whole build and every change to this repo since has silently
stopped reaching the cluster.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A deployment's workflow environment usually comes from more than one owner —
credentials the platform holds, and credentials the workflows' own estate holds.
Both slots are optional, so an unused one needs no placeholder Secret.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Every environment value is a ${VAR} for the caller to substitute: hostname,
images, storage, ingress class, TLS issuer, Vault server and path, timezone,
retention. Nothing in k8s/ names a host, a realm, an agent or an estate.
Removed: the Flux plumbing under dev/, which described one deployment, and the
ExternalSecret pulling a specific agent's Keycloak client secret. Both belong to
whoever deploys this. The lab CA ConfigMap goes with them — the mount stays,
parameterised and marked optional, because 'trust a private CA' is a property of
an environment and not of n8n.
The README is now the template's: how to consume it, what every variable means,
and the three things it deliberately does not do.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The agents' Keycloak client secrets reach the pod through the keycloak store,
naming the one property each workflow needs rather than copying it into n8n's
own Vault path — one source for a client secret, so rotating it in Vault
rotates it everywhere.
N8N_BLOCK_ENV_ACCESS_IN_NODE=false so a workflow can read them as $env, which
keeps them out of the committed workflow JSON. The trade-off is written down in
the ConfigMap: any workflow can then read any variable in the pod, which is
acceptable while this instance runs only this estate's agents.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The runtime for the estate's autonomous agents. Postgres as a StatefulSet with
its own claim, n8n behind a cert-manager certificate and the nginx ingress, and
both secrets in Vault behind an AppRole scoped to n8n/* alone.
The certificate is issued into the cluster rather than copied into the repo, so
the private key never reaches git. The CA certificate is committed and mounted
as NODE_EXTRA_CA_CERTS, so a workflow can reach keycloak and the domain
gateways without anyone disabling verification to make it work.
One replica and strategy: Recreate, both deliberate — n8n needs Redis and queue
mode before a second scheduler is safe, and a ReadWriteOnce volume deadlocks a
rolling update.
N8N_ENCRYPTION_KEY is generated once and kept in Vault. Regenerating it does not
re-encrypt the stored credentials, it orphans them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Stéphane Tailland