git commit -a stages tracked files only, so the Kustomization shipped a
reference to a manifest that was never pushed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The agents' Keycloak client secrets reach the pod through the keycloak store,
naming the one property each workflow needs rather than copying it into n8n's
own Vault path — one source for a client secret, so rotating it in Vault
rotates it everywhere.
N8N_BLOCK_ENV_ACCESS_IN_NODE=false so a workflow can read them as $env, which
keeps them out of the committed workflow JSON. The trade-off is written down in
the ConfigMap: any workflow can then read any variable in the pod, which is
acceptable while this instance runs only this estate's agents.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The runtime for the estate's autonomous agents. Postgres as a StatefulSet with
its own claim, n8n behind a cert-manager certificate and the nginx ingress, and
both secrets in Vault behind an AppRole scoped to n8n/* alone.
The certificate is issued into the cluster rather than copied into the repo, so
the private key never reaches git. The CA certificate is committed and mounted
as NODE_EXTRA_CA_CERTS, so a workflow can reach keycloak and the domain
gateways without anyone disabling verification to make it work.
One replica and strategy: Recreate, both deliberate — n8n needs Redis and queue
mode before a second scheduler is safe, and a ReadWriteOnce volume deadlocks a
rolling update.
N8N_ENCRYPTION_KEY is generated once and kept in Vault. Regenerating it does not
re-encrypt the stored credentials, it orphans them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Stéphane Tailland