# Two values, both of which must outlive any pod.
#
# N8N_ENCRYPTION_KEY encrypts the credentials n8n stores in its database. Lose
# it and every stored credential becomes unreadable — the workflows survive, the
# credentials do not. It is generated once and kept in Vault for that reason,
# never regenerated on a redeploy.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: n8n-secrets
  namespace: n8n
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-n8n
  target:
    name: n8n-secrets
    creationPolicy: Owner
  dataFrom:
    - extract:
        key: n8n/instance