Stéphane Tailland
dc13738e86
The runtime for the estate's autonomous agents. Postgres as a StatefulSet with its own claim, n8n behind a cert-manager certificate and the nginx ingress, and both secrets in Vault behind an AppRole scoped to n8n/* alone. The certificate is issued into the cluster rather than copied into the repo, so the private key never reaches git. The CA certificate is committed and mounted as NODE_EXTRA_CA_CERTS, so a workflow can reach keycloak and the domain gateways without anyone disabling verification to make it work. One replica and strategy: Recreate, both deliberate — n8n needs Redis and queue mode before a second scheduler is safe, and a ReadWriteOnce volume deadlocks a rolling update. N8N_ENCRYPTION_KEY is generated once and kept in Vault. Regenerating it does not re-encrypt the stored credentials, it orphans them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
23 lines
636 B
YAML
23 lines
636 B
YAML
# Two values, both of which must outlive any pod.
|
|
#
|
|
# N8N_ENCRYPTION_KEY encrypts the credentials n8n stores in its database. Lose
|
|
# it and every stored credential becomes unreadable — the workflows survive, the
|
|
# credentials do not. It is generated once and kept in Vault for that reason,
|
|
# never regenerated on a redeploy.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: n8n-secrets
|
|
namespace: n8n
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-n8n
|
|
target:
|
|
name: n8n-secrets
|
|
creationPolicy: Owner
|
|
dataFrom:
|
|
- extract:
|
|
key: n8n/instance
|