Stéphane Tailland
a658976f45
The agents' Keycloak client secrets reach the pod through the keycloak store, naming the one property each workflow needs rather than copying it into n8n's own Vault path — one source for a client secret, so rotating it in Vault rotates it everywhere. N8N_BLOCK_ENV_ACCESS_IN_NODE=false so a workflow can read them as $env, which keeps them out of the committed workflow JSON. The trade-off is written down in the ConfigMap: any workflow can then read any variable in the pod, which is acceptable while this instance runs only this estate's agents. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
116 lines
3.6 KiB
YAML
116 lines
3.6 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: n8n
|
|
namespace: n8n
|
|
spec:
|
|
# One replica. n8n's queue mode splits the editor from workers and needs Redis
|
|
# to do it; without that, a second replica is two schedulers racing over the
|
|
# same cron triggers. See the README before scaling this.
|
|
replicas: 1
|
|
strategy:
|
|
# The volume is ReadWriteOnce, so a rolling update deadlocks: the new pod
|
|
# waits for a volume the old pod has not released.
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: n8n
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: n8n
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
fsGroup: 1000
|
|
initContainers:
|
|
- name: wait-for-postgres
|
|
image: postgres:16.10-alpine
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
until pg_isready -h n8n-postgres -U n8n -d n8n; do
|
|
echo "waiting for postgres..."; sleep 3
|
|
done
|
|
containers:
|
|
- name: n8n
|
|
image: docker.n8n.io/n8nio/n8n:2.37.4
|
|
ports:
|
|
- name: http
|
|
containerPort: 5678
|
|
env:
|
|
- name: DB_TYPE
|
|
value: postgresdb
|
|
- name: DB_POSTGRESDB_HOST
|
|
value: n8n-postgres
|
|
- name: DB_POSTGRESDB_PORT
|
|
value: "5432"
|
|
- name: DB_POSTGRESDB_DATABASE
|
|
value: n8n
|
|
- name: DB_POSTGRESDB_USER
|
|
value: n8n
|
|
- name: DB_POSTGRESDB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: n8n-secrets
|
|
key: DB_PASSWORD
|
|
# Encrypts stored credentials. Held in Vault, never regenerated —
|
|
# a new key does not re-encrypt, it orphans everything already
|
|
# stored.
|
|
- name: N8N_ENCRYPTION_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: n8n-secrets
|
|
key: N8N_ENCRYPTION_KEY
|
|
# The lab CA, so a workflow can call keycloak.sttlab.local and the
|
|
# domain gateways without disabling verification. n8n is Node, hence
|
|
# this variable rather than a trust store.
|
|
- name: NODE_EXTRA_CA_CERTS
|
|
value: /etc/sttlab-ca/ca.crt
|
|
envFrom:
|
|
- configMapRef:
|
|
name: n8n-config
|
|
# The agents' Keycloak client secrets, reached from a workflow as
|
|
# `$env.APPROVISIONNEMENT_CLIENT_SECRET`. A workflow acts as its
|
|
# agent, so it is the workflow that must be able to exchange tokens.
|
|
- secretRef:
|
|
name: n8n-agent-secrets
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /home/node/.n8n
|
|
- name: sttlab-ca
|
|
mountPath: /etc/sttlab-ca
|
|
readOnly: true
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 20
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: n8n-data
|
|
- name: sttlab-ca
|
|
configMap:
|
|
name: sttlab-ca
|