Stéphane Tailland
ba11cc62eb
A ConfigMap's data values must be strings and this template cannot enforce it: kustomize re-serialises before Flux substitutes, stripping quotes and !!str alike, so a value that looks numeric or boolean parses as one and the apply fails on the type. The quotes have to be inside the substituted value. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
2.1 KiB
YAML
52 lines
2.1 KiB
YAML
# A ConfigMap's data values must be **strings**, and this file cannot enforce
|
|
# that: kustomize re-serialises before Flux substitutes, stripping both quotes
|
|
# and an `!!str` tag, so `${VAR}` is always bare by the time a value lands in it.
|
|
# A value that then looks like a number or a boolean parses as one and the apply
|
|
# fails on the type.
|
|
#
|
|
# So any value substituted here that is not obviously text must carry its own
|
|
# quotes in the substitution map:
|
|
#
|
|
# EXECUTIONS_MAX_AGE_HOURS: '"336"'
|
|
# BLOCK_ENV_ACCESS: '"false"'
|
|
#
|
|
# Nothing here is sensitive. The two values that are — the database password and
|
|
# the credential encryption key — arrive through n8n-secrets.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: n8n-config
|
|
namespace: ${NAMESPACE}
|
|
data:
|
|
GENERIC_TIMEZONE: ${TIMEZONE}
|
|
TZ: ${TIMEZONE}
|
|
NODE_ENV: production
|
|
|
|
# What n8n believes it is reachable at. It goes into the webhook URLs it
|
|
# generates and into the links it puts in its own UI, so it must be the
|
|
# ingress host and not the Service — a webhook advertised as `n8n` inside the
|
|
# cluster is a webhook nothing outside can call.
|
|
N8N_HOST: ${N8N_HOSTNAME}
|
|
N8N_PORT: "5678"
|
|
N8N_PROTOCOL: https
|
|
WEBHOOK_URL: https://${N8N_HOSTNAME}/
|
|
N8N_EDITOR_BASE_URL: https://${N8N_HOSTNAME}/
|
|
|
|
# TLS terminates at the ingress, so n8n itself serves plain HTTP and must be
|
|
# told it is behind a proxy — otherwise it reads the hop's address instead of
|
|
# the caller's.
|
|
N8N_PROXY_HOPS: "1"
|
|
|
|
# The default is to keep every execution for ever, which turns the database
|
|
# into a log. Two weeks is long enough to debug a failed run.
|
|
EXECUTIONS_DATA_PRUNE: "true"
|
|
EXECUTIONS_DATA_MAX_AGE: ${EXECUTIONS_MAX_AGE_HOURS}
|
|
N8N_DIAGNOSTICS_ENABLED: "false"
|
|
N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
|
|
N8N_RUNNERS_ENABLED: "true"
|
|
|
|
# "false" lets a workflow read `$env.<NAME>`, which is how a secret reaches a
|
|
# workflow without being stored in the workflow JSON. n8n blocks it by
|
|
# default, and that default is right wherever more than one team can write a
|
|
# workflow: any workflow can then read any variable in the pod.
|
|
N8N_BLOCK_ENV_ACCESS_IN_NODE: ${BLOCK_ENV_ACCESS} |