Stéphane Tailland
a658976f45
The agents' Keycloak client secrets reach the pod through the keycloak store, naming the one property each workflow needs rather than copying it into n8n's own Vault path — one source for a client secret, so rotating it in Vault rotates it everywhere. N8N_BLOCK_ENV_ACCESS_IN_NODE=false so a workflow can read them as $env, which keeps them out of the committed workflow JSON. The trade-off is written down in the ConfigMap: any workflow can then read any variable in the pod, which is acceptable while this instance runs only this estate's agents. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
17 lines
417 B
YAML
17 lines
417 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
- ca-configmap.yaml
|
|
- secrets/clustersecretstore.yaml
|
|
- secrets/externalsecret.yaml
|
|
- secrets/agent-externalsecret.yaml
|
|
- postgres/statefulset.yaml
|
|
- postgres/service.yaml
|
|
- n8n/pvc.yaml
|
|
- n8n/configmap.yaml
|
|
- n8n/deployment.yaml
|
|
- n8n/service.yaml
|
|
- ingress/certificate.yaml
|
|
- ingress/ingress.yaml
|