Stéphane Tailland
c4747a6149
git commit -a stages tracked files only, so the Kustomization shipped a reference to a manifest that was never pushed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
889 B
YAML
25 lines
889 B
YAML
# The agents' Keycloak client secrets, for the workflows that act as those
|
|
# agents. Read from the realm's own Vault entry through the keycloak store, not
|
|
# copied into `n8n/*`: there is one source for a client secret, and rotating it
|
|
# in Vault rotates it everywhere rather than leaving a stale twin behind.
|
|
#
|
|
# It is a narrow grant — this ExternalSecret names the properties it wants, so
|
|
# the n8n namespace receives those and nothing else of the realm.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: n8n-agent-secrets
|
|
namespace: n8n
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-keycloak
|
|
target:
|
|
name: n8n-agent-secrets
|
|
data:
|
|
- secretKey: APPROVISIONNEMENT_CLIENT_SECRET
|
|
remoteRef:
|
|
key: keycloak/classic-models-realm
|
|
property: KC_SECRET_CLASSIC_MODELS_AGENT_APPROVISIONNEMENT
|