Stéphane Tailland
d68d20c6f4
Every environment value is a ${VAR} for the caller to substitute: hostname,
images, storage, ingress class, TLS issuer, Vault server and path, timezone,
retention. Nothing in k8s/ names a host, a realm, an agent or an estate.
Removed: the Flux plumbing under dev/, which described one deployment, and the
ExternalSecret pulling a specific agent's Keycloak client secret. Both belong to
whoever deploys this. The lab CA ConfigMap goes with them — the mount stays,
parameterised and marked optional, because 'trust a private CA' is a property of
an environment and not of n8n.
The README is now the template's: how to consume it, what every variable means,
and the three things it deliberately does not do.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
23 lines
663 B
YAML
23 lines
663 B
YAML
# Two values, both of which must outlive any pod.
|
|
#
|
|
# N8N_ENCRYPTION_KEY encrypts the credentials n8n stores in its database. Lose
|
|
# it and every stored credential becomes unreadable — the workflows survive, the
|
|
# credentials do not. It is generated once and kept in Vault for that reason,
|
|
# never regenerated on a redeploy.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: n8n-secrets
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: ${VAULT_STORE_NAME}
|
|
target:
|
|
name: n8n-secrets
|
|
creationPolicy: Owner
|
|
dataFrom:
|
|
- extract:
|
|
key: ${VAULT_SECRET_PATH}
|