Stéphane Tailland
dc13738e86
The runtime for the estate's autonomous agents. Postgres as a StatefulSet with its own claim, n8n behind a cert-manager certificate and the nginx ingress, and both secrets in Vault behind an AppRole scoped to n8n/* alone. The certificate is issued into the cluster rather than copied into the repo, so the private key never reaches git. The CA certificate is committed and mounted as NODE_EXTRA_CA_CERTS, so a workflow can reach keycloak and the domain gateways without anyone disabling verification to make it work. One replica and strategy: Recreate, both deliberate — n8n needs Redis and queue mode before a second scheduler is safe, and a ReadWriteOnce volume deadlocks a rolling update. N8N_ENCRYPTION_KEY is generated once and kept in Vault. Regenerating it does not re-encrypt the stored credentials, it orphans them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
16 lines
379 B
YAML
16 lines
379 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- namespace.yaml
|
|
- ca-configmap.yaml
|
|
- secrets/clustersecretstore.yaml
|
|
- secrets/externalsecret.yaml
|
|
- postgres/statefulset.yaml
|
|
- postgres/service.yaml
|
|
- n8n/pvc.yaml
|
|
- n8n/configmap.yaml
|
|
- n8n/deployment.yaml
|
|
- n8n/service.yaml
|
|
- ingress/certificate.yaml
|
|
- ingress/ingress.yaml
|