Fix n8n, gitlab, and netbird-operator degraded states

- n8n: Set replicaCount=1 (RWO PVC incompatible with multiple replicas),
  add resource limits to satisfy Kyverno policy
- gitlab: Add ignoreDifferences for redis-gitlab-additional service
  (port names and selectors managed by Redis operator)
- netbird-operator: Add ExternalSecret for netbird-mgmt-api-key in
  netbird namespace and add manifests source to Application

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/n8n/values.yaml

@@ -40,8 +40,8 @@ config:
 secret: {}
 
 # --- Deployment replicas ---
-# Increased to 2 for high availability and faster response times
-replicaCount: 2
+# Single replica required: RWO PVC can't be shared across pods on different nodes
+replicaCount: 1
 
 # --- Service configuration ---
 service:
@@ -72,11 +72,13 @@ persistence:
   size: 10Gi
 
 # --- Resources ---
-# No CPU limits (burst allowed). Keep requests minimal for scheduling.
 resources:
   requests:
     cpu: 100m
     memory: 512Mi
+  limits:
+    cpu: "1"
+    memory: 1Gi
 
 # --- Startup probe ---
 # Allows app to start without being killed by liveness probe

argocd-apps/apps/gitlab.yaml

@@ -25,6 +25,14 @@ spec:
   destination:
     server: https://kubernetes.default.svc
     namespace: gitlab
+  ignoreDifferences:
+    # Redis operator reconciles this service with different port names and selectors
+    - group: ""
+      kind: Service
+      name: redis-gitlab-additional
+      jsonPointers:
+        - /spec/ports
+        - /spec/selector
   syncPolicy:
     automated:
       prune: true

argocd-apps/infrastructure/netbird-operator.yaml

@@ -19,6 +19,9 @@ spec:
     - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
       targetRevision: main
       ref: values
+    - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+      targetRevision: main
+      path: infrastructure/netbird-operator/manifests
   destination:
     server: https://kubernetes.default.svc
     namespace: netbird

infrastructure/netbird-operator/manifests/external-secret.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: netbird-mgmt-api-key
+  namespace: netbird
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: netbird-mgmt-api-key
+    creationPolicy: Owner
+  data:
+    - secretKey: NB_API_KEY
+      remoteRef:
+        key: netbird-api-token
+        property: api-token