Initial commit

apps/n8n/manifests/cnpg-secrets.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: n8n-cnpg-secret
+  namespace: n8n
+spec:
+  length: 42
+  digits: 5
+  symbols: 5
+  symbolCharacters: "-_$@"
+  noUpper: false
+  allowRepeat: true
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: n8n-cnpg-secret
+  namespace: n8n
+spec:
+  # Rotate database password every 24 hours
+  refreshInterval: "24h"
+  target:
+    # This will merge the generated password into the existing pg-n8n-app secret
+    name: pg-n8n-app
+    creationPolicy: Merge
+    template:
+      metadata:
+        labels:
+          cnpg.io/reload: "true"
+      data:
+        # Override the password field with our ESO-generated password
+        password: "{{ .password }}"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: n8n-cnpg-secret