Added kubectl to n8n

Reviewed-on: #127

k8s/apps/n8n/deployment-main.yaml

@@ -19,6 +19,35 @@ spec:
         component: main
     spec:
       serviceAccountName: n8n
+      initContainers:
+      - name: install-tools
+        image: alpine:3.22
+        command:
+        - /bin/sh
+        - -c
+        - |
+          set -e
+          if [ -x /tools/kubectl ]; then
+            echo "kubectl already exists, skipping download"
+            /tools/kubectl version --client
+            exit 0
+          fi
+          echo "Downloading kubectl..."
+          ARCH=$(uname -m)
+          case $ARCH in
+            x86_64) ARCH="amd64" ;;
+            aarch64) ARCH="arm64" ;;
+          esac
+          wget -O /tools/kubectl "https://dl.k8s.io/release/$(wget -qO- https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
+          chmod +x /tools/kubectl
+          /tools/kubectl version --client
+        volumeMounts:
+        - name: tools
+          mountPath: /tools
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          runAsNonRoot: true
       containers:
       - name: n8n
         image: docker.n8n.io/n8nio/n8n:latest
@@ -26,6 +55,8 @@ spec:
         - containerPort: 5678
           name: http
         env:
+        - name: PATH
+          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
         - name: HOME
           value: "/home/node"
         - name: N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
@@ -83,13 +114,15 @@ spec:
         volumeMounts:
         - name: n8n-data
           mountPath: /home/node/.n8n
+        - name: tools
+          mountPath: /opt/tools
         resources:
           requests:
-            cpu: 100m
+            cpu: 2000m
-            memory: 128Mi
-          limits:
-            cpu: 512m
             memory: 512Mi
+          limits:
+            cpu: 4000m
+            memory: 2048Gi
         livenessProbe:
           httpGet:
             path: /healthz
@@ -110,6 +143,9 @@ spec:
       - name: n8n-data
         persistentVolumeClaim:
           claimName: n8n-data
+      - name: tools
+        persistentVolumeClaim:
+          claimName: n8n-tools
       securityContext:
         runAsUser: 1000
         runAsGroup: 1000

k8s/apps/n8n/deployment-worker.yaml

@@ -7,7 +7,7 @@ metadata:
     app: n8n
     component: worker
 spec:
-  replicas: 1
+  replicas: 2
   selector:
     matchLabels:
       app: n8n
@@ -24,8 +24,12 @@ spec:
         image: docker.n8n.io/n8nio/n8n:latest
         command: ["n8n", "worker"]
         env:
+        - name: PATH
+          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
         - name: HOME
           value: "/home/node"
+        - name: NODES_EXCLUDE
+          value: "[]"
         - name: N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
           value: "true"
         - name: N8N_RUNNERS_ENABLED
@@ -75,13 +79,15 @@ spec:
         volumeMounts:
         - name: n8n-data
           mountPath: /home/node/.n8n
+        - name: tools
+          mountPath: /opt/tools
         resources:
           requests:
-            cpu: 100m
+            cpu: 2000m
-            memory: 256Mi
+            memory: 512Mi
           limits:
-            cpu: 1000m
+            cpu: 4000m
-            memory: 1Gi
+            memory: 2048Gi
         livenessProbe:
           exec:
             command:
@@ -96,6 +102,9 @@ spec:
       - name: n8n-data
         persistentVolumeClaim:
           claimName: n8n-data
+      - name: tools
+        persistentVolumeClaim:
+          claimName: n8n-tools
       securityContext:
         runAsUser: 1000
         runAsGroup: 1000

k8s/apps/n8n/kustomization.yaml

@@ -1,19 +1,18 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-# Updated: Fixed n8n volume permissions issue
 
 resources:
   - external-secrets.yaml
-  - plain/
+  - storage.yaml
+  - rbac.yaml
+  - redis-deployment.yaml
+  - redis-service.yaml
+  - deployment-main.yaml
+  - deployment-worker.yaml
+  - service.yaml
+  - ingress.yaml
 
 helmCharts:
-# - name: n8n
-#   repo: https://community-charts.github.io/helm-charts
-#   version: 1.16.28
-#   releaseName: n8n
-#   namespace: n8n
-#   valuesFile: values-n8n.yaml
-#   includeCRDs: true
   - name: yacy
     repo: https://gt.hexor.cy/api/packages/ab/helm
     version: 0.1.2
@@ -21,3 +20,6 @@ helmCharts:
     namespace: n8n
     valuesFile: values-yacy.yaml
     includeCRDs: true
+
+commonLabels:
+  app.kubernetes.io/name: n8n

k8s/apps/n8n/plain/kustomization.yaml

@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - storage.yaml
-  - rbac.yaml
-  - redis-deployment.yaml
-  - redis-service.yaml
-  - deployment-main.yaml
-  - deployment-worker.yaml
-  - service.yaml
-  - ingress.yaml
-
-commonLabels:
-  app.kubernetes.io/name: n8n
-  app.kubernetes.io/instance: n8n-plain

k8s/apps/n8n/plain/rbac.yaml

@@ -1,37 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: n8n
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: n8n-clusterrole
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - jobs
-  - cronjobs
-  - deployments
-  - statefulsets
-  verbs:
-  - get
-  - list
-  - watch
-  - create
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: n8n-clusterrolebinding
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: n8n-clusterrole
-subjects:
-- kind: ServiceAccount
-  name: n8n
-  namespace: n8n

k8s/apps/n8n/plain/storage.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: n8n-data
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: nfs-csi
-  resources:
-    requests:
-      storage: 10Gi

k8s/apps/n8n/rbac.yaml

@@ -0,0 +1,45 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: n8n
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: n8n-clusterrole
+rules:
+  # Core API group ("")
+  - apiGroups: [""]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Common built-in API groups
+  - apiGroups: ["apps", "batch", "autoscaling", "extensions", "policy"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  - apiGroups: ["networking.k8s.io", "rbac.authorization.k8s.io", "apiextensions.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  - apiGroups: ["coordination.k8s.io", "discovery.k8s.io", "events.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  - apiGroups: ["storage.k8s.io", "admissionregistration.k8s.io", "authentication.k8s.io", "authorization.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: n8n-clusterrolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: n8n-clusterrole
+subjects:
+- kind: ServiceAccount
+  name: n8n
+  namespace: n8n

k8s/apps/n8n/storage.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-data
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-tools
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 20Gi

k8s/core/longhorn/values.yaml

@@ -1,2 +1,4 @@
 longhornUI:
   replicas: 1
+persistence:
+  reclaimPolicy: "Retain"