Added kubectl to n8n

Reviewed-on: #127

k8s/apps/n8n/deployment-main.yaml

@@ -19,6 +19,35 @@ spec:
         component: main
     spec:
       serviceAccountName: n8n
+      initContainers:
+      - name: install-tools
+        image: alpine:3.22
+        command:
+        - /bin/sh
+        - -c
+        - |
+          set -e
+          if [ -x /tools/kubectl ]; then
+            echo "kubectl already exists, skipping download"
+            /tools/kubectl version --client
+            exit 0
+          fi
+          echo "Downloading kubectl..."
+          ARCH=$(uname -m)
+          case $ARCH in
+            x86_64) ARCH="amd64" ;;
+            aarch64) ARCH="arm64" ;;
+          esac
+          wget -O /tools/kubectl "https://dl.k8s.io/release/$(wget -qO- https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
+          chmod +x /tools/kubectl
+          /tools/kubectl version --client
+        volumeMounts:
+        - name: tools
+          mountPath: /tools
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          runAsNonRoot: true
       containers:
       - name: n8n
         image: docker.n8n.io/n8nio/n8n:latest
@@ -26,6 +55,8 @@ spec:
         - containerPort: 5678
           name: http
         env:
+        - name: PATH
+          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
         - name: HOME
           value: "/home/node"
         - name: N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
@@ -83,13 +114,15 @@ spec:
         volumeMounts:
         - name: n8n-data
           mountPath: /home/node/.n8n
+        - name: tools
+          mountPath: /opt/tools
         resources:
           requests:
-            cpu: 100m
-            memory: 128Mi
-          limits:
-            cpu: 512m
+            cpu: 2000m
             memory: 512Mi
+          limits:
+            cpu: 4000m
+            memory: 2048Gi
         livenessProbe:
           httpGet:
             path: /healthz
@@ -110,6 +143,9 @@ spec:
       - name: n8n-data
         persistentVolumeClaim:
           claimName: n8n-data
+      - name: tools
+        persistentVolumeClaim:
+          claimName: n8n-tools
       securityContext:
         runAsUser: 1000
         runAsGroup: 1000

k8s/apps/n8n/deployment-worker.yaml

@@ -7,7 +7,7 @@ metadata:
     app: n8n
     component: worker
 spec:
-  replicas: 1
+  replicas: 2
   selector:
     matchLabels:
       app: n8n
@@ -24,8 +24,12 @@ spec:
         image: docker.n8n.io/n8nio/n8n:latest
         command: ["n8n", "worker"]
         env:
+        - name: PATH
+          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
         - name: HOME
           value: "/home/node"
+        - name: NODES_EXCLUDE
+          value: "[]"
         - name: N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
           value: "true"
         - name: N8N_RUNNERS_ENABLED
@@ -75,13 +79,15 @@ spec:
         volumeMounts:
         - name: n8n-data
           mountPath: /home/node/.n8n
+        - name: tools
+          mountPath: /opt/tools
         resources:
           requests:
-            cpu: 100m
-            memory: 256Mi
+            cpu: 2000m
+            memory: 512Mi
           limits:
-            cpu: 1000m
-            memory: 1Gi
+            cpu: 4000m
+            memory: 2048Gi
         livenessProbe:
           exec:
             command:
@@ -96,6 +102,9 @@ spec:
       - name: n8n-data
         persistentVolumeClaim:
           claimName: n8n-data
+      - name: tools
+        persistentVolumeClaim:
+          claimName: n8n-tools
       securityContext:
         runAsUser: 1000
         runAsGroup: 1000

k8s/apps/n8n/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
+  - external-secrets.yaml
   - storage.yaml
   - rbac.yaml
   - redis-deployment.yaml
@@ -11,6 +12,14 @@ resources:
   - service.yaml
   - ingress.yaml
 
+helmCharts:
+  - name: yacy
+    repo: https://gt.hexor.cy/api/packages/ab/helm
+    version: 0.1.2
+    releaseName: yacy
+    namespace: n8n
+    valuesFile: values-yacy.yaml
+    includeCRDs: true
+
 commonLabels:
   app.kubernetes.io/name: n8n
-  app.kubernetes.io/instance: n8n-plain

k8s/apps/n8n/rbac.yaml

@@ -9,19 +9,27 @@ kind: ClusterRole
 metadata:
   name: n8n-clusterrole
 rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - jobs
-  - cronjobs
-  - deployments
-  - statefulsets
-  verbs:
-  - get
-  - list
-  - watch
-  - create
+  # Core API group ("")
+  - apiGroups: [""]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  # Common built-in API groups
+  - apiGroups: ["apps", "batch", "autoscaling", "extensions", "policy"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  - apiGroups: ["networking.k8s.io", "rbac.authorization.k8s.io", "apiextensions.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  - apiGroups: ["coordination.k8s.io", "discovery.k8s.io", "events.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
+
+  - apiGroups: ["storage.k8s.io", "admissionregistration.k8s.io", "authentication.k8s.io", "authorization.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

k8s/apps/n8n/storage.yaml

@@ -6,7 +6,19 @@ metadata:
 spec:
   accessModes:
     - ReadWriteMany
-  storageClassName: nfs-csi
+  storageClassName: longhorn
   resources:
     requests:
       storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-tools
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 20Gi

k8s/core/longhorn/values.yaml

@@ -1,2 +1,4 @@
 longhornUI:
   replicas: 1
+persistence:
+  reclaimPolicy: "Retain"