Add additional values and enhancements #199
Conversation
converted into the configmap
…ferent instances of the same application
WalkthroughThe changes update GitHub Actions workflows to use a newer version of the checkout action and adjust user permissions for a linter job. The Helm chart for n8n is incremented to version 1.0.8, reflecting an upstream app update and adding example configuration comments for license and logging in the values file. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant GitHub Actions
participant Linter Container
User->>GitHub Actions: Push/PR triggers workflow
GitHub Actions->>Linter Container: Start linter job (run as root)
Linter Container->>GitHub Actions: Run linting steps
GitHub Actions->>User: Report linting results
Possibly related PRs
✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (4)
charts/n8n/values.yaml (1)
54-58: Indentation nit – align with the surrounding commented examples.The new block is indented two spaces deeper than the earlier sample (
# n8n:vs# n8n:). Harmonising indentation avoids copy-paste YAML errors.charts/n8n/Chart.yaml (1)
37-41: Verify ArtifactHub changelog formatting.
artifacthub.io/changesis rendered verbatim; ensure each “- kind:” item is intended as a separate bullet and that multiline YAML is displayed as expected in the UI..github/workflows/push.yaml (1)
15-15: Consider pinningactions/checkoutto a commit SHA for better supply-chain securityMigrating to
actions/checkout@v4is 👍, but using only the major tag always tracks the latest minor/patch release.
For stricter reproducibility and protection against a compromised upstream release, pin to the exact commit:-uses: actions/checkout@v4 +uses: actions/checkout@v4 # e.g. actions/[email protected] +# or pin to the full SHA +# uses: actions/checkout@e39b… (commit SHA).github/workflows/lint-test.yaml (1)
13-13: Good move upgrading toactions/checkout@v4, but consider pinning to a specific versionSame rationale as in the release workflow: pinning avoids unexpected behaviour from future minor releases.
-uses: actions/checkout@v4 +uses: actions/checkout@v4 # or a specific tag/commitAlso applies to: 21-21
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/lint-test.yaml(1 hunks).github/workflows/push.yaml(1 hunks)charts/n8n/Chart.yaml(2 hunks)charts/n8n/values.yaml(1 hunks)
🔇 Additional comments (2)
charts/n8n/Chart.yaml (1)
3-4: Version bump LGTM.
version: 1.0.8andappVersion: 1.86.0correctly track the upstream release..github/workflows/lint-test.yaml (1)
10-10: ```shell
#!/bin/bash
set -euo pipefailEnsure jq is available
if ! command -v jq >/dev/null 2>&1; then
echo "Error: jq is required but not installed." >&2
exit 1
fi1. Get a token to pull from Docker Hub registry
TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:artifacthub/ah:pull" | jq -r .token)
2. Fetch the manifest for the 'latest' tag
MANIFEST=$(curl -s
-H "Accept: application/vnd.docker.distribution.manifest.v2+json"
-H "Authorization: Bearer $TOKEN"
https://registry-1.docker.io/v2/artifacthub/ah/manifests/latest)3. Extract the config digest
CONFIG_DIGEST=$(echo "$MANIFEST" | jq -r .config.digest)
4. Fetch the image config blob
CONFIG_BLOB=$(curl -s
-H "Authorization: Bearer $TOKEN"
https://registry-1.docker.io/v2/artifacthub/ah/blobs/$CONFIG_DIGEST)5. Output the default User setting
DEFAULT_USER=$(echo "$CONFIG_BLOB" | jq -r .config.User // empty)
if [ -z "$DEFAULT_USER" ]; then
echo "Default user: root (empty or not set → defaults to root)"
else
echo "Default user: $DEFAULT_USER"
fi</details> </blockquote></details> </details> <!-- This is an auto-generated comment by CodeRabbit for review status -->
| # license: | ||
| # activation: | ||
| # key: <N8N_LICENSE_ACTIVATION_KEY> | ||
| # log: | ||
| # level: info |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Store the license key under main.secret, not main.config.
Values placed in config end up in a ConfigMap (plain-text).
N8N_LICENSE_ACTIVATION_KEY is sensitive and should be surfaced through the secret: tree so it lands in a Secret:
main:
secret:
n8n:
license:
activation:
key: ${N8N_LICENSE_ACTIVATION_KEY}Prevents accidental exposure while still letting templates render the env-var.
🤖 Prompt for AI Agents
In charts/n8n/values.yaml around lines 54 to 58, the license key is currently
placed under main.config, which causes it to be stored in a plain-text
ConfigMap. To fix this, move the license activation key under main.secret so it
is stored in a Kubernetes Secret instead. Update the YAML structure to nest the
license key under main.secret.n8n.license.activation.key using the environment
variable reference, ensuring sensitive data is not exposed in plain text.
* feat: add additional values to demonstrate how env variables are converted into the configmap * feat: add instance common label to aid in differentiating between different instances of the same application * chore: bump helm value * chore: bump n8n app version * chore: remove instance as it is a selector label * chore: update artifacthub changes annotations * fix: address linter errors * chore: fix linter error * chore: update checkout action to v4 and add root user option --------- Co-authored-by: RoseSecurity <[email protected]> Co-authored-by: RoseSecurity <[email protected]>
2 participants
addition to PR #193
Closes #193
Summary by CodeRabbit
New Features
Chores