chemavxandClaude Opus 5
07521216c7
Ghost EN y ES son lo unico del mapa que da la cara al publico y lo que peor se lleva con dos semanas sin nadie mirando. Entran en el SERVICE_MAP con la clave igual al nombre exacto del monitor de Kuma. El monitor "www.zonadeexclusion.com (301->apex)" se queda fuera a proposito: que ese 301 falle es cosa de Traefik o del DNS, no de Ghost. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
177 lines
4.5 KiB
YAML
177 lines
4.5 KiB
YAML
# Permisos para el workflow "Uptime Kuma -> K8s Auto-Restart" (2026-07-30).
|
|
#
|
|
# El nodo Code lee el token proyectado de la ServiceAccount y hace un PATCH
|
|
# contra kubernetes.default.svc. Nunca habia existido ningun Role ni RoleBinding
|
|
# para n8n: el API devolvia 403 y el workflow se iba por la rama de "reinicio
|
|
# fallido". Los 23 "exitos" de workflow_statistics eran eso -- el aviso de fallo
|
|
# enviandose bien. La integracion jamas reinicio nada.
|
|
#
|
|
# SA propia y no la "default" del namespace: cualquier pod que se despliegue en
|
|
# n8n sin pedir SA hereda la default, y estos permisos cruzan namespaces.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
# get ademas de patch: tras el PATCH el workflow espera 60 s y RELEE el
|
|
# deployment para comprobar readyReplicas -- sin get, ese chequeo posterior
|
|
# devolvia "Cannot read properties of undefined (reading 'replicas')".
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: n8n-restarter
|
|
rules:
|
|
- apiGroups: ["apps"]
|
|
# statefulsets porque Gitea lo es (no un Deployment) y esta en el mapa.
|
|
resources: ["deployments", "statefulsets"]
|
|
verbs: ["get", "patch"]
|
|
---
|
|
# Un RoleBinding por namespace y no un ClusterRoleBinding: el webhook que
|
|
# dispara esto es PUBLICO y sin autenticar, asi que el alcance de lo que
|
|
# puede reiniciar un desconocido debe ser exactamente el SERVICE_MAP.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: monitoring
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: homarr
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: gitea
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: authentik
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: vaultwarden
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: ollama
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
# Los dos blogs (2026-07-30). Son lo unico de aqui que da la cara al publico, y
|
|
# justo lo que peor se lleva con quince dias sin nadie mirando: si Ghost se
|
|
# atasca, que al menos se intente un reinicio antes de que llegue el aviso.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: ghost-en
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: zona-exclusion
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|
|
---
|
|
# argocd el ultimo a proposito: reiniciar argocd-server o argocd-repo-server
|
|
# es lo mas agresivo del mapa (deja el cluster sin reconciliar un rato).
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: n8n-restarter
|
|
namespace: argocd
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: n8n-restarter
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: n8n-restarter
|
|
namespace: n8n
|