From bc137d13b45f03aa6312e16e693cd7b600a405b7 Mon Sep 17 00:00:00 2001 From: alkatrazz Date: Fri, 29 May 2026 15:08:41 +0200 Subject: [PATCH] =?UTF-8?q?feat(k8s):=20d=C3=A9ployer=20Open=20WebUI=20+?= =?UTF-8?q?=20n8n=20sur=20namespace=20ai=20via=20ArgoCD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Open WebUI (openwebui.lab.local) : - Connecté à LiteLLM (192.168.10.1:4000/v1) comme backend OpenAI-compatible - PostgreSQL via storage-01 pour l'historique des conversations - PVC 5Gi NFS pour les uploads, Traefik IngressRoute n8n (n8n.lab.local) : - PostgreSQL via storage-01, chiffrement des credentials - PVC 2Gi NFS, Traefik IngressRoute - Webhook URL interne : http://n8n.lab.local Ansible : ajoute openwebui et n8n dans postgresql_databases/users (vault_pg_openwebui_password + vault_pg_n8n_password à ajouter au vault) Prérequis avant 1er déploiement : make vault-edit # ajouter les 2 passwords make apply-storage --tags postgresql kubectl create secret generic open-webui-secret -n ai ... kubectl create secret generic n8n-secret -n ai ... Co-Authored-By: Claude Sonnet 4.6 --- ansible/roles/postgresql/defaults/main.yml | 11 ++- k8s/apps-of-apps/apps/n8n.yaml | 24 +++++++ k8s/apps-of-apps/apps/open-webui.yaml | 24 +++++++ k8s/apps/n8n/deployment.yaml | 82 ++++++++++++++++++++++ k8s/apps/n8n/ingress.yaml | 14 ++++ k8s/apps/n8n/pvc.yaml | 12 ++++ k8s/apps/n8n/service.yaml | 11 +++ k8s/apps/open-webui/deployment.yaml | 71 +++++++++++++++++++ k8s/apps/open-webui/ingress.yaml | 14 ++++ k8s/apps/open-webui/pvc.yaml | 12 ++++ k8s/apps/open-webui/service.yaml | 11 +++ 11 files changed, 285 insertions(+), 1 deletion(-) create mode 100644 k8s/apps-of-apps/apps/n8n.yaml create mode 100644 k8s/apps-of-apps/apps/open-webui.yaml create mode 100644 k8s/apps/n8n/deployment.yaml create mode 100644 k8s/apps/n8n/ingress.yaml create mode 100644 k8s/apps/n8n/pvc.yaml create mode 100644 k8s/apps/n8n/service.yaml create mode 100644 k8s/apps/open-webui/deployment.yaml create mode 100644 k8s/apps/open-webui/ingress.yaml create mode 100644 k8s/apps/open-webui/pvc.yaml create mode 100644 k8s/apps/open-webui/service.yaml diff --git a/ansible/roles/postgresql/defaults/main.yml b/ansible/roles/postgresql/defaults/main.yml index 90e8983..8923acc 100644 --- a/ansible/roles/postgresql/defaults/main.yml +++ b/ansible/roles/postgresql/defaults/main.yml @@ -10,10 +10,13 @@ postgresql_max_connections: 100 postgresql_shared_buffers: "256MB" # Bases et utilisateurs à créer -# Mots de passe dans le vault : vault_pg_hermes_password, vault_pg_litellm_password +# Mots de passe dans le vault : vault_pg_hermes_password, vault_pg_litellm_password, +# vault_pg_openwebui_password, vault_pg_n8n_password postgresql_databases: - name: hermes - name: litellm + - name: openwebui + - name: n8n postgresql_users: - name: hermes @@ -22,3 +25,9 @@ postgresql_users: - name: litellm password: "{{ vault_pg_litellm_password }}" db: litellm + - name: openwebui + password: "{{ vault_pg_openwebui_password }}" + db: openwebui + - name: n8n + password: "{{ vault_pg_n8n_password }}" + db: n8n diff --git a/k8s/apps-of-apps/apps/n8n.yaml b/k8s/apps-of-apps/apps/n8n.yaml new file mode 100644 index 0000000..2dd799d --- /dev/null +++ b/k8s/apps-of-apps/apps/n8n.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: n8n + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: git@github.com:Alkatrazz24/Funk-lab.git + targetRevision: main + path: k8s/apps/n8n + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: ai + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/apps-of-apps/apps/open-webui.yaml b/k8s/apps-of-apps/apps/open-webui.yaml new file mode 100644 index 0000000..856a350 --- /dev/null +++ b/k8s/apps-of-apps/apps/open-webui.yaml @@ -0,0 +1,24 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: open-webui + namespace: argocd + finalizers: + - resources-finalizer.argocd.argoproj.io +spec: + project: default + source: + repoURL: git@github.com:Alkatrazz24/Funk-lab.git + targetRevision: main + path: k8s/apps/open-webui + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: ai + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/apps/n8n/deployment.yaml b/k8s/apps/n8n/deployment.yaml new file mode 100644 index 0000000..9cbaef3 --- /dev/null +++ b/k8s/apps/n8n/deployment.yaml @@ -0,0 +1,82 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: n8n + namespace: ai +spec: + replicas: 1 + selector: + matchLabels: + app: n8n + template: + metadata: + labels: + app: n8n + spec: + containers: + - name: n8n + image: n8nio/n8n:latest + ports: + - containerPort: 5678 + env: + # PostgreSQL + - name: DB_TYPE + value: "postgresdb" + - name: DB_POSTGRESDB_HOST + value: "192.168.10.1" + - name: DB_POSTGRESDB_PORT + value: "5432" + - name: DB_POSTGRESDB_DATABASE + value: "n8n" + - name: DB_POSTGRESDB_USER + value: "n8n" + - name: DB_POSTGRESDB_PASSWORD + valueFrom: + secretKeyRef: + name: n8n-secret + key: db-password + # Clé de chiffrement des credentials + - name: N8N_ENCRYPTION_KEY + valueFrom: + secretKeyRef: + name: n8n-secret + key: encryption-key + # URLs + - name: N8N_HOST + value: "0.0.0.0" + - name: N8N_PORT + value: "5678" + - name: N8N_PROTOCOL + value: "http" + - name: WEBHOOK_URL + value: "http://n8n.lab.local" + - name: N8N_EDITOR_BASE_URL + value: "http://n8n.lab.local" + # Timezone + - name: GENERIC_TIMEZONE + value: "Europe/Paris" + - name: TZ + value: "Europe/Paris" + # Désactiver la télémétrie + - name: N8N_DIAGNOSTICS_ENABLED + value: "false" + volumeMounts: + - name: data + mountPath: /home/node/.n8n + resources: + requests: + cpu: 200m + memory: 256Mi + limits: + cpu: 1000m + memory: 1Gi + readinessProbe: + httpGet: + path: /healthz + port: 5678 + initialDelaySeconds: 20 + periodSeconds: 10 + volumes: + - name: data + persistentVolumeClaim: + claimName: n8n-data diff --git a/k8s/apps/n8n/ingress.yaml b/k8s/apps/n8n/ingress.yaml new file mode 100644 index 0000000..8af1642 --- /dev/null +++ b/k8s/apps/n8n/ingress.yaml @@ -0,0 +1,14 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: n8n + namespace: ai +spec: + entryPoints: + - web + routes: + - match: Host(`n8n.lab.local`) + kind: Rule + services: + - name: n8n + port: 5678 diff --git a/k8s/apps/n8n/pvc.yaml b/k8s/apps/n8n/pvc.yaml new file mode 100644 index 0000000..ad03216 --- /dev/null +++ b/k8s/apps/n8n/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: n8n-data + namespace: ai +spec: + accessModes: + - ReadWriteOnce + storageClassName: nfs + resources: + requests: + storage: 2Gi diff --git a/k8s/apps/n8n/service.yaml b/k8s/apps/n8n/service.yaml new file mode 100644 index 0000000..8d0c686 --- /dev/null +++ b/k8s/apps/n8n/service.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: n8n + namespace: ai +spec: + selector: + app: n8n + ports: + - port: 5678 + targetPort: 5678 diff --git a/k8s/apps/open-webui/deployment.yaml b/k8s/apps/open-webui/deployment.yaml new file mode 100644 index 0000000..28458e6 --- /dev/null +++ b/k8s/apps/open-webui/deployment.yaml @@ -0,0 +1,71 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: open-webui + namespace: ai +spec: + replicas: 1 + selector: + matchLabels: + app: open-webui + template: + metadata: + labels: + app: open-webui + spec: + containers: + - name: open-webui + image: ghcr.io/open-webui/open-webui:latest + ports: + - containerPort: 8080 + env: + # LiteLLM comme backend OpenAI-compatible + - name: OPENAI_API_BASE_URL + value: "http://192.168.10.1:4000/v1" + - name: OPENAI_API_KEY + valueFrom: + secretKeyRef: + name: open-webui-secret + key: litellm-api-key + # PostgreSQL — migrations automatiques au démarrage + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: open-webui-secret + key: database-url + # Clé de session + - name: WEBUI_SECRET_KEY + valueFrom: + secretKeyRef: + name: open-webui-secret + key: webui-secret-key + # Désactiver Ollama (on passe par LiteLLM) + - name: ENABLE_OLLAMA_API + value: "false" + - name: OLLAMA_BASE_URL + value: "" + # Nom affiché dans l'interface + - name: WEBUI_NAME + value: "Funk AI" + - name: DEFAULT_LOCALE + value: "fr-FR" + volumeMounts: + - name: data + mountPath: /app/backend/data + resources: + requests: + cpu: 200m + memory: 256Mi + limits: + cpu: 1000m + memory: 1Gi + readinessProbe: + httpGet: + path: /health + port: 8080 + initialDelaySeconds: 30 + periodSeconds: 10 + volumes: + - name: data + persistentVolumeClaim: + claimName: open-webui-data diff --git a/k8s/apps/open-webui/ingress.yaml b/k8s/apps/open-webui/ingress.yaml new file mode 100644 index 0000000..9943572 --- /dev/null +++ b/k8s/apps/open-webui/ingress.yaml @@ -0,0 +1,14 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: open-webui + namespace: ai +spec: + entryPoints: + - web + routes: + - match: Host(`openwebui.lab.local`) + kind: Rule + services: + - name: open-webui + port: 8080 diff --git a/k8s/apps/open-webui/pvc.yaml b/k8s/apps/open-webui/pvc.yaml new file mode 100644 index 0000000..aa1891a --- /dev/null +++ b/k8s/apps/open-webui/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: open-webui-data + namespace: ai +spec: + accessModes: + - ReadWriteOnce + storageClassName: nfs + resources: + requests: + storage: 5Gi diff --git a/k8s/apps/open-webui/service.yaml b/k8s/apps/open-webui/service.yaml new file mode 100644 index 0000000..de2ef7e --- /dev/null +++ b/k8s/apps/open-webui/service.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: Service +metadata: + name: open-webui + namespace: ai +spec: + selector: + app: open-webui + ports: + - port: 8080 + targetPort: 8080