n8n

Deploy n8n on Kubernetes — a workflow automation platform with a visual editor, 200+ integrations, and code nodes. Supports SQLite (zero-configuration default), and PostgreSQL, with Redis-backed queue mode for horizontal scaling of workflow executions.

Key Features

• Two database backends — SQLite (default) and PostgreSQL
• Queue mode — Redis-backed horizontal scaling with separate worker Deployments
• Encryption key protection — all workflow credentials encrypted at rest
• Webhook URL required — must match the external-facing URL for triggers to work
• Database-aware backup — tar for SQLite, pg_dump for PostgreSQL

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install n8n helmforge/n8n -f values.yaml

OCI registry:

helm install n8n oci://ghcr.io/helmforgedev/helm/n8n -f values.yaml

Deployment Examples

# values.yaml — n8n with SQLite (zero database configuration)
n8n:
  webhookUrl: 'https://n8n.example.com' # required for webhook triggers

encryptionKey:
  existingSecret: n8n-master-secret # key: encryption-key (never rotate)
  existingSecretKey: encryption-key

persistence:
  enabled: true
  size: 10Gi # SQLite DB + installed custom nodes

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: n8n.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: n8n-tls
      hosts:
        - n8n.example.com

# values.yaml — n8n with bundled PostgreSQL
n8n:
  webhookUrl: 'https://n8n.example.com'
  logLevel: info

encryptionKey:
  existingSecret: n8n-master-secret

postgresql:
  enabled: true
  auth:
    database: n8n
    username: n8n
    password: 'strong-db-password'
  primary:
    persistence:
      enabled: true
      size: 20Gi

persistence:
  enabled: true
  size: 5Gi # custom nodes (no SQLite when PostgreSQL is active)

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: n8n.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — n8n in queue mode with 3 workers
# Queue mode separates the main pod (editor + triggers) from worker pods (executions)
n8n:
  webhookUrl: 'https://n8n.example.com'

encryptionKey:
  existingSecret: n8n-master-secret

postgresql:
  enabled: true
  auth:
    password: 'strong-db-password'

redis:
  enabled: true
  auth:
    password: 'strong-redis-password'

queue:
  enabled: true
  workers: 3 # creates 3 separate worker Deployment pods
  concurrency: 10 # workflows executed simultaneously per worker

persistence:
  enabled: true
  size: 5Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: n8n.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — n8n with external PostgreSQL and daily backup
n8n:
  webhookUrl: 'https://n8n.example.com'

encryptionKey:
  existingSecret: n8n-master-secret

postgresql:
  enabled: false

database:
  mode: external
  external:
    vendor: postgres
    host: postgres.database.svc.cluster.local
    name: n8n
    username: n8n
    existingSecret: n8n-db-credentials
    existingSecretPasswordKey: database-password

persistence:
  enabled: true
  size: 5Gi

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: n8n-backups
    existingSecret: n8n-s3-credentials

Configuration Reference

Core

Image

Task Runners

n8n Configuration

Encryption Key

Queue Mode

Database

Auto-detection precedence (database.mode: auto):

Subcharts

Persistence

Backup

Backup mode is automatically selected based on the active database vendor.

Service, Ingress, Probes

Upgrade Notes

n8n 2.38.4 includes the 2.36–2.38 runner broker and shutdown fixes, database pool recovery, encryption-key seeding and queue execution fixes. Back up the database and data volume, preserve the encryption key, and validate workflows and credentials in staging before upgrading. Keep the app and external runner tags aligned; an empty taskRunners.image.tag inherits image.tag.

Use helm upgrade --reset-then-reuse-values with image.tag=2.38.4 and update any separately pinned runner tag. Existing generated encryption keys and runner tokens are retained through Helm lookup; use existing Secrets for offline rendering or GitOps. Automatic database migrations require a recoverable backup.

SQLite updates now use Recreate to stop the old main process before the new version opens the same database. Plan for brief downtime. The Python toggle taskRunners.nativePython.enabled now controls the n8n 2.x variable N8N_PYTHON_ENABLED; it remains disabled by default and requires external runners.

MySQL and MariaDB storage migration

n8n removed MySQL/MariaDB storage in version 2.0. Earlier chart releases still exposed these unsupported options. This chart now rejects mysql.enabled=true, database.mode=mysql and non-PostgreSQL external vendors, and no longer bundles MySQL or MySQL backup jobs. The MySQL workflow node is unaffected.

If an older deployment uses MySQL/MariaDB, stop here and migrate its data using the upstream migration procedure on a compatible source release. Back up the database and encryption key, migrate into a separate PostgreSQL instance, and verify credentials, workflows and executions before switching traffic. Changing database.mode alone does not migrate data. Do not apply this release over an existing bundled MySQL installation until its data has been migrated and its backup and PVC recovery have been verified.

See the 2.0 storage migration guidance and upstream releases.

More Information

• n8n Official Documentation
• n8n GitHub Repository
• HelmForge n8n Chart Source