Deploying n8n on Oracle Kubernetes Engine (OKE)

This guide walks you through deploying the n8n automation platform on Oracle Cloud Infrastructure (OCI) using Oracle Kubernetes Engine (OKE) — including persistent storage, authentication, and public access via an OCI Load Balancer.

Overview

n8n (“nodemation”) is an open-source workflow automation tool that lets you visually connect services and automate tasks.

Oracle Kubernetes Engine (OKE) is a managed Kubernetes service on OCI that provides scalable, highly available clusters with integrated networking and load balancing.

In this guide, you’ll:

• Create a namespace and persistent volume for n8n data
• Deploy n8n to OKE
• Expose it through an OCI LoadBalancer
• Fix permission and cookie issues for production readiness

Prerequisites

Before you begin, ensure you have:

• An existing OKE cluster (v1.34.1 or newer)
• kubectl configured to connect to the cluster (kubectl get nodes works)
• One public subnet OCID (for the OCI Load Balancer)
• Basic understanding of Kubernetes YAML manifests

Step 1 — Create the Namespace and Persistent Volume Claim

Create a namespace for organizational isolation and a PVC to persist n8n configuration and workflows.

apiVersion: v1
kind: Namespace
metadata:
  name: n8n
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: n8n-pvc
  namespace: n8n
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 50Gi

Apply it:

kubectl apply -f n8n-storage.yaml

Step 2 — Create Authentication Secret

Create a Kubernetes secret for n8n’s basic authentication.

apiVersion: v1
kind: Secret
metadata:
  name: n8n-secret
  namespace: n8n
type: Opaque
stringData:
  username: admin
  password: strongpassword123

Apply it:

kubectl apply -f n8n-secret.yaml

Step 3 — Deploy n8n Application

Below is a production-ready Deployment that:

• Uses the fully qualified Docker image
• Mounts the PVC for persistence
• Fixes file-permission issues (fsGroup: 1000)
• Disables secure cookie enforcement (for HTTP access via LoadBalancer)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n
  namespace: n8n
spec:
  replicas: 1
  selector:
    matchLabels:
      app: n8n
  template:
    metadata:
      labels:
        app: n8n
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: n8n
          image: docker.io/n8nio/n8n:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 5678
          env:
            - name: N8N_BASIC_AUTH_ACTIVE
              value: "true"
            - name: N8N_BASIC_AUTH_USER
              valueFrom:
                secretKeyRef:
                  name: n8n-secret
                  key: username
            - name: N8N_BASIC_AUTH_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: n8n-secret
                  key: password
            - name: N8N_HOST
              value: "n8n"
            - name: N8N_PORT
              value: "5678"
            - name: N8N_PROTOCOL
              value: "http"
            - name: N8N_SECURE_COOKIE
              value: "false"
            - name: GENERIC_TIMEZONE
              value: "Asia/Kolkata"
            - name: TZ
              value: "Asia/Kolkata"
          volumeMounts:
            - name: n8n-data
              mountPath: /home/node/.n8n
      volumes:
        - name: n8n-data
          persistentVolumeClaim:
            claimName: n8n-pvc

Apply it:

kubectl apply -f n8n-deployment.yaml

Step 4 — Expose n8n via OCI LoadBalancer

Now expose n8n externally so you can access it through a public IP.

apiVersion: v1
kind: Service
metadata:
  name: n8n-service
  namespace: n8n
spec:
  type: LoadBalancer
  selector:
    app: n8n
  ports:
    - name: http
      port: 80
      targetPort: 5678
      protocol: TCP

Apply it:

kubectl apply -f n8n-service.yaml

After a few minutes:

kubectl get svc -n n8n
NAME            TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)        AGE
n8n-service     LoadBalancer   10.96.123.45   140.238.xxx.xxx  80:31234/TCP   2m

Step 5 — Verify and Troubleshoot

Check pod logs:

kubectl logs -f -n n8n deploy/n8n

Expected startup log:

Editor is now accessible:
 ▸  http://0.0.0.0:5678/

If you see permission errors like EACCES: permission denied, confirm your fsGroup: 1000 is present in the YAML.

If you get a “secure cookie” warning, ensure N8N_SECURE_COOKIE=false is set, or enable HTTPS on your LoadBalancer.

Step 6 — (Optional) Add HTTPS with OCI LoadBalancer

For production, you can enable HTTPS by adding these annotations to the Service:

metadata:
  annotations:
    service.beta.kubernetes.io/oci-load-balancer-ssl-ports: "443"
    service.beta.kubernetes.io/oci-load-balancer-tls-secret: "n8n/n8n-tls"

Then create a TLS secret:

kubectl create secret tls n8n-tls \
  --cert=server.crt --key=server.key -n n8n

Step 7 — (Optional) Use PostgreSQL for Production

For better performance and reliability, you can connect n8n to an external PostgreSQL (or OCI Autonomous Database):

- name: DB_TYPE
  value: "postgresdb"
- name: DB_POSTGRESDB_HOST
  value: "<your-db-host>"
- name: DB_POSTGRESDB_USER
  value: "<your-db-user>"
- name: DB_POSTGRESDB_PASSWORD
  value: "<your-db-password>"
- name: DB_POSTGRESDB_DATABASE
  value: "n8n"

Summary

Component	Purpose
Namespace	Isolates resources
PVC	Persists workflow data
Secret	Stores login credentials
Deployment	Runs n8n container securely
Service (LoadBalancer)	Exposes n8n externally
SecurityContext	Fixes PVC permission issues
Optional TLS	Enables HTTPS via OCI LoadBalancer