Fix: checksum must be on pod template

templates/n8n-deployment.yaml

@@ -14,8 +14,10 @@ spec:
       {{- include "n8n.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.n8n.podAnnotations }}
       annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+      {{- with .Values.n8n.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
@@ -39,6 +41,9 @@ spec:
           {{- if .Values.n8n.extraEnvVarsSecret }}
             - secretRef:
                 name: {{ .Values.n8n.extraEnvVarsSecret }}
+          {{- else }}
+            - secretRef:
+                name: {{ include "n8n.fullname" . }}
           {{- end }}
           ports:
             - name: http

templates/webhook-deployment.yaml

@@ -4,9 +4,6 @@ metadata:
   name: {{ include "n8n.fullname" . }}-webhook
   labels:
     {{- include "n8n.labels" . | nindent 4 }}
-  annotations:
-    checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
-    checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
 spec:
   {{- if not .Values.webhook.autoscaling.enabled }}
   replicas: {{ .Values.webhook.replicaCount }}
@@ -16,8 +13,10 @@ spec:
       {{- include "n8n.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.webhook.podAnnotations }}
       annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+      {{- with .Values.webhook.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
@@ -44,6 +43,9 @@ spec:
           {{- if .Values.webhook.extraEnvVarsSecret }}
             - secretRef:
                 name: {{ .Values.webhook.extraEnvVarsSecret }}
+          {{- else }}
+            - secretRef:
+                name: {{ include "n8n.fullname" . }}
           {{- end }}
           ports:
             - name: http

templates/worker-deployment.yaml

@@ -16,8 +16,10 @@ spec:
       {{- include "n8n.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.worker.podAnnotations }}
       annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+      {{- with .Values.worker.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
@@ -44,6 +46,9 @@ spec:
           {{- if .Values.worker.extraEnvVarsSecret }}
             - secretRef:
                 name: {{ .Values.worker.extraEnvVarsSecret }}
+          {{- else }}
+            - secretRef:
+                name: {{ include "n8n.fullname" . }}
           {{- end }}
           resources:
             {{- toYaml .Values.worker.resources | nindent 12 }}