Quick overview
Quick overview This workflow reviews Kubernetes manifest changes in GitHub pull requests using OpenAI with policy RAG and external scanner APIs, logs results to Postgres, posts findings back to the PR, and—after Slack approval—commits secure manifest fixes to a remediation branch and opens a remediation PR. How it works Triggers on GitHub pull_request events when a PR is opened or updated. Collects PR context and retrieves the list of changed files and their Kubernetes YAML contents from GitHub. Uses an OpenAI agent with session memory to analyze each manifest, calling HTTP scanner tools for privileged settings, RBAC permissions, exposed services, and resource limits, and querying a vector store for internal Kubernetes security policies. Parses the agent’s structured JSON output and logs findings, risk, verdict, and proposed secure manifests to a Postgres audit table. Posts a detailed security review comment (including findings and proposed fixes) back to the originating GitHub pull request. If issues are found, requests remediation approval in Slack and, when approved, creates a remediation branch, commits the secure manifest changes, and opens a remediation PR before notifying Slack. Setup Add GitHub credentials with permission to read PR files, create branches, commit changes, and open PRs, and select the target repository in the GitHub trigger and GitHub nodes. Add an OpenAI credential for the Chat Model node and configure a vector store connection for the RAG policy search tool. Replace the internal HTTP endpoints for the four scanner tools (privileged, RBAC, exposure, resource limits) with your own reachable services that accept manifest YAML and return findings. Add a Postgres credential and create a public.k8s_manifest_reviews table matching the columns used by the logging node (pr_number, repo, author, findings, overall_risk, verdict, secured_manifests, created_at). Add Slack credentials and set the target channel (for example, #k8s-security-review) for approval requests and notifications. Implement the remediation approval input so the workflow receives remediationApproved=true/false before the approval gate continues. An n8n automation workflow template by Oneclick AI Squad.
Oneclick AI Squad
web
free
Others in the same category, ranked by how often they are opened.
