Skip to content

deploy: the cluster issuer is a workload issuer; --node-retention per environment #729

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aojea merged 1 commit into from
Oct 15, 2026
Merged

deploy: the cluster issuer is a workload issuer; --node-retention per environment #729

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .github/k8s/agentmesh-control-plane-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,10 +128,14 @@ spec:
args:
- "--bind-address=0.0.0.0:8080"
- "--db-driver=postgres"
- "--issuer=https://auth.sam-mesh.dev,https://container.googleapis.com/v1/projects/${GCP_PROJECT_ID}/locations/${CLUSTER_REGION}/clusters/${CLUSTER_NAME}"
- "--issuer=https://auth.sam-mesh.dev"
# The cluster's service account tokens are workload identities: a
# 48h session renewed with a fresh token, no /user/* access.
- "--workload-issuer=https://container.googleapis.com/v1/projects/${GCP_PROJECT_ID}/locations/${CLUSTER_REGION}/clusters/${CLUSTER_NAME}"
- "--allowed-audiences=agentmesh-audience,agentmesh-control-plane-audience,sam-mesh-audience,sam-control-plane-audience"
- "--auto-approve-enrollment"
- "--key-grace-period=48h"
- "--node-retention=${NODE_RETENTION}"
Comment thread
aojea marked this conversation as resolved.
resources:
requests:
cpu: 100m
Expand Down
7 changes: 6 additions & 1 deletion .github/workflows/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,6 +361,10 @@ jobs:
# routers per member, six routers hold 10,000 members with one
# router out for a rollout.
VAR_ROUTER_HIGH_WATERMARK: ${{ vars.ROUTER_HIGH_WATERMARK }}
# How long the control plane keeps a lapsed or silent member's
# record. Unset is the binary's default, 720h; an environment that
# runs scale tests sets it to days so the sweep is observable.
VAR_NODE_RETENTION: ${{ vars.NODE_RETENTION }}
run: |
print_rollout_diagnostics() {
local namespace="$1"
Expand Down Expand Up @@ -395,8 +399,9 @@ jobs:
export CLUSTER_NAME="${VAR_CLUSTER_NAME}"
export ROUTER_REPLICAS="${VAR_ROUTER_REPLICAS:-3}"
export ROUTER_HIGH_WATERMARK="${VAR_ROUTER_HIGH_WATERMARK:-6000}"
export NODE_RETENTION="${VAR_NODE_RETENTION:-720h}"

envsubst '${ENV_NAME} ${NAMESPACE} ${GCP_PROJECT_ID} ${CLUSTER_NAME} ${CLUSTER_REGION} ${IMAGE_TAG}' < .github/k8s/agentmesh-control-plane-template.yaml | kubectl apply -f -
envsubst '${ENV_NAME} ${NAMESPACE} ${GCP_PROJECT_ID} ${CLUSTER_NAME} ${CLUSTER_REGION} ${IMAGE_TAG} ${NODE_RETENTION}' < .github/k8s/agentmesh-control-plane-template.yaml | kubectl apply -f -
envsubst '${ENV_NAME} ${NAMESPACE} ${GCP_PROJECT_ID} ${CLUSTER_NAME} ${CLUSTER_REGION} ${IMAGE_TAG} ${ROUTER_REPLICAS} ${ROUTER_HIGH_WATERMARK}' < .github/k8s/agentmesh-router-template.yaml | kubectl apply -f -
envsubst '${ENV_NAME} ${NAMESPACE} ${GCP_PROJECT_ID} ${CLUSTER_NAME} ${CLUSTER_REGION} ${IMAGE_TAG}' < .github/k8s/agentmesh-console-template.yaml | kubectl apply -f -
envsubst '${ENV_NAME} ${NAMESPACE} ${GCP_PROJECT_ID}' < .github/k8s/dns-sync-cronjob-template.yaml | kubectl apply -f -
Expand Down
Loading