Struct ControlPlaneConfig

controlplane/control.go:35–120

ControlPlaneConfig extends server.Config with control-plane-specific settings.

)

// DefaultAdmissionReclaimerMaxReservations bounds cleanup ownership retained by
// one control-plane process when the operator does not configure a value.
const DefaultAdmissionReclaimerMaxReservations = defaultAdmissionReclaimerReservations

// ControlPlaneConfig extends server.Config with control-plane-specific settings.
type ControlPlaneConfig struct {
	server.Config

	Process ProcessConfig

	SocketDir            string
	ConfigPath           string // Path to config file, passed to workers
	HealthCheckInterval  time.Duration
	WorkerQueueTimeout   time.Duration // How long to wait for an available worker/org connection slot (default: 60s)
	WorkerIdleTimeout    time.Duration // How long to keep an idle worker alive (default: 5m)
	RetireOnSessionEnd   bool          // When true, process workers are retired immediately after their last session ends.
	HandoverDrainTimeout time.Duration // How long to wait for connections to drain during upgrade. 0 = unbounded (wait until k8s SIGKILL via terminationGracePeriodSeconds). Default: 0 in remote mode (so a CP rolling out doesn't kill in-flight customer queries at a self-imposed wall — see drainAndShutdown), 24h in process mode.
	MetricsServer        *http.Server  // Optional metrics server to shut down during upgrade

	AdmissionReclaimerMaxReservations int // Max queued/live admission identities whose cleanup ownership this CP may retain (default: 4096)

	// WorkerBackend selects the worker management backend.
	// "process" (default): workers are local child processes communicating over Unix sockets.
	// "remote": Kubernetes-backed multitenant workers communicating over TCP.
	//           Requires ConfigStoreConn and a binary built with -tags kubernetes.
	WorkerBackend string

	// K8s contains Kubernetes-specific configuration. Only used for remote
	// multitenant mode.
	K8s K8sConfig

	// ConfigStoreConn is the PostgreSQL connection string for the config store.
	// Required when WorkerBackend == "remote".
	ConfigStoreConn string

	// ConfigPollInterval is how often to poll the config store for changes.
	// Default: 30s.
	ConfigPollInterval time.Duration

	// InternalSecret is the shared secret for API authentication.
	// When empty, a random secret is generated and logged at startup.
	InternalSecret string

	// InternalSecretFallbacks are previous internal secrets still accepted
	// for API authentication during a rotation (newest first). Clients always
	// send the primary InternalSecret; the server accepts any of
	// {primary ∪ fallbacks}. Mirrors posthog's SECRET_KEY_FALLBACKS.
	InternalSecretFallbacks []string

	// ReadOnlySecret is a read-only secret accepted ONLY on the discovery
	// endpoints (GET /api/v1/warehouses, GET /api/v1/warehouse-team-ids), so
	// external writers (millpond, viaduck) don't have to carry the
	// admin-capable InternalSecret. It never grants access to any other
	// route. Empty disables the scoped path; the InternalSecret keeps
	// working on the discovery endpoints either way (operator/debug access
	// and rotation-window compatibility).
	ReadOnlySecret string