Multi-cluster

One app for every cluster you run.

Prod and staging at the very least, and often a region or two on top. dagweave holds one copy of the workflow and sends it wherever you name.

The problem

The same workflow, copied into every cluster.

A workflow that runs in staging and in prod is two files, or one file with a patch on top. They start identical and they do not stay that way.

The drift surfaces when the prod run fails on a step staging never had.

Enrollment

Enroll as many as you have

Each cluster gets its own connector and its own keypair, generated inside that cluster. One install covers the Argo Workflows instances running there.

Enrolling the tenth cluster works like the first.

what a workspace can holdtext

connectors            ->  as many as you enroll
served instances      ->  several per connector
each served instance  ->  one Argo Workflows instance, one namespace

Dispatch

The workflow and the cluster are separate choices

A trigger names the cluster it fires at. The same graph goes to staging on a branch push and to prod on a schedule, without being copied or forked.

A cron in the EU region and a cron in us-east are one workflow with two triggers.
A platform team can publish one template cluster-wide, and every team runs it into their own namespace. That one is a switch your platform team turns on in the connector's Helm values, and it ships off: a ClusterWorkflowTemplate is in no namespace, so nothing narrower than a ClusterRole can reach it.

one workflow, two targetstext

push to main   ->  connector: staging-eu   ns: pipelines
manual, gated  ->  connector: prod-us      ns: pipelines

Access

You choose who reaches which cluster

A cluster connection is its own permission, separate from whatever someone can already do to a workflow.

Give someone staging without prod. Revoke one, keep the other.

permission is layered, not inheritedtext

edit the workflow    ->  workflow permission
send it to staging   ->  staging-connector permission
send it to prod      ->  prod-connector permission

Fleet health

You find out when a connector drops

Every connector you enroll is watched. dagweave tells you when one goes offline.

Connect all of them.

dagweave is in early access. Leave an email and we will bring you on as we open it up.