Skip to content

Deploying Workflows

Deploy workflow artifacts with the same CI/CD process as your environment.

Artifacts to Deploy

  • flows/workflows/
  • flows/artifacts/
  • flows/connections/
  • flows/policies/
  • flows/schedules/
  • flows/settings/ (if applicable)
  • flows/settings/settings/runtime-config.yaml
  • flows/settings/settings/ssh_known_hosts (optional, if using repo-managed host keys)
  1. Commit changes to Git.
  2. Run validation checks in CI.
  3. Apply manifests or artifact upload process.
  4. Reload runtime if required.
  5. Validate with test runs and traces.

Post-Deployment Validation

  • GET /workflows shows expected entries.
  • Test invocations succeed.
  • Trigger-event and trace APIs show healthy behavior.

Runtime Settings Workflow (Dashboard → Repo → Deploy)

To manage allowlists and other runtime settings in the Dashboard and promote them to TST/ACC/PRD, use this flow:

  1. Update settings in Dashboard → Admin → Settings.
  2. Download YAML and copy it into flows/settings/settings/runtime-config.yaml.
  3. Commit and deploy to the target environment.

Notes:

  • SSH host keys can be managed in Settings via egress.ssh.known_hosts or via the repo file flows/settings/settings/ssh_known_hosts.
  • The storage service seeds runtime config from runtime-config.yaml on startup if no config exists yet (unless overwrite is enabled).

Selective Uploads (Collaboration Mode)

For teams iterating in a shared environment, you can upload individual assets instead of syncing the entire flows tree. These uploads use the storage service and require the runtime-admin token.

curl -X POST http://storage:8080/internal/upload/workflows/order-create \
  -H "Authorization: Bearer <runtime-admin-token>" \
  -H "Content-Type: application/yaml" \
  --data-binary @flows/workflows/order-create.yaml

Notes:

  • Use selective uploads for dev/test; prefer GitOps for consistent prod promotion.
  • Policy uploads are currently limited to required_headers.
  • After uploading a workflow, call POST /admin/reload on the orchestrator.

Kubernetes PV/PVC Sync (All Flows Data)

cd engine
./scripts/sync-flows-pv.sh meshflows

The shared PVC contains: - workflows/ - connections/ - policies/ - schedules/ - artifacts/ - settings/

Services read from /app/flows/* (for example WORKFLOWS_DIR=/app/flows/workflows).

Public Endpoint Routing

By default, workflows are invoked internally via POST /v1/run/{workflow_name} (requires orchestrator access).

To expose a workflow as a public HTTP endpoint (e.g., POST /api/orders/create), configure edge routes in the Gateway. See Gateway API — Edge Route Configuration for details (Forgejo mirror: Gateway API — Edge Route Configuration).

Edge routes allow you to: - Alias a workflow to a public path (e.g., /api/customers/lookup → lookup_customer_v2) - Apply request/response transforms - Add authentication or rate limiting - Support multiple HTTP methods on the same workflow