feat(trakrf-backend): per-env JWT access-token TTL → 900 (preview + prod) (TRA-843) - #134
Merged
mikestankavich merged 2 commits intoMay 30, 2026
Merged
Conversation
…843) Promote jwtExpirationSeconds (backend JWT_EXPIRATION) to a per-env value in the root chart so the short-access-token half of the refresh design can land on preview ahead of prod. Previously this lived only in the chart base (helm/trakrf-backend/values.yaml: "3600") and the root envs map didn't carry it — a base flip would have hit preview AND prod at once, forcing 15-min re-logins on real prod users before refresh ships there. - argocd/root/values.yaml: add jwtExpirationSeconds per env (preview="900", prod="3600" held). - argocd/root/templates/trakrf-backend.yaml: emit it into config inlineValues, appended before the top-level image: key; empty falls back to chart default. Preview is safe now: refresh-token rotation (POST /api/v1/auth/refresh) is live and soaked — 3h preview soak biz_ok 99.99% (219,704/219,706), 21 refreshes, 0 auth 401s, vs 11.87% baseline (2026-05-26). Prod stays at "3600" — gated on PR #416's refresh endpoint being on the :prod image AND the 06-01 launch-readiness window. Flipping prod later is a one-line value edit + scripts/apply-root-app.sh re-apply (root-template edits don't auto-sync). Refs: trakrf/platform #416 (refresh), #442 (soak scenario). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Per Mike's call during the 2026-05-30 cutover window, realize the short access-token TTL on prod as well, not just preview. - argocd/root/values.yaml: prod jwtExpirationSeconds "3600" → "900". Caveat (carried in the value's inline comment + PR body): this assumes PR #416's refresh endpoint (POST /api/v1/auth/refresh) is on the running :prod image (currently floating :prod → sha-c372f81, TRA-853 ServeSPA). If it is not, prod users hit 15-min re-logins with no refresh path. Change is inert until the next scripts/apply-root-app.sh against the live cluster — that apply is the real safety checkpoint. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mikestankavich
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Promote
jwtExpirationSeconds(→ backendJWT_EXPIRATION) to a per-env value in the root chart, and set the short access-token TTL on both envs:jwtExpirationSeconds: "900"(15 min)jwtExpirationSeconds: "900"(15 min) — added per Mike's call during the 2026-05-30 cutover window.Why per-env
jwtExpirationSecondspreviously lived only in the chart base (helm/trakrf-backend/values.yaml: "3600"); the rootenvsmap didn't carry it. Promoting it to the per-env map (same values-addition-only pattern asappEnv/environmentLabel/imageTag) makes each env's TTL an independent one-line value.Changes
argocd/root/values.yaml—jwtExpirationSecondsper env (preview="900",prod="900"), plus doc comment.argocd/root/templates/trakrf-backend.yaml— emit it into the backendconfig:inlineValues, appended before the top-levelimage:key. Empty falls back to the chart default.Safe on preview
Refresh-token rotation (
POST /api/v1/auth/refresh, trakrf/platform #416) is live + verified on preview. 3h preview soak (PEAK_VUS=10, STAGE_S=3600, scenario #442): biz_ok 99.99% (219,704/219,706), 21 token refreshes, 0 auth 401s — vs the 2026-05-26 baseline of 11.87%.Prod is now
"900"too. This assumes PR #416's/auth/refreshis on the running:prodimage (currently floating:prod→sha-c372f81, the TRA-853 ServeSPA image — refresh presence not independently verified). If that image lacks the refresh endpoint, prod users hit 15-min re-logins with no refresh path. This was a deliberate call by Mike given the 2026-05-30 cutover / pre-prod dry-run state.The change is inert until the next
scripts/apply-root-app.shagainst the live cluster — that apply is the real safety checkpoint.Root-chart template edits don't auto-sync. After merge, re-run
scripts/apply-root-app.sh <cluster>for the live cluster (GKE) to materialize the new inlineValues.Verification
helm template argocd/rootrenders:trakrf-backend-preview→config.jwtExpirationSeconds: "900"trakrf-backend-prod→config.jwtExpirationSeconds: "900"Refs: TRA-843; trakrf/platform #416 (refresh endpoint), #442 (soak scenario).
🤖 Generated with Claude Code