sam-router

sam-router is a libp2p peer with a stable identity that new nodes connect to first. It hosts the DHT, relays traffic between nodes that cannot reach each other, and forwards the control plane’s signed events. It has no policy of its own.

sam-router [flags]

Enrollment

A router enrolls like a node, requesting sam:role:router, with one of:

FlagMeaning
--jwt-pathFile containing an OIDC token (a projected service account token, for example).
--bootstrap-token-pathFile containing a bootstrap token minted with "role": "sam:role:router".
--oidc-token, --bootstrap-tokenThe same tokens as values. Visible in process listings. The file forms are preferred.

The mesh policy must bind the router’s identity to sam:role:router. The sam-mesh Helm chart handles this: its bootstrap job binds the router’s service account and mints a bootstrap token with max_usages equal to the replica count.

Flags

FlagDefaultMeaning
--control-planehttp://127.0.0.1:8080Control plane URL. https:// is required unless the host is loopback.
--insecure-control-planefalseAccept plaintext http:// to a non-loopback host, such as an in-cluster Service.
--listen/ip4/0.0.0.0/tcp/5001, /ip6/::/tcp/5001libp2p listen addresses. Repeatable. Add /ip4/0.0.0.0/udp/5001/quic-v1 for QUIC.
--external-addrnoneAddresses to announce instead of the detected ones, such as /dnsaddr/bootstrap.example.com or /ip4/<public-ip>/tcp/5001. Repeatable.
--keys-pathrouter.keyThe router’s private key. It fixes the peer ID across restarts and belongs on persistent storage.
--keys-sync-interval5mHow often /keys is polled for signing-key rotations.
--lease-renew-interval300sHow often the lease is renewed. Must be well below the control plane’s --lease-duration.
--allow-loopbackfalseAnnounce and accept loopback and link-local addresses. For a router and nodes on one host.
--conns-per-source-ip8 (libp2p default)Inbound connections accepted per source IP. Raise it behind a TLS-terminating proxy or a NAT that puts many peers on one address.
--low-watermark, --high-watermark1000, 4000Connection manager limits. Above the high mark, connections are trimmed down to the low mark.
--dht-provider-addr-ttl, --dht-max-record-agelibrary defaultsDHT record lifetimes.
--metrics-addroffServe /metrics, /healthz and /readyz without authentication on this address. /readyz returns 200 once the router is enrolled and the libp2p host is up. Keep this address separate from the libp2p ports and inside the cluster.
--log-levelinfodebug, info, warn, error. LOG_FORMAT=json selects JSON output.

What it does at run time

  1. Fetches /keys and enrolls. The credential carries role("sam:role:router") and the relay right.
  2. Starts the libp2p host, the DHT in server mode, the relay service and GossipSub.
  3. Registers a lease at POST /routers/lease with its announced addresses and renews it every --lease-renew-interval. The control plane lists the router on /info while the lease is live.
  4. Runs the mutual credential handshake on every inbound connection and refuses peers whose credential does not verify and peers on the ban list.
  5. Refreshes its own credential before it expires, like a node.

A router stores nothing except its key. Restarting a router loses no important state. Nodes reconnect and publish their services again.

Metrics

The metrics address exposes sam_router_connected_peers, sam_router_dht_routing_table_size, sam_router_auth_handshakes_total (by outcome) and sam_router_lease_renewals_total (by outcome), next to the Go runtime metrics. /healthz and /readyz on the same address are the probes to use in a pod spec.