diff --git a/tpu-ci/configmap.yaml b/tpu-ci/configmap.yaml
new file mode 100644
index 00000000000..3709eb0afbf
--- /dev/null
+++ b/tpu-ci/configmap.yaml
@@ -0,0 +1,4 @@
+secretName: github-pat
+resources:
+- namespace: "flux-system"
+- namespace: "arc-system"
diff --git a/tpu-ci/gke.tf b/tpu-ci/gke.tf
index 213a2ada5ff..6c01e953026 100644
--- a/tpu-ci/gke.tf
+++ b/tpu-ci/gke.tf
@@ -20,7 +20,7 @@ variable "gke_password" {
 }
 
 variable "gke_num_nodes" {
-  default     = 3
+  default     = 2
   description = "number of gke nodes"
 }
 
diff --git a/tpu-ci/k8s.tf b/tpu-ci/k8s.tf
index b4848369b5f..174393b3b77 100644
--- a/tpu-ci/k8s.tf
+++ b/tpu-ci/k8s.tf
@@ -51,3 +51,13 @@ resource "kubernetes_manifest" "flux-terraform" {
   ]
 }
 
+resource "kubernetes_config_map" "configmap" {
+  metadata {
+    name = "branch-planner"
+    namespace = "flux-system"
+  }
+
+  data = {
+    "configmap.yaml" = "${file("${path.module}/configmap.yaml")}"
+  }
+}
diff --git a/tpu-ci/secret.tf b/tpu-ci/secret.tf
index 4b469d95626..631b8517501 100644
--- a/tpu-ci/secret.tf
+++ b/tpu-ci/secret.tf
@@ -15,3 +15,18 @@ resource "kubernetes_secret" "github-pat" {
     github_token = var.GITHUB_TOKEN
   }
 }
+
+resource "kubernetes_secret" "github-pat-flux" {
+  metadata {
+    name = "github-pat"
+    namespace = "flux-system"
+  }
+  depends_on = [
+    helm_release.arc-runner-set
+  ]
+
+  data = {
+    github_token = var.GITHUB_TOKEN
+  }
+}
+