Enable X-Service: workflow routing to Temporal via ServiceAdapter.
Users can now specify namespace/domain in request payload for multi-tenant
workflow access.
Changes:
- Implement WorkflowAdapter in serviceadapter/workflow_adapter.go
* Defines 10 workflow resources: start, describe, list, history,
terminate, cancel, signal, query, reset, update
* Each resource validates namespace parameter in payload
* Forwards requests to Temporal gRPC handler
- Add GetWorkflowSpec() to define ServiceAdapter spec with:
* Upstream: grpc://temporal:7233
* Auth requirements per operation (execute, read, signal, query)
* Request/response schemas for validation
- Wire WorkflowAdapter into main.go:
* Register workflow adapter in serviceadapter registry
* Initialize with temporal handler for gRPC forwarding
- Remove old empty WorkflowAdapter stub from adapters.go
Usage:
curl -X POST https://api.riotpiao.com/ \
-H 'X-Service: workflow' \
-H 'X-Resource: start' \
-H 'Authorization: Bearer TOKEN' \
-d '{
"namespace": "default",
"workflow_id": "my-workflow",
"workflow_type": "MyWorkflow",
"task_queue": "default"
}'
Namespace is required in all workflow operations and must be specified
by the client in the request payload. This enables multi-tenant support
where different teams access their own Temporal namespaces.
- Add HTTP/2 transport support for gRPC calls
- Implement dispatchGRPC to forward requests to Temporal gRPC server
- Replace 501 Not Implemented with actual gRPC proxy
- Use golang.org/x/net/http2 for HTTP/2 protocol support
- Supports ListWorkflowExecutions and other gRPC methods
- Add TemporalConfig struct to internal/config
- Update gateway config with Temporal frontend service (port 7233)
- Update router with memory service adapter support
- Add config.local.yaml with memory service configuration
- Encrypt production config with SOPS (AES256_GCM)
- Support X-Service header routing pattern for service discovery
- Keep legacy path-based routes with deprecation warnings
- All 5 adapters preserved: workflow, memory, sqs, s3, iam
Tests that verify actual service operations:
- SQS send-message routing
- S3 list-objects with JWT pass-through
- Memory query routing
- IAM with JWT
- Authorization header pass-through to services
Tests gracefully skip if services unreachable (expected behavior).
Tests get real JWT from Authentik if credentials provided.
Run: GATEWAY_URL=http://localhost:8080 ./scripts/test-integration.sh
Or: GATEWAY_URL=https://api.riotpiao.com \
AUTHENTIK_CLIENT_ID=xxx AUTHENTIK_CLIENT_SECRET=yyy \
./scripts/test-integration.sh
Adapters defined in config.yaml alongside routes and models.
Parsed by existing config loader, populated into registry at startup.
Removed: client-go deps, REST loader, informer, nginx proxy,
CiliumNetworkPolicy, apis/gateway/v1/ (duplicate types).
Kept: merged CI pipeline, imagePullPolicy Always, CA certs in Dockerfile.
Admin Bot
poimenandrock