66 lines
2.3 KiB
Markdown
66 lines
2.3 KiB
Markdown
|
# 3.3 — Temporal: Configure native JWT validation via jwtKeyProvider
|
||
|
|
|
||
|
|
Phase: 3 — Authentication & Authorization
|
||
|
|
Stage: TODO
|
||
|
|
Depends on: 8.2 (X-Service dispatcher), 8.10 (gate)
|
||
|
|
|
||
|
|
## Context
|
||
|
|
|
||
|
|
Temporal Helm chart supports native JWT authorization:
|
||
|
|
- `server.config.authorization.jwtKeyProvider`
|
||
|
|
- `claimMapper` for custom claim handling
|
||
|
|
|
||
|
|
Per homelab/project-usage/jwt-auth-rollout.md: "native JWT authorization support".
|
||
|
|
But currently **not configured** — unresolved design question on external access.
|
||
|
|
|
||
|
|
**Phase 8.2 decision**: Gateway detects gRPC (returns 501 not-implemented).
|
||
|
|
Phase 9 will add gRPC proxy. Phase 3 can configure JWT validation in Temporal.
|
||
|
|
|
||
|
|
## Requirements
|
||
|
|
|
||
|
|
- [ ] Configure `server.config.authorization.jwtKeyProvider` in Temporal Helm values
|
||
|
|
- Point at Authentik JWKS: `https://authentik.riotpiao.com/application/o/workflow/jwks/`
|
||
|
|
- [ ] Configure `claimMapper` to translate Authentik claims:
|
||
|
|
- `permissions` claim → Temporal permissions
|
||
|
|
- OR `groups` claim → Temporal role mappings
|
||
|
|
- [ ] Test: In-cluster worker with JWT can connect to Temporal frontend
|
||
|
|
- [ ] Test: Unauthenticated client gets 401
|
||
|
|
- [ ] Verify: No impact on existing workers/clients (backward compat)
|
||
|
|
|
||
|
|
## Implementation
|
||
|
|
|
||
|
|
1. Update k8s/infra temporal-values.yaml:
|
||
|
|
```yaml
|
||
|
|
server:
|
||
|
|
config:
|
||
|
|
authorization:
|
||
|
|
jwtKeyProvider:
|
||
|
|
keySourceURIs:
|
||
|
|
- "https://authentik.riotpiao.com/application/o/workflow/jwks/"
|
||
|
|
claimMapper: |
|
||
|
|
# Custom claims mapping (TBD)
|
||
|
|
```
|
||
|
|
2. Deploy & test
|
||
|
|
3. Add integration test (requires gRPC client, Phase 9)
|
||
|
|
|
||
|
|
## Verification
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# In-cluster test (Pod with JWT)
|
||
|
|
kubectl -n temporal run --rm -it temporal-test \
|
||
|
|
--image=temporalioservices/temporal-server:latest \
|
||
|
|
-- tctl --address temporal-frontend:7233 namespace list
|
||
|
|
|
||
|
|
# External test (Phase 9, requires gRPC proxy)
|
||
|
|
# grpcurl -H "Authorization: Bearer $JWT" \
|
||
|
|
# temporal-frontend.cluster.local:7233 \
|
||
|
|
# temporal.api.workflowservice.v1.WorkflowService/ListNamespaces
|
||
|
|
```
|
||
|
|
|
||
|
|
## Notes
|
||
|
|
|
||
|
|
- **Not Phase 8.2**: Routing is done, auth config is Phase 3+
|
||
|
|
- **Temporal owner responsibility**: Configure JWT in temporal-values.yaml (k8s/infra)
|
||
|
|
- **Gateway responsibility**: Pass gRPC through (Phase 9: grpcproxy)
|
||
|
|
- **Open question**: External access to Temporal frontend (TBD)
|