35 lines
1.8 KiB
Markdown
35 lines
1.8 KiB
Markdown
|
# 7.3 — `/workflow/*` to Temporal (GREEN)
|
||
|
|
|
||
|
|
Phase: 7 — Additional capability prefixes
|
||
|
|
Stage: GREEN
|
||
|
|
Depends on: [6.5](6.5-cutover.md)
|
||
|
|
|
||
|
|
Temporal runs in the `temporal` namespace. Temporal namespace registration is
|
||
|
|
automatic via queue-operator and is NEVER done manually — this route must not create,
|
||
|
|
register or mutate Temporal namespaces, only proxy to what queue-operator has already
|
||
|
|
provisioned.
|
||
|
|
|
||
|
|
- [ ] `/workflow/*` on `api.riotpiao.com` proxies to the Temporal Service in the `temporal` namespace
|
||
|
|
- [ ] Nothing in this route registers a Temporal namespace. Registration stays with queue-operator
|
||
|
|
- [ ] Path rewriting between the `/workflow` prefix and Temporal's own paths is explicit in configuration
|
||
|
|
- [ ] Timeouts and body caps are explicit, with no silent defaults (G6). Long-poll semantics are accounted for rather than truncated by a short read timeout
|
||
|
|
- [ ] The route requires authentication and the token is checked for workflow capability — a GPU token must not drive workflows
|
||
|
|
- [ ] The NetworkPolicy is extended to reach only Temporal
|
||
|
|
- [ ] Streaming or long-poll responses pass through unbuffered, and a client disconnect cancels the upstream call rather than orphaning it (G4)
|
||
|
|
- [ ] `/v1/*` behaviour is unchanged before and after
|
||
|
|
- [ ] Metrics and rejection counters cover this route with its own route label
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
|
||
|
|
# expected: 401 without a token
|
||
|
|
|
||
|
|
curl -s -H "authorization: Bearer $WORKFLOW_TOKEN" https://api.riotpiao.com/workflow/health
|
||
|
|
# expected: Temporal's own response, proxied unmodified
|
||
|
|
|
||
|
|
kubectl -n temporal exec svc/temporal-admintools -- tctl --ad temporal-frontend:7233 namespace list | sort > /tmp/ns.after
|
||
|
|
diff /tmp/ns.before /tmp/ns.after
|
||
|
|
# expected: no diff — the gateway registered nothing; queue-operator remains the only registrar
|
||
|
|
```
|