51 lines
2.5 KiB
Markdown
51 lines
2.5 KiB
Markdown
|
# 8.4 — `X-Service: workflow` adapter, supersedes `/workflow/*` prefix (GREEN)
|
||
|
|
|
||
|
|
Phase: 8 — ServiceAdapter CRD rollout
|
||
|
|
Stage: RED
|
||
|
|
Depends on: 8.1, 8.2, 8.3
|
||
|
|
|
||
|
|
Design contract: [API_ROUTING_HYBRID_DESIGN.md](../API_ROUTING_HYBRID_DESIGN.md) §2.
|
||
|
|
Supersedes [7.3](7.3-workflow-prefix.md) — that task's prefix-based `/workflow/*`
|
||
|
|
route was itself mocked/partial (see `INDEX.md` Progress note); this task replaces
|
||
|
|
it with the header-based adapter rather than finishing it as originally specced.
|
||
|
|
Do not also try to complete 7.3's checklist — its route is retired, not extended.
|
||
|
|
|
||
|
|
- [ ] `k8s/serviceadapter-workflow.yaml` CR: `serviceName: workflow`, upstream = the
|
||
|
|
Temporal Service in the `temporal` namespace, `auth.capability: workflow:access`
|
||
|
|
- [ ] Resource `workflow` maps: `POST` → `START_WORKFLOW`, `GET /workflow/{id}` →
|
||
|
|
`QUERY_WORKFLOW`, `GET` (list) → `LIST_WORKFLOWS`, `DELETE /workflow/{id}` →
|
||
|
|
`TERMINATE_WORKFLOW`, `GET /workflow/{id}/history` → `GET_WORKFLOW_HISTORY`
|
||
|
|
(§2's mapping table)
|
||
|
|
- [ ] `requestSchema` on `START_WORKFLOW`'s POST method — fields for whatever the
|
||
|
|
Temporal start-workflow call actually needs (namespace, workflow type, args);
|
||
|
|
define against the real `internal/temporal` client code, not invented fields
|
||
|
|
- [ ] Long-poll/streaming semantics from the old `/workflow` handler are preserved
|
||
|
|
unbuffered through the new dispatcher (G4 still applies)
|
||
|
|
- [ ] Nothing in this adapter registers a Temporal namespace — registration stays
|
||
|
|
with queue-operator, same invariant as 7.3
|
||
|
|
- [ ] Old `/workflow*` path-mounted route is removed once this adapter is verified live
|
||
|
|
- [ ] Metrics/rejection counters cover this adapter with its own service label
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/ \
|
||
|
|
-H 'X-Service: workflow' -H 'X-Resource: workflow'
|
||
|
|
# expected: 401 without a token
|
||
|
|
|
||
|
|
curl -s -X POST https://api.riotpiao.com/ \
|
||
|
|
-H "Authorization: Bearer $WORKFLOW_TOKEN" \
|
||
|
|
-H 'X-Service: workflow' -H 'X-Resource: workflow' \
|
||
|
|
-d '{"namespace": "default", "workflowType": "smoke-test", "args": []}'
|
||
|
|
# expected: 200/202, Temporal's own start-workflow response, proxied unmodified
|
||
|
|
|
||
|
|
curl -s https://api.riotpiao.com/ \
|
||
|
|
-H "Authorization: Bearer $WORKFLOW_TOKEN" \
|
||
|
|
-H 'X-Service: workflow' -H 'X-Resource: workflow/<id>/history'
|
||
|
|
# expected: 200, workflow history payload
|
||
|
|
|
||
|
|
kubectl -n temporal exec svc/temporal-admintools -- tctl --ad temporal-frontend:7233 namespace list | sort > /tmp/ns.after
|
||
|
|
diff /tmp/ns.before /tmp/ns.after
|
||
|
|
# expected: no diff
|
||
|
|
```
|