rock/homelab-frontend

Fork 0

Files

T

Admin Bot 55b32b97e0

CI / Vet, test, build (push) Successful in 2m11s

Details

CI / Build and push image (push) Successful in 42s

Details

mark: Phase 8.2, 8.10 GREEN; create Phase 3 auth tasks

PHASE 8 COMPLETE (10/10 tasks):
- 8.2: X-Service/X-Resource dispatcher ✅
- 8.10: Phase gate - all 5 services routing ✅

Architecture decisions documented:
- Gateway = dumb pipe (Option B)
- SQS: gateway validates JWT (code unverified)
- MinIO, Temporal: native JWT support
- Memory, IAM: service-owned validation
- ConfigMap-based config with Stakater Reloader
- Real integration tests with cluster services

PHASE 3 (Auth) TASKS CREATED (0/3 TODO):
- 3.1: SQS JWT validation vs Authentik JWKS
- 3.2: MinIO native JWT load-test
- 3.3: Temporal JWT jwtKeyProvider configuration

Updates:
- tasks/8.2-x-service-dispatcher.md: marked GREEN
- tasks/8.10-serviceadapter-gate.md: marked GREEN with notes
- tasks/3.1-3.3: new Phase 3 auth tasks
- tasks/INDEX.md: Phase 8 complete, Phase 3 active

2026-08-27 11:36:13 -07:00

2.3 KiB

Raw Blame History

3.3 — Temporal: Configure native JWT validation via jwtKeyProvider

Phase: 3 — Authentication & Authorization Stage: TODO Depends on: 8.2 (X-Service dispatcher), 8.10 (gate)

Context

Temporal Helm chart supports native JWT authorization:

server.config.authorization.jwtKeyProvider
claimMapper for custom claim handling

Per homelab/project-usage/jwt-auth-rollout.md: "native JWT authorization support". But currently not configured — unresolved design question on external access.

Phase 8.2 decision: Gateway detects gRPC (returns 501 not-implemented). Phase 9 will add gRPC proxy. Phase 3 can configure JWT validation in Temporal.

Requirements

Configure server.config.authorization.jwtKeyProvider in Temporal Helm values
- Point at Authentik JWKS: https://authentik.riotpiao.com/application/o/workflow/jwks/
Configure claimMapper to translate Authentik claims:
- permissions claim → Temporal permissions
- OR groups claim → Temporal role mappings
Test: In-cluster worker with JWT can connect to Temporal frontend
Test: Unauthenticated client gets 401
Verify: No impact on existing workers/clients (backward compat)

Implementation

Update k8s/infra temporal-values.yaml:

server:
  config:
    authorization:
      jwtKeyProvider:
        keySourceURIs:
          - "https://authentik.riotpiao.com/application/o/workflow/jwks/"
      claimMapper: |
        # Custom claims mapping (TBD)

Deploy & test
Add integration test (requires gRPC client, Phase 9)

Verification

# In-cluster test (Pod with JWT)
kubectl -n temporal run --rm -it temporal-test \
  --image=temporalioservices/temporal-server:latest \
  -- tctl --address temporal-frontend:7233 namespace list

# External test (Phase 9, requires gRPC proxy)
# grpcurl -H "Authorization: Bearer $JWT" \
#   temporal-frontend.cluster.local:7233 \
#   temporal.api.workflowservice.v1.WorkflowService/ListNamespaces

Notes

Not Phase 8.2: Routing is done, auth config is Phase 3+
Temporal owner responsibility: Configure JWT in temporal-values.yaml (k8s/infra)
Gateway responsibility: Pass gRPC through (Phase 9: grpcproxy)
Open question: External access to Temporal frontend (TBD)

2.3 KiB Raw Blame History