Admin Bot
55b32b97e0
PHASE 8 COMPLETE (10/10 tasks): - 8.2: X-Service/X-Resource dispatcher ✅ - 8.10: Phase gate - all 5 services routing ✅ Architecture decisions documented: - Gateway = dumb pipe (Option B) - SQS: gateway validates JWT (code unverified) - MinIO, Temporal: native JWT support - Memory, IAM: service-owned validation - ConfigMap-based config with Stakater Reloader - Real integration tests with cluster services PHASE 3 (Auth) TASKS CREATED (0/3 TODO): - 3.1: SQS JWT validation vs Authentik JWKS - 3.2: MinIO native JWT load-test - 3.3: Temporal JWT jwtKeyProvider configuration Updates: - tasks/8.2-x-service-dispatcher.md: marked GREEN - tasks/8.10-serviceadapter-gate.md: marked GREEN with notes - tasks/3.1-3.3: new Phase 3 auth tasks - tasks/INDEX.md: Phase 8 complete, Phase 3 active
66 lines
2.3 KiB
Markdown
66 lines
2.3 KiB
Markdown
# 3.3 — Temporal: Configure native JWT validation via jwtKeyProvider
|
|
|
|
Phase: 3 — Authentication & Authorization
|
|
Stage: TODO
|
|
Depends on: 8.2 (X-Service dispatcher), 8.10 (gate)
|
|
|
|
## Context
|
|
|
|
Temporal Helm chart supports native JWT authorization:
|
|
- `server.config.authorization.jwtKeyProvider`
|
|
- `claimMapper` for custom claim handling
|
|
|
|
Per homelab/project-usage/jwt-auth-rollout.md: "native JWT authorization support".
|
|
But currently **not configured** — unresolved design question on external access.
|
|
|
|
**Phase 8.2 decision**: Gateway detects gRPC (returns 501 not-implemented).
|
|
Phase 9 will add gRPC proxy. Phase 3 can configure JWT validation in Temporal.
|
|
|
|
## Requirements
|
|
|
|
- [ ] Configure `server.config.authorization.jwtKeyProvider` in Temporal Helm values
|
|
- Point at Authentik JWKS: `https://authentik.riotpiao.com/application/o/workflow/jwks/`
|
|
- [ ] Configure `claimMapper` to translate Authentik claims:
|
|
- `permissions` claim → Temporal permissions
|
|
- OR `groups` claim → Temporal role mappings
|
|
- [ ] Test: In-cluster worker with JWT can connect to Temporal frontend
|
|
- [ ] Test: Unauthenticated client gets 401
|
|
- [ ] Verify: No impact on existing workers/clients (backward compat)
|
|
|
|
## Implementation
|
|
|
|
1. Update k8s/infra temporal-values.yaml:
|
|
```yaml
|
|
server:
|
|
config:
|
|
authorization:
|
|
jwtKeyProvider:
|
|
keySourceURIs:
|
|
- "https://authentik.riotpiao.com/application/o/workflow/jwks/"
|
|
claimMapper: |
|
|
# Custom claims mapping (TBD)
|
|
```
|
|
2. Deploy & test
|
|
3. Add integration test (requires gRPC client, Phase 9)
|
|
|
|
## Verification
|
|
|
|
```bash
|
|
# In-cluster test (Pod with JWT)
|
|
kubectl -n temporal run --rm -it temporal-test \
|
|
--image=temporalioservices/temporal-server:latest \
|
|
-- tctl --address temporal-frontend:7233 namespace list
|
|
|
|
# External test (Phase 9, requires gRPC proxy)
|
|
# grpcurl -H "Authorization: Bearer $JWT" \
|
|
# temporal-frontend.cluster.local:7233 \
|
|
# temporal.api.workflowservice.v1.WorkflowService/ListNamespaces
|
|
```
|
|
|
|
## Notes
|
|
|
|
- **Not Phase 8.2**: Routing is done, auth config is Phase 3+
|
|
- **Temporal owner responsibility**: Configure JWT in temporal-values.yaml (k8s/infra)
|
|
- **Gateway responsibility**: Pass gRPC through (Phase 9: grpcproxy)
|
|
- **Open question**: External access to Temporal frontend (TBD)
|