homelab-frontend/tasks/7.3-workflow-prefix.md

7.3 — /workflow/* to Temporal (GREEN)

Phase: 7 — Additional capability prefixes Stage: GREEN Depends on: Phase 6 (cutover) — done, confirmed live in-cluster

Temporal runs in the temporal namespace. Temporal namespace registration is automatic via queue-operator and is NEVER done manually — this route must not create, register or mutate Temporal namespaces, only proxy to what queue-operator has already provisioned.

• /workflow/* on api.riotpiao.com proxies to the Temporal Service in the temporal namespace
• Nothing in this route registers a Temporal namespace. Registration stays with queue-operator
• Path rewriting between the /workflow prefix and Temporal's own paths is explicit in configuration
• Timeouts and body caps are explicit, with no silent defaults (G6). Long-poll semantics are accounted for rather than truncated by a short read timeout
• The route requires authentication and the token is checked for workflow capability — a GPU token must not drive workflows
• The NetworkPolicy is extended to reach only Temporal
• Streaming or long-poll responses pass through unbuffered, and a client disconnect cancels the upstream call rather than orphaning it (G4)
• /v1/* behaviour is unchanged before and after
• Metrics and rejection counters cover this route with its own route label

Verify

curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
# expected: 401 without a token

curl -s -H "authorization: Bearer $WORKFLOW_TOKEN" https://api.riotpiao.com/workflow/health
# expected: Temporal's own response, proxied unmodified

kubectl -n temporal exec svc/temporal-admintools -- tctl --ad temporal-frontend:7233 namespace list | sort > /tmp/ns.after
diff /tmp/ns.before /tmp/ns.after
# expected: no diff — the gateway registered nothing; queue-operator remains the only registrar