Add API key support for the worker-controller

.gitignore

@@ -10,3 +10,4 @@ certs
 .DS_Store
 
 .claude
+.config 

Makefile

@@ -158,20 +158,35 @@ manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and Cust
 generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
 	GOWORK=off GO111MODULE=on $(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths=./api/... paths=./internal/... paths=./cmd/...
 
-# source secret.env && make start-sample-workflow TEMPORAL_CLOUD_API_KEY=$TEMPORAL_CLOUD_API_KEY
 .PHONY: start-sample-workflow
+.SILENT: start-sample-workflow
 start-sample-workflow: ## Start a sample workflow.
-	@$(TEMPORAL) workflow start --type "HelloWorld" --task-queue "default/helloworld" \
-      --tls-cert-path certs/client.pem \
-      --tls-key-path certs/client.key \
-      --address "worker-controller-test.a2dd6.tmprl.cloud:7233" \
-      -n "worker-controller-test.a2dd6"
-#      --address replay-2025.ktasd.tmprl.cloud:7233 \
-#      --api-key $(TEMPORAL_CLOUD_API_KEY)
+	@set -e; \
+	# Load env vars from skaffold.env if present so address/namespace aren't hardcoded
+	if [ -f skaffold.env ]; then set -a; . skaffold.env; set +a; fi; \
+	API_KEY_VAL=""; \
+	if [ -n "$$TEMPORAL_API_KEY" ]; then API_KEY_VAL="$$TEMPORAL_API_KEY"; \
+	elif [ -f certs/api-key.txt ]; then API_KEY_VAL="$$(tr -d '\r\n' < certs/api-key.txt)"; fi; \
+	if [ -n "$$API_KEY_VAL" ]; then \
+	  $(TEMPORAL) workflow start --type "HelloWorld" --task-queue "default/helloworld" \
+	    --address "$$TEMPORAL_ADDRESS" \
+	    --namespace "$$TEMPORAL_NAMESPACE" \
+	    --api-key "$$API_KEY_VAL"; \
+	else \
+	  $(TEMPORAL) workflow start --type "HelloWorld" --task-queue "default/helloworld" \
+	    --tls-cert-path certs/client.pem \
+	    --tls-key-path certs/client.key \
+	    --address "$$TEMPORAL_ADDRESS" \
+	    --namespace "$$TEMPORAL_NAMESPACE"; \
+	fi
 
 .PHONY: apply-load-sample-workflow
+.SILENT: apply-load-sample-workflow
 apply-load-sample-workflow: ## Start a sample workflow every 15 seconds
-	watch --interval 0.1 -- $(TEMPORAL) workflow start --type "HelloWorld" --task-queue "default/helloworld"
+	@while true; do \
+		$(MAKE) -s start-sample-workflow; \
+		sleep 15; \
+	done
 
 .PHONY: list-workflow-build-ids
 list-workflow-build-ids: ## List workflow executions and their build IDs.
@@ -300,6 +315,11 @@ create-cloud-mtls-secret:
       --cert=certs/client.pem \
       --key=certs/client.key
 
+.PHONY: create-api-key-secret
+create-api-key-secret:
+	kubectl create secret generic temporal-api-key --namespace default \
+      --from-file=api-key=certs/api-key.txt
+
 ##### Checks #####
 goimports: fmt-imports $(GOIMPORTS)
 	@printf $(COLOR) "Run goimports for all files..."

api/v1alpha1/temporalconnection_types.go

@@ -5,6 +5,7 @@
 package v1alpha1
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -19,6 +20,7 @@ type SecretReference struct {
 }
 
 // TemporalConnectionSpec defines the desired state of TemporalConnection
+// +kubebuilder:validation:XValidation:rule="!(has(self.mutualTLSSecretRef) && has(self.apiKeySecretRef))",message="Only one of mutualTLSSecretRef or apiKeySecretRef may be set"
 type TemporalConnectionSpec struct {
 	// The host and port of the Temporal server.
 	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9.-]+:[0-9]+$`
@@ -32,6 +34,14 @@ type TemporalConnectionSpec struct {
 	// https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets
 	// +optional
 	MutualTLSSecretRef *SecretReference `json:"mutualTLSSecretRef,omitempty"`
+
+	// APIKeySecretRef selects the Secret key that contains the API key used for authentication.
+	// The Secret must be `type: kubernetes.io/opaque` and exist in the same Kubernetes namespace as
+	// the TemporalConnection resource. This is a corev1.SecretKeySelector and encodes both:
+	//   - LocalObjectReference.Name: the name of the Secret resource
+	//   - Key: the data key within Secret.Data whose value is the API key token
+	// +optional
+	APIKeySecretRef *corev1.SecretKeySelector `json:"apiKeySecretRef,omitempty"`
 }
 
 // TemporalConnectionStatus defines the observed state of TemporalConnection

config/rbac/role.yaml

@@ -0,0 +1,66 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: manager-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments/scale
+  verbs:
+  - update
+- apiGroups:
+  - temporal.io
+  resources:
+  - temporalconnections
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - temporal.io
+  resources:
+  - temporalworkerdeployments
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - temporal.io
+  resources:
+  - temporalworkerdeployments/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - temporal.io
+  resources:
+  - temporalworkerdeployments/status
+  verbs:
+  - get
+  - patch
+  - update

config/webhook/manifests.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: mutating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /mutate-temporal-io-temporal-io-v1alpha1-temporalworkerdeployment
+  failurePolicy: Fail
+  name: mtemporalworker.kb.io
+  rules:
+  - apiGroups:
+    - temporal.io.temporal.io
+    apiVersions:
+    - v1alpha1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - temporalworkers
+  sideEffects: None

helm/temporal-worker-controller/crds/temporal.io_temporalconnections.yaml

@@ -37,6 +37,19 @@ spec:
             type: object
           spec:
             properties:
+              apiKeySecretRef:
+                properties:
+                  key:
+                    type: string
+                  name:
+                    default: ""
+                    type: string
+                  optional:
+                    type: boolean
+                required:
+                - key
+                type: object
+                x-kubernetes-map-type: atomic
               hostPort:
                 pattern: ^[a-zA-Z0-9.-]+:[0-9]+$
                 type: string
@@ -51,6 +64,9 @@ spec:
             required:
             - hostPort
             type: object
+            x-kubernetes-validations:
+            - message: Only one of mutualTLSSecretRef or apiKeySecretRef may be set
+              rule: '!(has(self.mutualTLSSecretRef) && has(self.apiKeySecretRef))'
           status:
             type: object
         type: object