Add API key support for the worker-controller #149
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Shivs11
commented
Sep 30, 2025
Shivs11
commented
Sep 30, 2025
carlydf
reviewed
Oct 7, 2025
jacobstr
added a commit
to jacobstr/temporal-worker-controller
that referenced
this pull request
Oct 7, 2025
Supporting review comments in temporalio#149 which I'd like to see over the line.
carlydf
reviewed
Oct 15, 2025
| @@ -0,0 +1,66 @@ | |||
| --- | |||
| apiVersion: rbac.authorization.k8s.io/v1 | |||
There was a problem hiding this comment.
I think this was accidentally committed (sidenote, we should fix the make manifests target to put these files in the right place after generating them, but for this PR just remove the extra files)
| @@ -0,0 +1,26 @@ | |||
| --- | |||
| apiVersion: admissionregistration.k8s.io/v1 | |||
Comment on lines
+58
to
+78
| func resolveAuthSecretName(tc *temporaliov1alpha1.TemporalConnection) (clientpool.AuthMode, string, error) { | ||
| auth := getAuthMode(tc) | ||
| switch auth { | ||
| case clientpool.AuthModeTLS: | ||
| name, err := getTLSSecretName(tc.Spec.MutualTLSSecretRef) | ||
| return auth, name, err | ||
| case clientpool.AuthModeAPIKey: | ||
| name, err := getAPIKeySecretName(tc.Spec.APIKeySecretRef) | ||
| return auth, name, err | ||
| default: | ||
| return auth, "", nil | ||
| } | ||
| } | ||
|
|
||
| func getAuthMode(temporalConnection *temporaliov1alpha1.TemporalConnection) clientpool.AuthMode { | ||
| if temporalConnection.Spec.MutualTLSSecretRef != nil { | ||
| return clientpool.AuthModeTLS | ||
| } else if temporalConnection.Spec.APIKeySecretRef != nil { | ||
| return clientpool.AuthModeAPIKey | ||
| } | ||
| return clientpool.AuthModeNoCredentials |
There was a problem hiding this comment.
nit: I only see getAuthMode used in this one place, so it's more concise to just do:
func resolveAuthSecretName(tc *temporaliov1alpha1.TemporalConnection) (clientpool.AuthMode, string, error) {
if temporalConnection.Spec.MutualTLSSecretRef != nil {
name, err := getTLSSecretName(tc.Spec.MutualTLSSecretRef)
return clientpool.AuthModeTLS, name, err
} else if temporalConnection.Spec.APIKeySecretRef != nil {
name, err := getAPIKeySecretName(tc.Spec.APIKeySecretRef)
return clientpool.AuthModeAPIKey, name, err
}
return clientpool.AuthModeNoCredentials, "", nil
}
| namespace: "" # e.g. default | ||
| # Use existing connection (leave empty to create new one) | ||
| connectionName: "" # e.g. dev-server | ||
| # Connection details (required if connectionName is empty) |
There was a problem hiding this comment.
Suggested change
| # Connection details (required if connectionName is empty) | |
| # Connection details (either mtlsSecretName or apiKey is required if connectionName is empty) |
(Or feel free to say that only one or the other is required in another way)
| "properties": { | ||
| "name": { | ||
| "type": "string", | ||
| "description": "Name of the secret containing API key (required if connectionName is empty)" |
There was a problem hiding this comment.
nit: this says that both apiKey and mtlsSecretName are required but only one or the other is required -- right?
carlydf
approved these changes
Oct 15, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What was changed
Why?
Checklist
Closes
Add API Keys support #144
How was this tested: