Documentation
¶
Index ¶
- func EnsureACRAuth(ctx workflow.Context, cfg *configs.OCIRegistryRepository) error
- func EnsureGARAuth(ctx workflow.Context, cfg *configs.OCIRegistryRepository) error
- type ACRAccessToken
- type Activities
- func (a *Activities) EnqueueSignalToOwner(ctx context.Context, req *EnqueueSignalToOwnerRequest) (*EnqueueSignalToOwnerResponse, error)
- func (a *Activities) GetACRAccessToken(ctx context.Context, req *GetACRAccessTokenRequest) (*ACRAccessToken, error)
- func (a *Activities) GetGARAccessToken(ctx context.Context, req *GetGARAccessTokenRequest) (*GARAccessToken, error)
- func (a *Activities) GetSandboxBuildOCIRegistry(ctx context.Context, req GetSandboxBuildOCIRegistryRequest) (*configs.OCIRegistryRepository, error)
- func (a *Activities) GetVersion(ctx context.Context, _ GetVersionRequest) (string, error)
- func (a *Activities) SendEmail(ctx context.Context, req SendNotificationRequest) error
- type EnqueueSignalToOwnerRequest
- type EnqueueSignalToOwnerResponse
- type GARAccessToken
- type GetACRAccessTokenRequest
- type GetGARAccessTokenRequest
- type GetSandboxBuildOCIRegistryRequest
- type GetVersionRequest
- type Params
- type SendNotificationRequest
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnsureACRAuth ¶ added in v0.19.1153
func EnsureACRAuth(ctx workflow.Context, cfg *configs.OCIRegistryRepository) error
EnsureACRAuth mints an ACR refresh token into cfg.OCIAuth so the runner can authenticate to a registry it has no identity for.
The runner only falls back to ambient Azure credentials when no token is supplied (see pkg/runner/registry/acr.FetchAccessInfo), which holds solely for registries in the same tenant as the runner's own managed identity. A vendor's registry lives in the vendor's tenant, and managed identity cannot cross that boundary, so the token has to be minted here.
Only applies when the config names an app registration. A plain ACR config keeps the existing ambient-identity behaviour, so same-tenant registries that work today are untouched.
Safe to call on any registry type; it is a no-op unless cfg is ACR with an app registration and no token already attached.
func EnsureGARAuth ¶ added in v0.19.1121
func EnsureGARAuth(ctx workflow.Context, cfg *configs.OCIRegistryRepository) error
EnsureGARAuth mints a GAR access token into cfg.OCIAuth so the runner can authenticate without GCP application default credentials of its own.
The runner only falls back to ADC when no token is supplied (see pkg/runner/registry/gar.FetchAccessInfo), which holds solely for runners that themselves run in GCP. A control plane in GCP can hand artifacts to a runner in AWS or Azure, so every plan carrying a GAR repository has to embed credentials minted here.
Safe to call on any registry type; it is a no-op unless cfg is GAR without a token already attached.
Types ¶
type ACRAccessToken ¶ added in v0.19.1153
type Activities ¶
type Activities struct {
// contains filtered or unexported fields
}
func New ¶
func New(params Params) (*Activities, error)
func (*Activities) EnqueueSignalToOwner ¶ added in v0.19.850
func (a *Activities) EnqueueSignalToOwner(ctx context.Context, req *EnqueueSignalToOwnerRequest) (*EnqueueSignalToOwnerResponse, error)
EnqueueSignalToOwner sends a signal to a queue owned by a specific entity (e.g., runner, install). This enables cross-namespace signal sending where one namespace can trigger work in another.
@temporal-gen-v2 activity
func (*Activities) GetACRAccessToken ¶ added in v0.19.1153
func (a *Activities) GetACRAccessToken(ctx context.Context, req *GetACRAccessTokenRequest) (*ACRAccessToken, error)
GetACRAccessToken mints a registry refresh token for a vendor-owned ACR.
Like GetGARAccessToken this lives in the shared activity set because both the components namespace (pulling a source image for a build) and the installs namespace (resolving a sandbox artifact) schedule it.
@temporal-gen-v2 activity @max-retries 1
func (*Activities) GetGARAccessToken ¶ added in v0.19.1121
func (a *Activities) GetGARAccessToken(ctx context.Context, req *GetGARAccessTokenRequest) (*GARAccessToken, error)
GetGARAccessToken lives in the shared activity set because both the components namespace (pulling a source image for a build) and the installs namespace (resolving the sandbox artifact) schedule it. Activities are registered per worker, so a components-only registration is invisible to installs.
@temporal-gen-v2 activity @max-retries 1
func (*Activities) GetSandboxBuildOCIRegistry ¶ added in v0.19.1118
func (a *Activities) GetSandboxBuildOCIRegistry(ctx context.Context, req GetSandboxBuildOCIRegistryRequest) (*configs.OCIRegistryRepository, error)
GetSandboxBuildOCIRegistry lives in the shared activity set because both the apps namespace (building the sandbox artifact) and the installs namespace (resolving it when planning a sandbox run) schedule it. Activities are registered per worker, so an apps-only registration is invisible to installs until it is called.
@temporal-gen-v2 activity @start-to-close-timeout 30s
func (*Activities) GetVersion ¶
func (a *Activities) GetVersion(ctx context.Context, _ GetVersionRequest) (string, error)
@temporal-gen-v2 activity @schedule-to-close-timeout 1m @start-to-close-timeout 10s
func (*Activities) SendEmail ¶
func (a *Activities) SendEmail(ctx context.Context, req SendNotificationRequest) error
@temporal-gen-v2 activity @schedule-to-close-timeout 1m @start-to-close-timeout 10s
type EnqueueSignalToOwnerRequest ¶ added in v0.19.850
type EnqueueSignalToOwnerRequest struct {
OwnerID string `json:"owner_id" validate:"required"`
OwnerType string `json:"owner_type" validate:"required"`
QueueName string `json:"queue_name,omitempty"`
Signal signal.Signal `json:"signal" validate:"required"`
// QueueID short-circuits the owner/name lookup when set.
QueueID string `json:"queue_id,omitempty"`
DedupeKey *string `json:"dedupe_key,omitempty"`
// SignalOwnerID and SignalOwnerType are set on the QueueSignal record to track
// which entity (e.g. workflow step) triggered this signal execution.
SignalOwnerID string `json:"signal_owner_id,omitempty"`
SignalOwnerType string `json:"signal_owner_type,omitempty"`
IdempotencyKey string `json:"idempotency_key,omitempty" validate:"omitempty,max=255"`
// Callback describes where the handler should send a Temporal signal on completion.
// Deprecated: use Callbacks for new code.
Callback callback.Ref `json:"callback,omitempty"`
// Callbacks supports multiple completion targets.
Callbacks callback.Refs `json:"callbacks,omitempty"`
}
type EnqueueSignalToOwnerResponse ¶ added in v0.19.850
type GARAccessToken ¶ added in v0.19.1121
type GetACRAccessTokenRequest ¶ added in v0.19.1153
type GetACRAccessTokenRequest struct {
// ComponentID rather than an app ID: it is present on every build plan
// without depending on a preload, and the activity has a DB handle anyway.
ComponentID string
LoginServer string
TenantID string
ClientID string
ClientSecretName string
ClientCertificateName string
}
GetACRAccessTokenRequest names the credential rather than carrying it.
ClientSecretName and ClientCertificateName are AppSecret names, resolved against the DB inside the activity. Activity inputs are recorded in Temporal history, so passing the vendor's long-lived secret here would persist it; passing a name persists nothing. The minted refresh token does land in history as the activity result, but it expires in 60 minutes — the same exposure GAR tokens already have.
type GetGARAccessTokenRequest ¶ added in v0.19.1121
type GetSandboxBuildOCIRegistryRequest ¶ added in v0.19.1118
type GetSandboxBuildOCIRegistryRequest struct {
AppID string `json:"app_id" validate:"required"`
}
type GetVersionRequest ¶
type GetVersionRequest struct{}