Documentation
¶
Overview ¶
Package gateway exposes a narrow, authenticated slice of the Temporal WorkflowService to backup agents on the server's public port.
Agents are Temporal SDK activity workers. Instead of reaching the Temporal frontend directly they speak gRPC to fallbck-server, which authenticates the agent bearer token, allows only the RPCs an activity-only worker needs, pins every call to the agent's own task queue and forwards it to the real frontend (embedded loopback or an external cluster). This makes the gateway the single authorization boundary for agents regardless of how Temporal is deployed.
Index ¶
Constants ¶
const MaxMessageSize = 64 * 1024 * 1024
MaxMessageSize matches Temporal's default frontend limit (4 MiB) with headroom
Variables ¶
This section is empty.
Functions ¶
func Dial ¶
Dial connects to a Temporal frontend for use as the gateway backend. tlsConfig nil means plaintext (the embedded loopback frontend).
func IsGRPCRequest ¶
IsGRPCRequest reports whether an HTTP/2 request carries gRPC
Types ¶
type AgentVerifier ¶
type AgentVerifier interface {
Verify(ctx context.Context, bearer string) (*auth.AgentClaims, error)
}
AgentVerifier authenticates agent bearer tokens (implemented by *auth.AgentVerifier)
type Gateway ¶
type Gateway struct {
// contains filtered or unexported fields
}
Gateway is the authenticating WorkflowService proxy
func New ¶
func New(backend workflowservice.WorkflowServiceClient, verifier AgentVerifier, namespace string, logger *slog.Logger) *Gateway
New builds a gateway in front of backend for the given namespace
func (*Gateway) GRPCServer ¶
GRPCServer exposes the underlying server (for ServeHTTP or a dedicated listener)
func (*Gateway) GracefulStop ¶
func (g *Gateway) GracefulStop()
GracefulStop stops accepting new RPCs and waits for in-flight ones
func (*Gateway) Handler ¶
Handler routes gRPC requests to the gateway and everything else to next. Mount it as the root handler of an h2c-enabled http.Server.
func (*Gateway) RegisterService ¶ added in v0.6.0
func (g *Gateway) RegisterService(desc *grpc.ServiceDesc, impl any)
RegisterService adds another gRPC service (e.g. the PBS backup tunnel) to the gateway server. Its RPCs are subject to the same agent authentication.
Source Files