config

type AuthConfig ¶

type AuthConfig struct {
	External    *ExternalAuthConfig `yaml:"external"`
	StaticToken *StaticTokenConfig  `yaml:"staticToken"`
	JWKS        *JWKSConfig         `yaml:"jwks"`
}

AuthConfig configures inbound authentication for the proxy listener. Exactly one authenticator must be selected: one of the built-in ones, or an external extension server that decides on the proxy's behalf.

func (a *AuthConfig) Validate() error

type Config ¶

type Config struct {
	Listen           ListenConfig        `yaml:",inline"`
	Encryption       Encryption          `yaml:"encryption"`
	ExtensionServers ExtensionServerList `yaml:"extensionServers"`
	Routing          Routing             `yaml:"routing"`
	Upstreams        UpstreamList        `yaml:"upstreams"`
	Auth             *AuthConfig         `yaml:"auth"`
}

Config is the top-level proxy configuration.

func Load(r io.Reader) (*Config, error)

func LoadFile(path string) (*Config, error)

func (c *Config) Validate() error

type ConfigParams ¶

type ConfigParams struct {
	fx.In
	File string `name:"configFile"`
}

ConfigParams holds the fx-injected dependencies for loading the config file.

type CredentialConfig ¶

type CredentialConfig struct {
	Static *StaticCredentialConfig `yaml:"static"`
}

CredentialConfig configures the credential the proxy presents to an upstream. Static is the only variant today.

func (c *CredentialConfig) Validate() error

type Encryption ¶

type Encryption struct {
	Enabled   bool                 `yaml:"enabled"`
	CacheSize int                  `yaml:"cacheSize"`
	Default   *KeyPolicy           `yaml:"default"`
	Overrides map[string]KeyPolicy `yaml:"overrides"`
}

Encryption configures envelope encryption of payloads. When Enabled, a Default key policy is required and governs how DEKs are provisioned and rotated. CacheSize bounds the in-memory DEK cache. Overrides maps a namespace to a key policy that supersedes Default for that namespace; the keys are pre-translation (local) namespace names, matching the namespace the vault seals under at request time.

func (e *Encryption) Validate() error

type ExtensionServer ¶ added in v0.3.0

type ExtensionServer struct {
	Name        string            `yaml:"name"`
	Listen      ListenConfig      `yaml:",inline"`
	Credentials *CredentialConfig `yaml:"credentials"`
}

ExtensionServer addresses an operator-run gRPC server implementing the extension APIs under api/, currently api.kms.v1.EncryptionService, the pluggable Key Encryption Key provider. The proxy has built-in KMS providers (awskms, azurekeyvault, gcpkms); an extension server is how an operator plugs in a backend the proxy does not support natively, such as an on-prem HSM or an internal key service.

Name identifies the server within the configuration so other blocks can reference it, and must be unique across the list. Credentials, when set, attach per-request credentials to the outbound calls and require TLS, since sending them over a plaintext connection would expose them on the wire.

Unlike Upstream, an extension server is dialed at a fixed address rather than resolved per request, so a templated hostPort is rejected outright instead of being deferred to request time.

func (s *ExtensionServer) Validate() error

type ExtensionServerList ¶ added in v0.3.0

type ExtensionServerList []ExtensionServer

ExtensionServerList is the configured set of extension servers. It exists as a named type so the checks that span the whole collection - name and address uniqueness - live alongside the per-entry checks instead of in the parent Config.

func (sl ExtensionServerList) Validate() error

type ExternalAuthConfig ¶ added in v0.4.0

type ExternalAuthConfig struct {
	Name              string   `yaml:"name"`
	CredentialHeaders []string `yaml:"credentialHeaders"`
}

ExternalAuthConfig delegates the inbound decision to an extension server implementing api.auth.v1.AuthService, for identity systems the built-in authenticators do not cover.

Name selects which configured extension server to ask. CredentialHeaders names the metadata headers carrying the caller's credentials, which the proxy lifts into the request it sends that server and removes from the stream it forwards upstream. It has to be declared because a verdict reports only admit-or-deny, so nothing in the exchange reveals which headers mattered.

Leaving it empty does not hide the caller's credentials from the server. The proxy forwards the caller's metadata on the call either way, so the server still sees whatever headers the caller sent; what it loses is the request field naming them, so it has to know which metadata to read and cannot tell a header this proxy vouches for from any other. Nothing is stripped before proxying upstream either, so the caller's credential continues to the upstream alongside any credential configured for it.

func (c *ExternalAuthConfig) Validate() error

type JWKSConfig ¶

type JWKSConfig struct {
	URL       string   `yaml:"url"`
	Audiences []string `yaml:"audiences"`
	Issuer    string   `yaml:"issuer"`
	Header    string   `yaml:"header"`
	Scheme    string   `yaml:"scheme"`
}

JWKSConfig verifies an inbound JWT's signature and claims against a JWKS.

func (c *JWKSConfig) Validate() error

type KeyPolicy ¶

type KeyPolicy struct {
	URI         url.URL       `yaml:"uri"`
	DecryptURIs []url.URL     `yaml:"decryptURIs"`
	Duration    time.Duration `yaml:"duration"`
	RenewBefore time.Duration `yaml:"renewBefore"`
}

KeyPolicy describes the KMS key backing a DEK and its rotation schedule. URI is the primary key used to wrap new DEKs; DecryptURIs are additional keys accepted when unwrapping existing DEKs (for example, during key migration). Duration is a DEK's lifetime and RenewBefore is the lead time before that lifetime elapses at which rotation begins.

func (p *KeyPolicy) Validate() error

type ListenConfig ¶

type ListenConfig struct {
	HostPort string     `yaml:"hostPort"`
	TLS      *TLSConfig `yaml:"tls"`
}

ListenConfig defines properties for an inbound listener.

func (l *ListenConfig) Validate() error

type NamespaceConfig ¶

type NamespaceConfig struct {
	Rules NamespaceRules `yaml:"rules"`
}

NamespaceConfig groups the namespace translation rules for an upstream.

func (c *NamespaceConfig) Validate() error

type NamespaceMapping ¶

type NamespaceMapping struct {
	Local  string `yaml:"local"`
	Remote string `yaml:"remote"`
}

NamespaceMapping is one explicit local/remote namespace pair, used to short-circuit the prefix/suffix rule for namespaces whose names do not follow the convention.

func (m *NamespaceMapping) Validate() error

type NamespaceRules ¶

type NamespaceRules struct {
	Prefix    string             `yaml:"prefix"`
	Suffix    string             `yaml:"suffix"`
	Overrides []NamespaceMapping `yaml:"overrides"`
	// contains filtered or unexported fields
}

NamespaceRules translates namespace names between the local view that workers use and the remote names registered on the upstream cluster.

The default translation is to wrap or unwrap a Prefix and Suffix: Remote("payments") returns Prefix+"payments"+Suffix, and Local of that returns "payments". When an explicit Overrides entry matches, the override takes precedence over the prefix/suffix rule.

func (r *NamespaceRules) Configured() bool

func (r *NamespaceRules) Local(remoteNS string) string

func (r *NamespaceRules) Remote(localNS string) string

func (r *NamespaceRules) UnmarshalYAML(unmarshal func(any) error) error

func (r *NamespaceRules) Validate() error

type Routing ¶

type Routing struct {
	DefaultUpstream string        `yaml:"default"`
	SystemUpstream  string        `yaml:"system"`
	Rules           []RoutingRule `yaml:"rules"`
}

Routing selects which upstream serves a request. DefaultUpstream is the fallback when no rule matches and SystemUpstream serves system-namespace traffic; both name an upstream and are optional. Rules are evaluated in order against the incoming request.

func (r *Routing) Validate() error

type RoutingMatch ¶

type RoutingMatch struct {
	Namespace string            `yaml:"namespace"`
	Metadata  map[string]string `yaml:"metadata"`
}

RoutingMatch describes the request attributes a rule matches on. A match requires at least one of Namespace or Metadata: an empty match would apply to every request, which is what DefaultUpstream is for.

func (m *RoutingMatch) Validate() error

type RoutingRule ¶

type RoutingRule struct {
	Upstream string       `yaml:"upstream"`
	Match    RoutingMatch `yaml:"match"`
}

RoutingRule sends every request matched by Match to the named Upstream.

func (r *RoutingRule) Validate() error

type StaticCredentialConfig ¶

type StaticCredentialConfig struct {
	APIKey string `yaml:"apiKey"`
	Header string `yaml:"header"`
	Scheme string `yaml:"scheme"`
}

StaticCredentialConfig injects a fixed API key as a bearer header on every outbound request to the upstream.

func (c *StaticCredentialConfig) Validate() error

type StaticTokenConfig ¶

type StaticTokenConfig struct {
	Token  string `yaml:"token"`
	Header string `yaml:"header"`
	Scheme string `yaml:"scheme"`
}

StaticTokenConfig compares an inbound bearer token against a fixed value.

func (c *StaticTokenConfig) Validate() error

type TLSConfig ¶

type TLSConfig struct {
	CA         string `yaml:"ca"`         // PEM-encoded CA certificate (mTLS only)
	Cert       string `yaml:"cert"`       // PEM-encoded server certificate
	Key        string `yaml:"key"`        // PEM-encoded private key
	ServerName string `yaml:"serverName"` // Optional SNI override
}

TLSConfig specifies TLS material for an inbound HTTPS listener. When CAFile is non-empty the listener enforces mutual TLS: connecting clients must present a certificate signed by that CA.

NB: Be sure to set ServerName when the host name you dial doesn't match the CN or SAN on the server's certificate.

func (t *TLSConfig) Dialer() *creds.Dialer

func (t *TLSConfig) Listener() *creds.Listener

func (t *TLSConfig) Validate() error

type Upstream ¶

type Upstream struct {
	Name        string            `yaml:"name"`
	Listen      ListenConfig      `yaml:",inline"`
	Namespaces  NamespaceConfig   `yaml:"namespaces"`
	Credentials *CredentialConfig `yaml:"credentials"`
}

Upstream describes a single upstream Temporal cluster the proxy connects workers to along with configuration for that remote cluster. Name identifies the upstream so routing rules can refer to it; it must be unique within the config.

func (u *Upstream) IsTemplated() bool

func (u *Upstream) Validate() error

type UpstreamList ¶ added in v0.3.0

type UpstreamList []Upstream

func (ul UpstreamList) Validate() error