Let the engine gateway read its identity map from a Secret - #202
Merged
Conversation
The gateway's identity map is keyed BY the bearer token, so `staticIdentities` can only be set by writing live credentials into a values file. For anyone keeping release config in version control that is not a weaker option, it is an unusable one — which leaves `defaultSubject`/`defaultRoles` as the only practical way to give the hop an identity, and that grants those roles to anything able to reach the Service. `staticIdentitiesExistingSecret` holds the same JSON under a Secret key and takes precedence, so the tokens stay out of the values file while everything else stays in it. This is the shape agent-orchestrator already uses for its own identity map (`config.staticIdentitiesExistingSecret`), down to the default key name, so the two subcharts now configure the same concern the same way. Also documents a sharp edge that was previously unstated: `defaultSubject` is a fallback for *unresolved* tokens, not just absent ones. `StaticResolver.Resolve` returns the fallback on a map miss, so a gateway with a default set never denies on identity alone — an unrecognised token is silently as good as no token. Verified by rendering all four states: - Secret set: renders a secretKeyRef. - Both set: the Secret wins and the plain token does not appear anywhere in the output. - Plain value only: unchanged from before. - Neither: no STATIC_IDENTITIES var at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
The engine gateway's identity map is keyed by the bearer token, so
gateway.identity.staticIdentitiescan only be set by writing live credentialsinto a values file. For anyone who keeps release config in version control that
is not a weaker option, it is an unusable one.
What is left is
defaultSubject/defaultRoles— which grants those roles toanything that can reach the Service. That is the choice this chart currently
forces, and it is the wrong one to force.
staticIdentitiesExistingSecretholds the same JSON under a Secret key andtakes precedence over the plain value.
Same shape agent-orchestrator already uses
This is not a new pattern.
agent-orchestratorsolved the identical problemwith
config.staticIdentitiesExistingSecret+staticIdentitiesExistingSecretKey, and this mirrors it down to the default keyname (
AGENT_STATIC_IDENTITIES) and theif secret / else if valueprecedence.Two subcharts, one concern, one way to configure it.
A sharp edge, now written down
defaultSubjectreads like a default for tokenless callers. It is also thefallback for unrecognised ones —
StaticResolver.Resolvereturns thefallback on a map miss, not nil. So a gateway with a default set never denies on
identity alone, and a typo'd or rotated token silently keeps working with the
default's roles instead of failing.
That is worth knowing before someone sets a default "just in case", so the
values comment now says it.
Verification
Rendered all four states:
staticIdentitiesExistingSecretstaticIdentitiessecretKeyRefSTATIC_IDENTITIESvar at allBackwards compatible: existing installs that set the plain value render exactly
as they did.
Versions
temporal-engine0.1.1 → 0.2.0, umbrella 0.4.0 → 0.5.0. Additive only — noexisting values change meaning.
🤖 Generated with Claude Code