Add encryption config with validation - #260
Open
pseudomuto wants to merge 1 commit into
Open
Conversation
Adds an encryption block to cluster connections, configuring envelope encryption of replication payloads: a data encryption key seals the payload and a customer-managed KMS key wraps the DEK. A default key policy applies to every namespace, with per-namespace overrides. Validation composes from `S2SProxyConfig` down through each cluster connection, so a bad key URI surfaces as `clusterConnections[0].encryption.overrides[ns].uri` rather than a message the operator has to go hunting for. `NewProxy` runs it before building anything, which is the one point every `ConfigProvider` passes through, and means an invalid config costs no listeners. > [!NOTE] > In #248 we pinned server to v1.31.2. The temporal-proxy module uses > api v1.63 which would bump server to v1.32.0. In order to avoid that, > since I'm assuming the rollback/pin is still necessary, I've ensured > server v1.31.2 remains by forcing v1.62.8 in go.mod.
pseudomuto
commented
Aug 24, 2026
| github.com/temporalio/temporal-proxy v0.5.1 | ||
| github.com/urfave/cli/v2 v2.27.7 | ||
| go.temporal.io/api v1.62.8 | ||
| go.temporal.io/api v1.63.5 |
Author
There was a problem hiding this comment.
See replace above for why this is safe
liam-lowe
approved these changes
Aug 24, 2026
| package config | ||
|
|
||
| import ( | ||
| "github.com/temporalio/temporal-proxy/pkg/validation" |
Comment on lines
+5
to
+10
| // go.temporal.io/server v1.31.2 is built against api v1.62.8, and its | ||
| // client/frontend wrappers don't implement the WorkflowServiceClient methods | ||
| // added in api v1.63 (CountNexusOperationExecutions). temporal-proxy requires | ||
| // api v1.63.5, so without this pin MVS picks v1.63.5 and cmd/proxy stops | ||
| // compiling. Drop the pin once we move off server v1.31.2, which was itself a | ||
| // rollback: https://github.com/temporalio/s2s-proxy/pull/248 |
Contributor
There was a problem hiding this comment.
Drop the pin once we move off server v1.31.2
1.31.2 is the latest server release - should we update temporal proxy instead, so that we aren't using pre-release APIs until we get into a proper release / tagging process that aligns with temporal server.
Unsure if there's any value or strict requirement to keeping temporal proxy at pre-release versions given it will be used by OSS customers?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an encryption block to cluster connections, configuring envelope encryption of replication payloads: a data encryption key seals the payload and a customer-managed KMS key wraps the DEK. A default key policy applies to every namespace, with per-namespace overrides.
Validation composes from
S2SProxyConfigdown through each cluster connection, so a bad key URI surfaces asclusterConnections[0].encryption.overrides[ns].urirather than a message the operator has to go hunting for.NewProxyruns it before building anything, which is the one point everyConfigProviderpasses through, and means an invalid config costs no listeners.Note
In #248 we pinned server to v1.31.2. The temporal-proxy module uses
api v1.63 which would bump server to v1.32.0. In order to avoid that,
since I'm assuming the rollback/pin is still necessary, I've ensured
server v1.31.2 remains by forcing v1.62.8 in go.mod.