Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates for temporal CLI over tctl and temporal dev-server #131

Merged
merged 3 commits into from
Jul 24, 2024
Merged

Updates for temporal CLI over tctl and temporal dev-server #131

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e5fcd59
Updates for temporal CLI over tctl and temporal dev-server
cici Jul 23, 2024
68e11f1
Remove comment to set an env variable
cici Jul 24, 2024
28b64ff
Merge branch 'main' into updates-for-cli
cici Jul 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 13 additions & 12 deletions encryption/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,11 @@ This sample shows how to make an encryption codec for end-to-end encryption. It
samples [in TypeScript](https://github.com/temporalio/samples-typescript/tree/main/encryption) and
[in Go](https://github.com/temporalio/samples-go/tree/main/encryption).

Ensure you have an environment variable set to the Namespace your Workflows are in:


export TEMPORAL_NAMESPACE=<Namespace Name>

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This variable is not used in this sample, the namespace is fixed to default (we expect to come later and make all samples run somewhere configurable)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added that in because my TEMPORAL_NAMESPACE was set to my Cloud Namespace and when I ran the starter, I got an error that the Namespace didn't exist, so I reset it to "default" and then it ran fine.

Copy link
Member

@cretz cretz Jul 23, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The starter in the encryption sample doesn't use env vars. Do you maybe mean the temporal CLI which does? There may be other env vars the CLI uses that you would have to make sure are unset if you're concerned about your existing environment variable leftovers polluting the CLI (though I can't think of any for dev server). Also, would encourage unset TEMPORAL_NAMESPACE instead of export TEMPORAL_NAMESPACE=<Namespace Name> and "Namespace your Workflows are in". This sample is hardcoded to work with default.

Copy link
Contributor Author

@cici cici Jul 24, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wasn't using the CLI to start the Workflow. I do see where it is using default, so I will have to debug what I was seeing. I will remove that statement.

For this sample, the optional `encryption` dependency group must be included. To include, run:

poetry install --with encryption
Expand All @@ -17,38 +22,34 @@ This will start the worker. Then, in another terminal, run the following to exec

poetry run python starter.py

The workflow should complete with the hello result. To view the workflow, use [tctl](https://docs.temporal.io/tctl-v1/):
The workflow should complete with the hello result. To view the workflow, use [temporal](https://docs.temporal.io/cli):

tctl workflow show --workflow_id encryption-workflow-id
temporal workflow show --workflow-id encryption-workflow-id

Note how the input/result look like (with wrapping removed):
Note how the result looks like (with wrapping removed):

```
Input:[encoding binary/encrypted: payload encoding is not supported]
...
Result:[encoding binary/encrypted: payload encoding is not supported]
Output:[encoding binary/encrypted: payload encoding is not supported]
```

This is because the data is encrypted and not visible. To make data visible to external Temporal tools like `tctl` and
This is because the data is encrypted and not visible. To make data visible to external Temporal tools like `temporal` and
the UI, start a codec server in another terminal:

poetry run python codec_server.py

Now with that running, run `tctl` again with the codec endpoint:
Now with that running, run `temporal` again with the codec endpoint:

tctl --codec_endpoint http://localhost:8081 workflow show --workflow_id encryption-workflow-id
temporal workflow show --workflow-id encryption-workflow-id --codec-endpoint http://localhost:8081

Notice now the output has the unencrypted values:

```
Input:["Temporal"]
...
Result:["Hello, Temporal"]
```

This decryption did not leave the local machine here.

Same case with the web UI. If you go to the web UI, you'll only see encrypted input/results. But, assuming your web UI
is at `http://localhost:8080`, if you set the "Remote Codec Endpoint" in the web UI to `http://localhost:8081` you can
is at `http://localhost:8233` (this is the default for the local dev server), if you set the "Remote Codec Endpoint" in the web UI to `http://localhost:8081` you can
then see the unencrypted results. This is possible because CORS settings in the codec server allow the browser to access
the codec server directly over localhost. They can be changed to suit Temporal cloud web UI instead if necessary.
4 changes: 2 additions & 2 deletions encryption/codec_server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ def build_codec_server() -> web.Application:
# Cors handler
async def cors_options(req: web.Request) -> web.Response:
resp = web.Response()
if req.headers.get(hdrs.ORIGIN) == "http://localhost:8080":
resp.headers[hdrs.ACCESS_CONTROL_ALLOW_ORIGIN] = "http://localhost:8080"
if req.headers.get(hdrs.ORIGIN) == "http://localhost:8233":
resp.headers[hdrs.ACCESS_CONTROL_ALLOW_ORIGIN] = "http://localhost:8233"
resp.headers[hdrs.ACCESS_CONTROL_ALLOW_METHODS] = "POST"
resp.headers[hdrs.ACCESS_CONTROL_ALLOW_HEADERS] = "content-type,x-namespace"
return resp
Expand Down