Skip to content

Add TLS Server Name Config #686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cretz merged 10 commits into from
Oct 22, 2025
Merged

Add TLS Server Name Config #686

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
a75776a
update harnesses for tls server name
kepe-temporal Oct 20, 2025
84f603e
formatting
kepe-temporal Oct 20, 2025
a0fa3b9
fix java line
kepe-temporal Oct 20, 2025
89e2bf3
try to resolve build
kepe-temporal Oct 20, 2025
c6bab27
build
kepe-temporal Oct 20, 2025
0251bb1
bump sdk
kepe-temporal Oct 20, 2025
585a59e
Update cmd/run.go
kepe-temporal Oct 20, 2025
de7fd05
Update harness/go/harness/util.go
kepe-temporal Oct 20, 2025
9bead16
fix BuildId
kepe-temporal Oct 20, 2025
18b065e
field name
kepe-temporal Oct 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion cmd/run.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,7 @@ type RunConfig struct {
Namespace string
ClientCertPath string
ClientKeyPath string
TLSServerName string
GenerateHistory bool
DisableHistoryCheck bool
RetainTempDir bool
Expand Down Expand Up @@ -92,6 +93,11 @@ func (r *RunConfig) dockerRunFlags() []cli.Flag {
Usage: "Path of TLS client key to use (optional)",
Destination: &r.ClientKeyPath,
},
&cli.StringFlag{
Name: "tls-server-name",
Usage: "TLS server name to use for verification and SNI override (optional)",
Destination: &r.TLSServerName,
},
}
}

Expand Down Expand Up @@ -238,7 +244,7 @@ func (r *Runner) Run(ctx context.Context, patterns []string) error {
} else {
// Wait for namespace to become available
err := harness.WaitNamespaceAvailable(ctx, r.log,
r.config.Server, r.config.Namespace, r.config.ClientCertPath, r.config.ClientKeyPath)
r.config.Server, r.config.Namespace, r.config.ClientCertPath, r.config.ClientKeyPath, r.config.TLSServerName)
if err != nil {
return err
}
Expand Down Expand Up @@ -294,6 +300,7 @@ func (r *Runner) Run(ctx context.Context, patterns []string) error {
Namespace: r.config.Namespace,
ClientCertPath: r.config.ClientCertPath,
ClientKeyPath: r.config.ClientKeyPath,
TLSServerName: r.config.TLSServerName,
SummaryURI: r.config.SummaryURI,
HTTPProxyURL: r.config.HTTPProxyURL,
}).Run(ctx, run)
Expand Down
3 changes: 3 additions & 0 deletions cmd/run_dotnet.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ func (r *Runner) RunDotNetExternal(ctx context.Context, run *cmd.Run) error {
if r.config.HTTPProxyURL != "" {
args = append(args, "--http-proxy-url", r.config.HTTPProxyURL)
}
if r.config.TLSServerName != "" {
args = append(args, "--tls-server-name", r.config.TLSServerName)
}
args = append(args, run.ToArgs()...)
cmd, err := r.program.NewCommand(ctx, args...)
if err == nil {
Expand Down
3 changes: 3 additions & 0 deletions cmd/run_go.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,9 @@ func (r *Runner) RunGoExternal(ctx context.Context, run *cmd.Run) error {
if r.config.HTTPProxyURL != "" {
args = append(args, "--http-proxy-url", r.config.HTTPProxyURL)
}
if r.config.TLSServerName != "" {
args = append(args, "--tls-server-name", r.config.TLSServerName)
}
args = append(args, run.ToArgs()...)
cmd, err := r.program.NewCommand(ctx, args...)
if err == nil {
Expand Down
3 changes: 3 additions & 0 deletions cmd/run_java.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,9 @@ func (r *Runner) RunJavaExternal(ctx context.Context, run *cmd.Run) error {
if r.config.HTTPProxyURL != "" {
args = append(args, "--http-proxy-url", r.config.HTTPProxyURL)
}
if r.config.TLSServerName != "" {
args = append(args, "--tls-server-name", r.config.TLSServerName)
}
args = append(args, run.ToArgs()...)

// Run
Expand Down
3 changes: 3 additions & 0 deletions cmd/run_php.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,9 @@ func (r *Runner) RunPhpExternal(ctx context.Context, run *cmd.Run) error {
}
args = append(args, "tls.key="+clientKeyPath)
}
if r.config.TLSServerName != "" {
args = append(args, "tls.server-name="+r.config.TLSServerName)
}

// Run
cmd, err := r.program.NewCommand(ctx, args...)
Expand Down
3 changes: 3 additions & 0 deletions cmd/run_python.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,9 @@ func (r *Runner) RunPythonExternal(ctx context.Context, run *cmd.Run) error {
if r.config.HTTPProxyURL != "" {
args = append(args, "--http-proxy-url", r.config.HTTPProxyURL)
}
if r.config.TLSServerName != "" {
args = append(args, "--tls-server-name", r.config.TLSServerName)
}
args = append(args, run.ToArgs()...)

// Run
Expand Down
3 changes: 3 additions & 0 deletions cmd/run_typescript.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,9 @@ func (r *Runner) RunTypeScriptExternal(ctx context.Context, run *cmd.Run) error
if r.config.HTTPProxyURL != "" {
args = append(args, "--http-proxy-url", r.config.HTTPProxyURL)
}
if r.config.TLSServerName != "" {
args = append(args, "--tls-server-name", r.config.TLSServerName)
}
args = append(args, run.ToArgs()...)

// Run
Expand Down
8 changes: 7 additions & 1 deletion features/client/http_proxy/feature.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ func (h HTTPProxyTest) Execute(ctx context.Context, r *harness.Runner) (client.W
namespace: r.Namespace,
clientCertPath: r.ClientCertPath,
clientKeyPath: r.ClientKeyPath,
tlsServerName: r.TLSServerName,
taskQueue: r.TaskQueue,
workflowID: "wf-" + uuid.NewString(),
}
Expand Down Expand Up @@ -93,7 +94,7 @@ func SubprocessExecuteWorkflow(ctx context.Context, args *subprocessArgs) error
clientOpts := client.Options{HostPort: fmt.Sprintf("passthrough:///%s", args.server), Namespace: args.namespace}
if args.clientCertPath != "" {
var err error
clientOpts.ConnectionOptions.TLS, err = harness.LoadTLSConfig(args.clientCertPath, args.clientKeyPath)
clientOpts.ConnectionOptions.TLS, err = harness.LoadTLSConfig(args.clientCertPath, args.clientKeyPath, args.tlsServerName)
if err != nil {
return fmt.Errorf("failed loading TLS config: %w", err)
}
Expand Down Expand Up @@ -138,6 +139,7 @@ type subprocessArgs struct {
namespace string
clientCertPath string
clientKeyPath string
tlsServerName string
taskQueue string
workflowID string
useAuth bool
Expand All @@ -149,6 +151,7 @@ func (s *subprocessArgs) flags() []cli.Flag {
&cli.StringFlag{Name: "namespace", Destination: &s.namespace, Required: true},
&cli.StringFlag{Name: "client-cert-path", Destination: &s.clientCertPath},
&cli.StringFlag{Name: "client-key-path", Destination: &s.clientKeyPath},
&cli.StringFlag{Name: "tls-server-name", Destination: &s.tlsServerName},
&cli.StringFlag{Name: "task-queue", Destination: &s.taskQueue, Required: true},
&cli.StringFlag{Name: "workflow-id", Destination: &s.workflowID, Required: true},
}
Expand All @@ -164,6 +167,9 @@ func (s *subprocessArgs) args() []string {
if s.clientCertPath != "" {
args = append(args, "--client-cert-path", s.clientCertPath, "--client-key-path", s.clientKeyPath)
}
if s.tlsServerName != "" {
args = append(args, "--tls-server-name", s.tlsServerName)
}
return args
}

Expand Down
4 changes: 2 additions & 2 deletions features/deployment_versioning/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ func SetCurrent(r *harness.Runner, ctx context.Context, deploymentName string, v
}

_, err = dHandle.SetCurrentVersion(ctx, client.WorkerDeploymentSetCurrentVersionOptions{
BuildID: version.BuildId,
BuildID: version.BuildID,
ConflictToken: response1.ConflictToken,
})

Expand All @@ -110,7 +110,7 @@ func SetRamp(r *harness.Runner, ctx context.Context, deploymentName string, vers
}

_, err = dHandle.SetRampingVersion(ctx, client.WorkerDeploymentSetRampingVersionOptions{
BuildID: version.BuildId,
BuildID: version.BuildID,
ConflictToken: response1.ConflictToken,
Percentage: float32(100.0),
})
Expand Down
4 changes: 2 additions & 2 deletions features/deployment_versioning/routing_auto_upgrade/feature.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,11 @@ import (
var deploymentName = uuid.NewString()
var v1 = worker.WorkerDeploymentVersion{
DeploymentName: deploymentName,
BuildId: "1.0",
BuildID: "1.0",
}
var v2 = worker.WorkerDeploymentVersion{
DeploymentName: deploymentName,
BuildId: "2.0",
BuildID: "2.0",
}

func WaitForSignalOne(ctx workflow.Context) (string, error) {
Expand Down
4 changes: 2 additions & 2 deletions features/deployment_versioning/routing_pinned/feature.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,11 @@ import (
var deploymentName = uuid.NewString()
var v1 = worker.WorkerDeploymentVersion{
DeploymentName: deploymentName,
BuildId: "1.0",
BuildID: "1.0",
}
var v2 = worker.WorkerDeploymentVersion{
DeploymentName: deploymentName,
BuildId: "2.0",
BuildID: "2.0",
}

func WaitForSignalOne(ctx workflow.Context) (string, error) {
Expand Down
4 changes: 2 additions & 2 deletions features/deployment_versioning/routing_with_override/feature.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,11 @@ import (
var deploymentName = uuid.NewString()
var v1 = worker.WorkerDeploymentVersion{
DeploymentName: deploymentName,
BuildId: "1.0",
BuildID: "1.0",
}
var v2 = worker.WorkerDeploymentVersion{
DeploymentName: deploymentName,
BuildId: "2.0",
BuildID: "2.0",
}

func WaitForSignalOne(ctx workflow.Context) (string, error) {
Expand Down
4 changes: 2 additions & 2 deletions features/deployment_versioning/routing_with_ramp/feature.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,11 @@ import (
var deploymentName = uuid.NewString()
var v1 = worker.WorkerDeploymentVersion{
DeploymentName: deploymentName,
BuildId: "1.0",
BuildID: "1.0",
}
var v2 = worker.WorkerDeploymentVersion{
DeploymentName: deploymentName,
BuildId: "2.0",
BuildID: "2.0",
}

func WaitForSignalOne(ctx workflow.Context) (string, error) {
Expand Down
4 changes: 3 additions & 1 deletion features/update/self/feature.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ type ConnMaterial struct {
Identity string
ClientCertPath string
ClientKeyPath string
TLSServerName string
}

var Feature = harness.Feature{
Expand All @@ -44,6 +45,7 @@ var Feature = harness.Feature{
Identity: runner.Feature.ClientOptions.Identity,
ClientCertPath: runner.ClientCertPath,
ClientKeyPath: runner.ClientKeyPath,
TLSServerName: runner.TLSServerName,
})
},
}
Expand Down Expand Up @@ -75,7 +77,7 @@ func SelfUpdateWorkflow(ctx workflow.Context, cm ConnMaterial) (string, error) {
}

func SelfUpdateActivity(ctx context.Context, cm ConnMaterial) error {
tlsCfg, err := harness.LoadTLSConfig(cm.ClientCertPath, cm.ClientKeyPath)
tlsCfg, err := harness.LoadTLSConfig(cm.ClientCertPath, cm.ClientKeyPath, cm.TLSServerName)
if err != nil {
return err
}
Expand Down
10 changes: 5 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ require (
github.com/temporalio/features/features v0.0.0-00010101000000-000000000000
github.com/temporalio/features/harness/go v0.0.0-00010101000000-000000000000
github.com/urfave/cli/v2 v2.25.7
go.temporal.io/sdk v1.35.0
go.temporal.io/sdk v1.37.0
golang.org/x/mod v0.17.0
gopkg.in/yaml.v3 v3.0.1
)
Expand All @@ -21,7 +21,7 @@ require (
github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/mock v1.6.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
github.com/nexus-rpc/sdk-go v0.3.0 // indirect
github.com/robfig/cron v1.2.0 // indirect
Expand All @@ -31,7 +31,7 @@ require (
github.com/twmb/murmur3 v1.1.8 // indirect
github.com/uber-go/tally/v4 v4.1.7 // indirect
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
go.temporal.io/api v1.50.0 // indirect
go.temporal.io/api v1.53.0 // indirect
go.temporal.io/sdk/contrib/tally v0.2.0 // indirect
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
Expand All @@ -43,8 +43,8 @@ require (
golang.org/x/time v0.5.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240827150818-7e3bb234dfed // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240827150818-7e3bb234dfed // indirect
google.golang.org/grpc v1.66.0 // indirect
google.golang.org/protobuf v1.36.5 // indirect
google.golang.org/grpc v1.67.1 // indirect
google.golang.org/protobuf v1.36.6 // indirect
)

replace (
Expand Down
Loading
Loading