Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Feature Request] Consider using explicit configuration for temporal api key

Aperta
  • Qualcosa non va?
#375 5 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@kriyanshii ci sta già lavorando.

Dal 31/8/2026.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go, kubernetes
Ambito
devops, infrastructure

Direzione di ricerca

Inizia da docs/configuration.md ed esamina la configurazione di TemporalWorkerDeployment e la gestione di secret e variabili d’ambiente da parte del controller. Chiarisci come dovrebbero funzionare un riferimento esplicito a un secret o a una API key, gli errori di collisione e la documentazione; il lavoro sarà completo quando il comportamento e la configurazione proposti saranno definiti senza fare affidamento sulla convenzione implicita attuale.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

rbac
Is your feature request related to a problem? Please describe.

TLDR; it doing weird magic stuff with regards to secrets management and that makes maintenance hard.

I am an application developer and tend to touch k8s the most on our team. Note that I am not the person who set the controller up in our environment. I am aware of it and have had my struggles with it, but its not at the front of my mind in general and I usually am just working with kubernetes abstractions.

In this situation I needed to rotate our temporal key. I look at our application secrets and notice that we have a TEMPORAL_API_KEY in our secrets (which are used via secretRef). I keep updating it checking it, triple checking it, rolling containers, no matter what I do, whenever I exec into the container I see the old api key.

Eventually I noticed we have another kubernetes secret named temporal-api-token that does have the old key in it, but the key is under the api-key value, not TEMPORAL_API_KEY which is what our code uses. I search all our helm charts, our entire codebase for either temporal-api-token or api-key and I find nothing in there. The way this is included in our helm chart it just creates an env var named api-key which everything ignores.

Eventually I track it down. What is happening is that we should not have had a TEMPORAL_API_KEY in secrets at all, that is something that the temporal worker controller creates. It just implicitly assumes that you have a secret named temporal-api-token, and that it has that api-key in it. None of it explicit, its all by convention and it then overwrites the actual environment variables when it starts. This is the only place I can find where any of this stuff is explained and it's frankly really confusing what you're supposed to do and what the options are.

All in all, this was a solid 3 hours of confusion and pulling my hair out over what might be going on.

Describe the solution you'd like

My recommendation for yall:

Document this a hell of a lot more clearly in a lot more places
Error if the TEMPORAL_API_KEY already exists and is going to get overwritten
Explicitly pass in the secret/api-key that will be used into the TemporalWorkerDeployment, This is not a spot for convention-over-configuration. I predict a lot of scenarios where someone sees that secret, finds no reference to it at all in their yaml templates, figures it is some sort of vestigial thing and deletes it then next time the containers restart they fail to come up.

Additional Context

Originally posted in slack

Lingua principale
Go
Stelle
197
Fork
79
Merge medio
5g 7h
PR unite (30g)
29

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di temporalio/temporal-worker-controller

Tutte le issue di temporalio/temporal-worker-controller

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.