Skip to content

Commit 2e221d2

Browse files
daryllimytdaryllimyt
committed
feat(temporal): add breakglass codec server
1 parent 1a5b3c6 commit 2e221d2

File tree

18 files changed

+601
-19
lines changed

18 files changed

+601
-19
lines changed

‎deployments/eks/main.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,4 +133,13 @@ module "eks" {
133133

134134
# Feature flags (maps to enterprise.featureFlags)
135135
feature_flags = var.feature_flags
136+
137+
temporal_payload_encryption_enabled = var.temporal_payload_encryption_enabled
138+
temporal_payload_encryption_key_version = var.temporal_payload_encryption_key_version
139+
temporal_payload_encryption_cache_ttl_seconds = var.temporal_payload_encryption_cache_ttl_seconds
140+
temporal_payload_encryption_cache_max_items = var.temporal_payload_encryption_cache_max_items
141+
temporal_payload_encryption_existing_secret = var.temporal_payload_encryption_existing_secret
142+
temporal_payload_encryption_payload_key_secret_key = var.temporal_payload_encryption_payload_key_secret_key
143+
temporal_payload_encryption_visibility_hmac_secret_key = var.temporal_payload_encryption_visibility_hmac_secret_key
144+
temporal_payload_encryption_codec_server_shared_secret_key = var.temporal_payload_encryption_codec_server_shared_secret_key
136145
}

‎deployments/eks/modules/eks/helm.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,16 @@ resource "helm_release" "tracecat" {
150150
scrape = true
151151
}
152152
}
153+
temporalPayloadEncryption = {
154+
enabled = var.temporal_payload_encryption_enabled
155+
keyVersion = var.temporal_payload_encryption_key_version
156+
cacheTtlSeconds = var.temporal_payload_encryption_cache_ttl_seconds
157+
cacheMaxItems = var.temporal_payload_encryption_cache_max_items
158+
secretName = var.temporal_payload_encryption_existing_secret
159+
payloadKeySecretKey = var.temporal_payload_encryption_payload_key_secret_key
160+
visibilityHmacKeySecretKey = var.temporal_payload_encryption_visibility_hmac_secret_key
161+
codecServerSharedSecretKey = var.temporal_payload_encryption_codec_server_shared_secret_key
162+
}
153163
}
154164
# PostgreSQL TLS configuration with AWS RDS CA certificate
155165
externalPostgres = {

‎deployments/eks/modules/eks/variables.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -556,6 +556,54 @@ variable "feature_flags" {
556556
default = ""
557557
}
558558

559+
variable "temporal_payload_encryption_enabled" {
560+
description = "Enable application-layer encryption for Temporal payloads"
561+
type = bool
562+
default = false
563+
}
564+
565+
variable "temporal_payload_encryption_key_version" {
566+
description = "Current Temporal payload encryption key version"
567+
type = string
568+
default = "1"
569+
}
570+
571+
variable "temporal_payload_encryption_cache_ttl_seconds" {
572+
description = "In-memory cache TTL in seconds for resolved Temporal encryption keys"
573+
type = number
574+
default = 3600
575+
}
576+
577+
variable "temporal_payload_encryption_cache_max_items" {
578+
description = "Maximum number of cached Temporal encryption keys"
579+
type = number
580+
default = 128
581+
}
582+
583+
variable "temporal_payload_encryption_existing_secret" {
584+
description = "Existing Kubernetes Secret name for Temporal payload encryption secrets"
585+
type = string
586+
default = ""
587+
}
588+
589+
variable "temporal_payload_encryption_payload_key_secret_key" {
590+
description = "Secret key name for the Temporal payload encryption root key"
591+
type = string
592+
default = "payloadEncryptionKey"
593+
}
594+
595+
variable "temporal_payload_encryption_visibility_hmac_secret_key" {
596+
description = "Secret key name for the Temporal visibility HMAC key"
597+
type = string
598+
default = "visibilityHmacKey"
599+
}
600+
601+
variable "temporal_payload_encryption_codec_server_shared_secret_key" {
602+
description = "Secret key name for the Temporal codec server shared secret"
603+
type = string
604+
default = "codecServerSharedSecret"
605+
}
606+
559607
# Auth Configuration
560608
variable "auth_types" {
561609
description = "Comma-separated authentication types (e.g., 'oidc', 'basic,saml', 'basic,oidc')"

‎deployments/eks/variables.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -602,3 +602,51 @@ variable "feature_flags" {
602602
type = string
603603
default = ""
604604
}
605+
606+
variable "temporal_payload_encryption_enabled" {
607+
description = "Enable application-layer encryption for Temporal payloads"
608+
type = bool
609+
default = false
610+
}
611+
612+
variable "temporal_payload_encryption_key_version" {
613+
description = "Current Temporal payload encryption key version"
614+
type = string
615+
default = "1"
616+
}
617+
618+
variable "temporal_payload_encryption_cache_ttl_seconds" {
619+
description = "In-memory cache TTL in seconds for resolved Temporal encryption keys"
620+
type = number
621+
default = 3600
622+
}
623+
624+
variable "temporal_payload_encryption_cache_max_items" {
625+
description = "Maximum number of cached Temporal encryption keys"
626+
type = number
627+
default = 128
628+
}
629+
630+
variable "temporal_payload_encryption_existing_secret" {
631+
description = "Existing Kubernetes Secret name for Temporal payload encryption secrets"
632+
type = string
633+
default = ""
634+
}
635+
636+
variable "temporal_payload_encryption_payload_key_secret_key" {
637+
description = "Secret key name for the Temporal payload encryption root key"
638+
type = string
639+
default = "payloadEncryptionKey"
640+
}
641+
642+
variable "temporal_payload_encryption_visibility_hmac_secret_key" {
643+
description = "Secret key name for the Temporal visibility HMAC key"
644+
type = string
645+
default = "visibilityHmacKey"
646+
}
647+
648+
variable "temporal_payload_encryption_codec_server_shared_secret_key" {
649+
description = "Secret key name for the Temporal codec server shared secret"
650+
type = string
651+
default = "codecServerSharedSecret"
652+
}

‎deployments/fargate/main.tf‎

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -54,17 +54,21 @@ module "ecs" {
5454
temporal_namespace = var.temporal_namespace
5555

5656
# Container environment variables
57-
tracecat_app_env = var.tracecat_app_env
58-
log_level = var.log_level
59-
temporal_log_level = var.temporal_log_level
60-
feature_flags = var.feature_flags
61-
ee_multi_tenant = var.ee_multi_tenant
62-
context_compression_enabled = var.context_compression_enabled
63-
context_compression_threshold_kb = var.context_compression_threshold_kb
64-
result_externalization_enabled = var.result_externalization_enabled
65-
collection_manifests_enabled = var.collection_manifests_enabled
66-
result_externalization_threshold_bytes = var.result_externalization_threshold_bytes
67-
workflow_artifact_retention_days = var.workflow_artifact_retention_days
57+
tracecat_app_env = var.tracecat_app_env
58+
log_level = var.log_level
59+
temporal_log_level = var.temporal_log_level
60+
feature_flags = var.feature_flags
61+
ee_multi_tenant = var.ee_multi_tenant
62+
context_compression_enabled = var.context_compression_enabled
63+
context_compression_threshold_kb = var.context_compression_threshold_kb
64+
temporal_payload_encryption_enabled = var.temporal_payload_encryption_enabled
65+
temporal_payload_encryption_key_version = var.temporal_payload_encryption_key_version
66+
temporal_payload_encryption_cache_ttl_seconds = var.temporal_payload_encryption_cache_ttl_seconds
67+
temporal_payload_encryption_cache_max_items = var.temporal_payload_encryption_cache_max_items
68+
result_externalization_enabled = var.result_externalization_enabled
69+
collection_manifests_enabled = var.collection_manifests_enabled
70+
result_externalization_threshold_bytes = var.result_externalization_threshold_bytes
71+
workflow_artifact_retention_days = var.workflow_artifact_retention_days
6872

6973
# Database connection pool
7074
db_max_overflow = var.db_max_overflow
@@ -83,9 +87,12 @@ module "ecs" {
8387
temporal_db_snapshot_name = var.temporal_db_snapshot_name
8488

8589
# Secrets from AWS Secrets Manager
86-
tracecat_db_encryption_key_arn = var.tracecat_db_encryption_key_arn
87-
tracecat_service_key_arn = var.tracecat_service_key_arn
88-
tracecat_signing_secret_arn = var.tracecat_signing_secret_arn
90+
tracecat_db_encryption_key_arn = var.tracecat_db_encryption_key_arn
91+
tracecat_service_key_arn = var.tracecat_service_key_arn
92+
tracecat_signing_secret_arn = var.tracecat_signing_secret_arn
93+
temporal_payload_encryption_key_arn = var.temporal_payload_encryption_key_arn
94+
temporal_visibility_hmac_key_arn = var.temporal_visibility_hmac_key_arn
95+
temporal_codec_server_shared_secret_arn = var.temporal_codec_server_shared_secret_arn
8996

9097
# Authentication
9198
auth_types = var.auth_types

‎deployments/fargate/modules/ecs/iam.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,9 @@ resource "aws_iam_policy" "secrets_access" {
137137
var.tracecat_db_encryption_key_arn,
138138
var.tracecat_service_key_arn,
139139
var.tracecat_signing_secret_arn,
140+
var.temporal_payload_encryption_key_arn,
141+
var.temporal_visibility_hmac_key_arn,
142+
var.temporal_codec_server_shared_secret_arn,
140143
var.oauth_client_id_arn,
141144
var.oauth_client_secret_arn,
142145
var.oidc_client_id_arn,

‎deployments/fargate/modules/ecs/locals.tf‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,10 @@ locals {
4040
TRACECAT__EE_MULTI_TENANT = var.ee_multi_tenant
4141
TRACECAT__CONTEXT_COMPRESSION_ENABLED = var.context_compression_enabled
4242
TRACECAT__CONTEXT_COMPRESSION_THRESHOLD_KB = var.context_compression_threshold_kb
43+
TEMPORAL__PAYLOAD_ENCRYPTION_ENABLED = var.temporal_payload_encryption_enabled
44+
TEMPORAL__PAYLOAD_ENCRYPTION_KEY_VERSION = var.temporal_payload_encryption_key_version
45+
TEMPORAL__PAYLOAD_ENCRYPTION_CACHE_TTL_SECONDS = var.temporal_payload_encryption_cache_ttl_seconds
46+
TEMPORAL__PAYLOAD_ENCRYPTION_CACHE_MAX_ITEMS = var.temporal_payload_encryption_cache_max_items
4347
TRACECAT__RESULT_EXTERNALIZATION_ENABLED = var.result_externalization_enabled
4448
TRACECAT__COLLECTION_MANIFESTS_ENABLED = var.collection_manifests_enabled
4549
TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES = var.result_externalization_threshold_bytes
@@ -148,10 +152,10 @@ locals {
148152
migrations_env = [
149153
for k, v in merge(
150154
{
151-
LOG_LEVEL = var.log_level
152-
TRACECAT__DB_SSLMODE = "require"
153-
TRACECAT__DB_ENDPOINT = local.core_db_hostname
154-
TRACECAT__FEATURE_FLAGS = var.feature_flags
155+
LOG_LEVEL = var.log_level
156+
TRACECAT__DB_SSLMODE = "require"
157+
TRACECAT__DB_ENDPOINT = local.core_db_hostname
158+
TRACECAT__FEATURE_FLAGS = var.feature_flags
155159
},
156160
local.tracecat_db_configs
157161
) :

‎deployments/fargate/modules/ecs/secrets.tf‎

Lines changed: 58 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66
# Optional secrets:
77
# 1. OAUTH_CLIENT_ID
88
# 2. OAUTH_CLIENT_SECRET
9+
# 3. TEMPORAL__PAYLOAD_ENCRYPTION_KEY
10+
# 4. TEMPORAL__VISIBILITY_HMAC_KEY
11+
# 5. TEMPORAL__CODEC_SERVER_SHARED_SECRET
912

1013
### Required secrets
1114
data "aws_secretsmanager_secret" "tracecat_db_encryption_key" {
@@ -44,6 +47,21 @@ data "aws_secretsmanager_secret" "oidc_client_secret" {
4447
arn = var.oidc_client_secret_arn
4548
}
4649

50+
data "aws_secretsmanager_secret" "temporal_payload_encryption_key" {
51+
count = var.temporal_payload_encryption_key_arn != null ? 1 : 0
52+
arn = var.temporal_payload_encryption_key_arn
53+
}
54+
55+
data "aws_secretsmanager_secret" "temporal_visibility_hmac_key" {
56+
count = var.temporal_visibility_hmac_key_arn != null ? 1 : 0
57+
arn = var.temporal_visibility_hmac_key_arn
58+
}
59+
60+
data "aws_secretsmanager_secret" "temporal_codec_server_shared_secret" {
61+
count = var.temporal_codec_server_shared_secret_arn != null ? 1 : 0
62+
arn = var.temporal_codec_server_shared_secret_arn
63+
}
64+
4765
data "aws_secretsmanager_secret" "user_auth_secret" {
4866
count = var.user_auth_secret_arn != null ? 1 : 0
4967
arn = var.user_auth_secret_arn
@@ -117,6 +135,21 @@ data "aws_secretsmanager_secret_version" "oidc_client_secret" {
117135
secret_id = data.aws_secretsmanager_secret.oidc_client_secret[0].id
118136
}
119137

138+
data "aws_secretsmanager_secret_version" "temporal_payload_encryption_key" {
139+
count = var.temporal_payload_encryption_key_arn != null ? 1 : 0
140+
secret_id = data.aws_secretsmanager_secret.temporal_payload_encryption_key[0].id
141+
}
142+
143+
data "aws_secretsmanager_secret_version" "temporal_visibility_hmac_key" {
144+
count = var.temporal_visibility_hmac_key_arn != null ? 1 : 0
145+
secret_id = data.aws_secretsmanager_secret.temporal_visibility_hmac_key[0].id
146+
}
147+
148+
data "aws_secretsmanager_secret_version" "temporal_codec_server_shared_secret" {
149+
count = var.temporal_codec_server_shared_secret_arn != null ? 1 : 0
150+
secret_id = data.aws_secretsmanager_secret.temporal_codec_server_shared_secret[0].id
151+
}
152+
120153
data "aws_secretsmanager_secret_version" "user_auth_secret" {
121154
count = var.user_auth_secret_arn != null ? 1 : 0
122155
secret_id = data.aws_secretsmanager_secret.user_auth_secret[0].id
@@ -203,9 +236,33 @@ locals {
203236
}
204237
] : []
205238

239+
temporal_payload_encryption_secret = var.temporal_payload_encryption_key_arn != null ? [
240+
{
241+
name = "TEMPORAL__PAYLOAD_ENCRYPTION_KEY"
242+
valueFrom = data.aws_secretsmanager_secret_version.temporal_payload_encryption_key[0].arn
243+
}
244+
] : []
245+
246+
temporal_visibility_hmac_secret = var.temporal_visibility_hmac_key_arn != null ? [
247+
{
248+
name = "TEMPORAL__VISIBILITY_HMAC_KEY"
249+
valueFrom = data.aws_secretsmanager_secret_version.temporal_visibility_hmac_key[0].arn
250+
}
251+
] : []
252+
253+
temporal_codec_server_shared_secret = var.temporal_codec_server_shared_secret_arn != null ? [
254+
{
255+
name = "TEMPORAL__CODEC_SERVER_SHARED_SECRET"
256+
valueFrom = data.aws_secretsmanager_secret_version.temporal_codec_server_shared_secret[0].arn
257+
}
258+
] : []
259+
206260
tracecat_base_secrets = concat(
207261
local.required_tracecat_base_secrets,
208-
local.temporal_api_key_secret
262+
local.temporal_api_key_secret,
263+
local.temporal_payload_encryption_secret,
264+
local.temporal_visibility_hmac_secret,
265+
local.temporal_codec_server_shared_secret
209266
)
210267

211268
oauth_client_id_secret = var.oauth_client_id_arn != null ? [

‎deployments/fargate/modules/ecs/variables.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -286,6 +286,30 @@ variable "context_compression_threshold_kb" {
286286
default = 16
287287
}
288288

289+
variable "temporal_payload_encryption_enabled" {
290+
type = bool
291+
description = "Enable application-layer encryption for Temporal payloads"
292+
default = false
293+
}
294+
295+
variable "temporal_payload_encryption_key_version" {
296+
type = string
297+
description = "Current Temporal payload encryption key version"
298+
default = "1"
299+
}
300+
301+
variable "temporal_payload_encryption_cache_ttl_seconds" {
302+
type = number
303+
description = "In-memory cache TTL in seconds for resolved Temporal encryption keys"
304+
default = 3600
305+
}
306+
307+
variable "temporal_payload_encryption_cache_max_items" {
308+
type = number
309+
description = "Maximum number of cached Temporal encryption keys"
310+
default = 128
311+
}
312+
289313
### Secret ARNs
290314

291315
variable "tracecat_db_encryption_key_arn" {
@@ -303,6 +327,24 @@ variable "tracecat_signing_secret_arn" {
303327
description = "The ARN of the secret containing the Tracecat signing secret"
304328
}
305329

330+
variable "temporal_payload_encryption_key_arn" {
331+
type = string
332+
description = "The ARN of the secret containing the Temporal payload encryption root key"
333+
default = null
334+
}
335+
336+
variable "temporal_visibility_hmac_key_arn" {
337+
type = string
338+
description = "The ARN of the secret containing the Temporal visibility HMAC key"
339+
default = null
340+
}
341+
342+
variable "temporal_codec_server_shared_secret_arn" {
343+
type = string
344+
description = "The ARN of the secret containing the Temporal codec server shared secret"
345+
default = null
346+
}
347+
306348
variable "oauth_client_id_arn" {
307349
type = string
308350
description = "The ARN of the secret containing the OAuth client ID (optional)"

0 commit comments

Comments
 (0)