[mzohaib-scale]

What

Add renewable Azure Workload Identity authentication to the ADK Temporal client.

Why

VULN-2040 Stage B requires public Temporal callers to authenticate before namespace-scoped authorization can be enabled. Agents built on the ADK connect to Temporal through this client.

How

TEMPORAL_AUTH_SCOPE opts in. Tokens are acquired and refreshed through Azure Identity. Initial or expired credentials fail closed, while a transient refresh failure keeps the current valid token and retries once after the retry delay. Authenticated in-cluster connections set tls=False so Istio remains the transport-security layer. Explicit TLS configuration and the scope-unset path are unchanged. The change is limited to hand-written code under src/agentex/lib/.

Verification

tests/lib/test_temporal_auth.py passes 9/9. Removing the plaintext TLS guard, or reverting the single-retry delay, makes the matching test fail.

Cluster impact

None until an agent is released with this ADK version and deployed with TEMPORAL_AUTH_SCOPE. Temporal authorization remains disabled.

Confidence Score: 5/5

The PR appears safe to merge; no new blocking issues were found.

Summary

Adds opt-in Azure Workload Identity authentication and token refresh for Temporal clients.

• Temporal clients can authenticate with renewable Azure tokens.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Connect to Temporal] --> B{TEMPORAL_AUTH_SCOPE set?}
  B -->|No| C[Keep existing connection options]
  B -->|Yes| D[Acquire Azure token]
  D -->|Missing or expired| E[Fail startup]
  D -->|Valid| F[Connect with token and preserve explicit TLS]
  F --> G[Refresh before expiry]
  G -->|Success| H[Replace client token]
  G -->|Failure| I[Keep token and retry after 30 seconds]
  H --> G
  I --> G

Loading

_{Reviews (2) · Last reviewed commit: "test(temporal): import TLSConfig from te..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​azure-identity@​1.27.0

View full report