docs(temporal-proxy): update for v0.5.0 - #5109
Merged
Merged
Conversation
v0.5.0 adds a service allowlist and turns the inbound auth extension point into an authorization one. Neither was covered here. The allowlist matters most for anyone upgrading, since the proxy forwards only WorkflowService and OperatorService by default. A deployment that relies on reflection has to opt in, and a service left out answers _Unimplemented_ rather than passing the call through. The gateway now publishes a health entry per allowed service, which is what makes a gRPC probe or the Go SDK's CheckHealth work, so the Kubernetes page has some probe guidance next to the drain budgets a probe has to fit inside.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📖 Docs PR preview links
|
Duncanma
approved these changes
Aug 14, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Temporal Proxy documentation for v0.5.0.
Changes:
- Documents service allowlisting and health checks.
- Adds Kubernetes probe and shutdown guidance.
- Documents external authorization extensions.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
index.mdx |
Summarizes allowlisting and health support. |
deploy-kubernetes.mdx |
Adds probe and shutdown guidance. |
configure.mdx |
Documents allowlists, health checks, and authorization. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+89
to
+90
| Those three are the whole set to select from. A name the proxy cannot forward fails the configuration at startup rather | ||
| than at the first request. |
Comment on lines
+195
to
+196
| decides before the request is routed, so nothing reaches an upstream until the caller is admitted, and it strips the | ||
| credential before forwarding upstream. |
| ```yaml | ||
| livenessProbe: | ||
| grpc: | ||
| port: 8443 # Must be numeric. Match service.port. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.5.0 adds a service allowlist and reframes the inbound auth extension point as an authorization point. Neither was covered here. The allowlist matters most for anyone upgrading, since the proxy forwards only WorkflowService and OperatorService by default. A deployment that relies on reflection has to opt in, and a service left out answers Unimplemented rather than passing the call through.
The gateway now publishes a health entry per allowed service, which is what makes a gRPC probe or the Go SDK's CheckHealth work. So the Kubernetes page has some probe guidance next to the drain budgets a probe has to fit within.
┆Attachments: EDU-6954 docs(temporal-proxy): update for v0.5.0