[mzohaib-scale]

What

Add renewable Azure Workload Identity authentication to Agentex Temporal clients.

Why

Lets Agentex Temporal clients authenticate with Azure Workload Identity.

How

TEMPORAL_AUTH_SCOPE opts in. Tokens are acquired and refreshed through Azure Identity. Initial or expired credentials fail closed, while a transient refresh failure retains the current valid token. Authenticated in-cluster connections set tls=False so Istio remains the transport-security layer. Explicit TLS configuration and the scope-unset path are unchanged.

Verification

The focused suite passes 8/8. Ruff and diff checks pass. Removing the plaintext TLS guard makes its regression test fail.

Cluster impact

None until an Agentex release is deployed with TEMPORAL_AUTH_SCOPE.

Confidence Score: 5/5

The PR appears safe to merge; the previous retry-timing issue is fixed and no new actionable issues were found.

Summary

Adds opt-in Azure Workload Identity authentication for Temporal clients.

• Agentex Temporal clients can authenticate with renewable Azure tokens.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Connect to Temporal] --> B{Auth scope set?}
  B -->|No| C[Use existing connection options]
  B -->|Yes| D[Acquire Azure token]
  D -->|Failed or expired| E[Close credential and fail]
  D -->|Valid| F[Connect with token and start refresh]
  F --> G[Wait until refresh]
  G --> H{Refresh succeeds?}
  H -->|Yes| I[Replace token and calculate next wait]
  I --> G
  H -->|No| J[Keep current token and wait 30 seconds]
  J --> H

Loading

_{Reviews (2) · Last reviewed commit: "fix(temporal): correct token refresh ret..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​azure-identity@​1.27.0

View full report