Temporal Proxy
A temporal proxy routes traffic between worker processes and your workflow cluster. You set it up by placing a network forwarder in front of frontend services. Engineering teams often use this setup to manage network routes across private clouds. Still, broad network rules and shared client keys often give workers too much trust. When one worker role has full reach, any bad task can hit every namespace. How a temporal proxy works in your cluster Workflow clusters rely on frontend services to
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
A temporal proxy routes traffic between worker processes and your workflow cluster. You set it up by placing a network forwarder in front of frontend services. Engineering teams often use this setup to manage network routes across private clouds. Still, broad network rules and shared client keys often give workers too much trust. When one worker role has full reach, any bad task can hit every namespace.
How a temporal proxy works in your cluster
Workflow clusters rely on frontend services to take in task requests from workers. Workers poll these frontend services over gRPC to get new jobs and send results. When teams run workers in separate networks, direct routing becomes hard to manage. Teams add a temporal proxy to forward gRPC calls across network borders. This node sits between external worker apps and the internal cluster frontend.
To secure this path, admins set up mutual TLS on the network forwarder. Each worker app gets a client cert to prove its identity during the handshake. The forwarder checks the cert before it sends the traffic to the cluster. Inside the cluster, an authorizer plugin reads claims from the caller identity. It checks if the caller has a role for the target namespace.
Admins usually define three basic role levels for each namespace in the system. A reader role lets a user view workflow history and check task states. A writer role lets a worker start workflows, send signals, and poll task queues. An admin role allows full control to change namespace settings and delete histories. The cluster checks these roles on every gRPC call that arrives from workers.
What native network routing solves and where it stops
Native network forwarding and mutual TLS solve basic network reachability and service identity. They ensure that only known worker apps can open a socket to the cluster. Namespace roles also stop a team from writing to another team's workflow queue. This setup works well for service-to-service traffic that never changes its behavior.
Still, this setup only decides who can open a session with the namespace. It does not inspect what individual commands or payloads do while in flight. Once a human engineer or tool holds a writer cert, they have broad power. They can terminate running workflows, send bad signals, or read all payload data.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Workflow payloads often carry raw user data like emails, phone numbers, and card numbers. Native namespace roles do not rewrite or mask these fields when engineers query histories. Anyone with read permissions gets the full payload text in their client output. Also, shared client certs make it hard to tie actions to one person. Teams need a way to inspect each request and protect data in flight.
Managing worker certs and human sessions at scale
As more teams build workflows, managing certs for every user becomes a heavy chore. Platform teams must issue, rotate, and revoke certs whenever people change roles. If a cert leaks on a laptop, an attacker gains full namespace permissions. Revoking that cert often requires updating files across many servers and restarting services.
Human engineers also need occasional write rights to fix stuck workflows during an outage. Giving them permanent writer roles breaks the rule of least privilege every day. Teams end up choosing between slow manual ticket approvals and risky standing permissions. Splitting machine traffic from human debug sessions helps teams keep tight control over production.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Why do teams put a forwarder in front of workflow clusters?
Teams use a forwarder to route gRPC traffic across separate cloud networks safely. It also terminates TLS connections and balances load across multiple frontend nodes.
Can native namespace roles hide sensitive fields inside workflow payloads?
No, native roles only allow or block access to the entire namespace API. Client-side encryption or in-flight data masking is needed to rewrite emails or card numbers.
How do workers talk to the workflow frontend service?
Workers use gRPC over HTTP/2 to poll task queues and report workflow steps. Any network node on that path must support long-lived HTTP/2 connections without dropping them.