From 0f3c0e46fd1a52407de53fc23a7567a64ef26e1c Mon Sep 17 00:00:00 2001 From: Prashant Yadav Date: Fri, 3 Jul 2026 13:57:28 -0700 Subject: [PATCH] Add CentralizedWorkflowOwnerVerificationEnabled CRE gate setting. Introduce a global gate limiter so workflow syncer nodes can opt into centralized workflow owner/org verification during rollout. Co-authored-by: Cursor --- pkg/settings/cresettings/README.md | 1 + pkg/settings/cresettings/defaults.json | 1 + pkg/settings/cresettings/defaults.toml | 1 + pkg/settings/cresettings/settings.go | 2 ++ 4 files changed, 5 insertions(+) diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index f3e5e3cadf..a1a7194b82 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -60,6 +60,7 @@ flowchart %% PerOrg.ZeroBalancePruningTimeout subgraph Store.FetchWorkflowArtifacts + CentralizedWorkflowOwnerVerificationEnabled[/CentralizedWorkflowOwnerVerificationEnabled\]:::gate PerWorkflow.WASMConfigSizeLimit{{PerWorkflow.WASMConfigSizeLimit}}:::bound PerWorkflow.WASMBinarySizeLimit{{PerWorkflow.WASMBinarySizeLimit}}:::bound PerWorkflow.WASMSecretsSizeLimit{{PerWorkflow.WASMSecretsSizeLimit}}:::bound diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index 77f1128f8e..795f8bc776 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -4,6 +4,7 @@ "GatewayIncomingPayloadSizeLimit": "1mb", "GatewayVaultManagementEnabled": "true", "VaultJWTAuthEnabled": "false", + "CentralizedWorkflowOwnerVerificationEnabled": "false", "VaultOrgIdAsSecretOwnerEnabled": "false", "PropagateOrgIDInRequestMetadata": "false", "VaultBase64EncodingEnabled": "false", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index a7fb091944..f2a7cfe764 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -3,6 +3,7 @@ WorkflowExecutionConcurrencyLimit = '1000' GatewayIncomingPayloadSizeLimit = '1mb' GatewayVaultManagementEnabled = 'true' VaultJWTAuthEnabled = 'false' +CentralizedWorkflowOwnerVerificationEnabled = 'false' VaultOrgIdAsSecretOwnerEnabled = 'false' PropagateOrgIDInRequestMetadata = 'false' VaultBase64EncodingEnabled = 'false' diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index 7e201699d8..a83e7a76f0 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -57,6 +57,7 @@ var Default = Schema{ GatewayIncomingPayloadSizeLimit: Size(1 * config.MByte), GatewayVaultManagementEnabled: Bool(true), VaultJWTAuthEnabled: Bool(false), + CentralizedWorkflowOwnerVerificationEnabled: Bool(false), // Deprecated: retained for backwards compatibility; workflow owner identifies secret ownership. VaultOrgIdAsSecretOwnerEnabled: Bool(false), PropagateOrgIDInRequestMetadata: Bool(false), @@ -314,6 +315,7 @@ type Schema struct { GatewayIncomingPayloadSizeLimit Setting[config.Size] GatewayVaultManagementEnabled Setting[bool] VaultJWTAuthEnabled Setting[bool] + CentralizedWorkflowOwnerVerificationEnabled Setting[bool] VaultOrgIdAsSecretOwnerEnabled Setting[bool] // Deprecated PropagateOrgIDInRequestMetadata Setting[bool] VaultBase64EncodingEnabled Setting[bool]