mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-26 00:01:37 +00:00
Alexander Petric
396fb1c475
* [ee] feat(otel-tracing-proxy): trust internal endpoints with untrusted CAs Add `insecure_upstream_hosts` and `upstream_ca_certs` to the HTTP Request Tracing settings so the OTEL tracing proxy can reach internal endpoints with untrusted or private-CA certificates while keeping them traced. Wires the two settings through the worker config and live reload, adds the inputs to the instance settings UI, and pulls in the rustls upstream-client deps (hyper-rustls/tokio-rustls/rustls/ rustls-native-certs/rustls-pemfile; hyper-http-proxy switched to its rustls feature). The proxy-side implementation lives in the companion EE PR. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump ee-repo-ref to otel_ca companion commit Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(otel-tracing-proxy): expose new fields in declarative config; bump ee-ref Addresses code-review findings: - Add `insecure_upstream_hosts` and `upstream_ca_certs` to the declarative `OtelTracingProxySettings` in instance_config.rs so operator/GitOps-managed installs can set them and reconciliation no longer drops values saved via the UI. - Restore the trailing newline on ee-repo-ref.txt and bump it to the companion EE commit carrying the strict host-matching / port-ordering fixes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: update ee-repo-ref to 51e50629f48dbc4f5520a787b4bdfb76f4cd38d3 This commit updates the EE repository reference after PR #665 was merged in windmill-ee-private. Previous ee-repo-ref: 49f458e4446395e98915c220baa757ab3b2ed2d8 New ee-repo-ref: 51e50629f48dbc4f5520a787b4bdfb76f4cd38d3 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
164 lines
6.5 KiB
TOML
164 lines
6.5 KiB
TOML
[package]
|
|
name = "windmill-worker"
|
|
version.workspace = true
|
|
authors.workspace = true
|
|
edition.workspace = true
|
|
|
|
[lib]
|
|
name = "windmill_worker"
|
|
path = "src/lib.rs"
|
|
|
|
[features]
|
|
default = []
|
|
private = ["windmill-worker-volumes/private", "windmill-queue/private", "windmill-common/private", "windmill-dep-map/private", "windmill-runtime-nativets?/private"]
|
|
mcp = ["windmill-ai/mcp", "dep:windmill-mcp"]
|
|
prometheus = ["dep:prometheus", "windmill-common/prometheus"]
|
|
enterprise = ["windmill-queue/enterprise", "windmill-git-sync/enterprise", "windmill-common/enterprise", "windmill-worker-volumes/enterprise", "windmill-runtime-nativets?/enterprise", "dep:pem", "dep:rsa", "dep:tokio-util", "dep:opentelemetry-proto", "dep:prost", "dep:hudsucker", "dep:rcgen", "dep:hyper-http-proxy", "dep:hyper-rustls", "dep:tokio-rustls", "dep:rustls", "dep:rustls-native-certs", "dep:rustls-pemfile", "dep:hyper-util"]
|
|
mssql = ["dep:tiberius"]
|
|
mssql-kerberos = ["mssql", "tiberius/integrated-auth-gssapi"] # Linux/Unix integrated auth
|
|
mssql-winauth = ["mssql", "tiberius/winauth"] # Windows integrated auth
|
|
bigquery = ["dep:gcp_auth"]
|
|
benchmark = ["windmill-queue/benchmark", "windmill-common/benchmark"]
|
|
parquet = ["windmill-common/parquet", "windmill-object-store/parquet"]
|
|
flow_testing = []
|
|
failpoints = []
|
|
cloud = []
|
|
sqlx = []
|
|
deno_core = ["dep:windmill-runtime-nativets"]
|
|
libffi_mac = ["dep:libffi-sys"]
|
|
otel = ["windmill-common/otel", "dep:opentelemetry", "dep:tracing-opentelemetry"]
|
|
dind = ["dep:bollard"]
|
|
php = ["dep:windmill-parser-php"]
|
|
mysql = ["dep:mysql_async"]
|
|
oracledb = ["dep:oracle"]
|
|
python = ["dep:windmill-parser-py", "dep:windmill-parser-py-imports", "windmill-dep-map/python"]
|
|
csharp = ["dep:windmill-parser-csharp"]
|
|
rust = ["dep:windmill-parser-rust"]
|
|
nu = ["dep:windmill-parser-nu"]
|
|
java = ["dep:windmill-parser-java"]
|
|
ruby = ["dep:windmill-parser-ruby"]
|
|
rlang = ["dep:windmill-parser-r"]
|
|
duckdb = ["dep:libloading"]
|
|
quickjs = ["windmill-jseval/quickjs", "windmill-queue/quickjs"]
|
|
bedrock = ["windmill-ai/bedrock"]
|
|
|
|
[dependencies]
|
|
windmill-ai = { workspace = true, default-features = false }
|
|
windmill-queue.workspace = true
|
|
windmill-dep-map.workspace = true
|
|
windmill-audit.workspace = true # there isn't really a reason for audit-worth actions to happen in the worker.
|
|
windmill-common = { workspace = true, default-features = false }
|
|
windmill-types.workspace = true
|
|
windmill-object-store.workspace = true
|
|
windmill-worker-volumes.workspace = true
|
|
windmill-jseval.workspace = true
|
|
windmill-runtime-nativets = { workspace = true, optional = true }
|
|
windmill-mcp = { workspace = true, optional = true }
|
|
windmill-macros.workspace = true
|
|
windmill-parser.workspace = true
|
|
windmill-parser-ts.workspace = true
|
|
windmill-parser-go.workspace = true
|
|
windmill-parser-rust = { workspace = true, optional = true }
|
|
windmill-parser-csharp = { workspace = true, optional = true }
|
|
windmill-parser-nu = { workspace = true, optional = true }
|
|
windmill-parser-java = { workspace = true, optional = true }
|
|
windmill-parser-ruby = { workspace = true, optional = true }
|
|
windmill-parser-r = { workspace = true, optional = true }
|
|
windmill-parser-py = { workspace = true, optional = true }
|
|
windmill-parser-yaml.workspace = true
|
|
windmill-parser-py-imports = { workspace = true, optional = true }
|
|
windmill-parser-bash.workspace = true
|
|
windmill-parser-sql.workspace = true
|
|
windmill-parser-graphql.workspace = true
|
|
windmill-parser-php = { workspace = true, optional = true }
|
|
windmill-git-sync.workspace = true
|
|
flume.workspace = true
|
|
sqlx.workspace = true
|
|
uuid.workspace = true
|
|
ulid.workspace = true
|
|
tracing.workspace = true
|
|
tokio.workspace = true
|
|
tokio-stream.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
futures.workspace = true
|
|
async-recursion.workspace = true
|
|
async-trait.workspace = true
|
|
anyhow.workspace = true
|
|
derive_more.workspace = true
|
|
itertools.workspace = true
|
|
regex.workspace = true
|
|
prometheus = { workspace = true, optional = true }
|
|
lazy_static.workspace = true
|
|
quick_cache.workspace = true
|
|
chrono.workspace = true
|
|
dotenv.workspace = true
|
|
rand.workspace = true # TODO: Remove. only used by token creation hack.
|
|
const_format.workspace = true
|
|
mappable-rc.workspace = true
|
|
git-version.workspace = true
|
|
once_cell.workspace = true
|
|
tokio-postgres.workspace = true
|
|
bit-vec.workspace = true
|
|
url.workspace = true
|
|
async-stream.workspace = true
|
|
|
|
postgres-native-tls.workspace = true
|
|
native-tls.workspace = true
|
|
mysql_async = { workspace = true, optional = true }
|
|
base64.workspace = true
|
|
gcp_auth = { workspace = true, optional = true }
|
|
rust_decimal.workspace = true
|
|
jsonwebtoken.workspace = true
|
|
sha2.workspace = true
|
|
hmac.workspace = true
|
|
pem = { workspace = true, optional = true }
|
|
rsa = { workspace = true, optional = true }
|
|
urlencoding.workspace = true
|
|
# `fs` adds flock(2) for the cross-process Python install lock (shared cache mounts);
|
|
# `user` adds geteuid(2) to verify ownership of the ansible socket-dir root
|
|
nix = { workspace = true, features = ["fs", "user"] }
|
|
bytes.workspace = true
|
|
reqwest.workspace = true
|
|
reqwest-middleware.workspace = true
|
|
eventsource-stream.workspace = true
|
|
mime_guess.workspace = true
|
|
hex.workspace = true
|
|
tiberius = { workspace = true, optional = true }
|
|
tokio-util = { workspace = true, optional = true }
|
|
tar.workspace = true
|
|
convert_case.workspace = true
|
|
yaml-rust.workspace = true
|
|
backon.workspace = true
|
|
pep440_rs.workspace = true
|
|
process-wrap.workspace = true
|
|
async-once-cell.workspace = true
|
|
libloading = { workspace = true, optional = true }
|
|
|
|
opentelemetry-proto = { workspace = true, optional = true }
|
|
opentelemetry = { workspace = true, optional = true }
|
|
tracing-opentelemetry = { workspace = true, optional = true }
|
|
prost = { workspace = true, optional = true }
|
|
axum.workspace = true
|
|
bollard = { workspace = true, optional = true }
|
|
oracle = { workspace = true, optional = true }
|
|
hudsucker = { workspace = true, optional = true }
|
|
hyper-http-proxy = { workspace = true, optional = true }
|
|
hyper-rustls = { workspace = true, optional = true }
|
|
tokio-rustls = { workspace = true, optional = true }
|
|
rustls = { workspace = true, optional = true }
|
|
rustls-native-certs = { workspace = true, optional = true }
|
|
rustls-pemfile = { workspace = true, optional = true }
|
|
hyper-util = { workspace = true, optional = true }
|
|
rcgen = { workspace = true, optional = true }
|
|
|
|
[target.'cfg(windows)'.dependencies]
|
|
windows = { version = "0.61", features = ["Win32_System_JobObjects", "Win32_System_Threading", "Win32_System_Diagnostics_ToolHelp"] }
|
|
|
|
[dev-dependencies]
|
|
tempfile.workspace = true
|
|
x509-parser.workspace = true
|
|
|
|
[build-dependencies]
|
|
libffi-sys = { workspace = true, optional = true }
|