### Install Temporal Helm Chart with MySQL Source: https://github.com/temporalio/helm-charts/blob/main/README.md Install the Temporal Helm chart using a custom values file configured for MySQL database connectivity. ```bash helm install --repo https://go.temporal.io/helm-charts -f mysql.values.yaml temporal temporal --timeout 900s ``` -------------------------------- ### Install Temporal with Cassandra Persistence Source: https://context7.com/temporalio/helm-charts/llms.txt Installs the Temporal Helm chart with Cassandra configured as the default persistence store. Ensure the necessary secrets are pre-created. ```bash helm install temporal \ --repo https://go.temporal.io/helm-charts \ -f values.cassandra.yaml \ temporal \ --timeout 900s ``` -------------------------------- ### Helm Install Command with Persistence Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Demonstrates the command to install the Temporal Helm chart, specifying a custom values file for persistence configuration and targeting release candidate versions. ```bash # 1. Set up your databases first # 2. Create a values file with persistence configuration # 3. Install with version specified to allow release candidates helm install --repo https://go.temporal.io/helm-charts \ --version '>=1.0.0-0' \ -f my-persistence-values.yaml \ temporal temporal \ --timeout 900s ``` -------------------------------- ### Install Temporal with Cloud SQL Proxy Configuration Source: https://context7.com/temporalio/helm-charts/llms.txt Install the Temporal Helm chart using a custom values file that includes Cloud SQL Proxy configuration. ```bash helm install temporal \ --repo https://go.temporal.io/helm-charts \ -f values.cloudsqlproxy.yaml \ temporal \ --timeout 900s ``` -------------------------------- ### Install Temporal with Elasticsearch Visibility Source: https://context7.com/temporalio/helm-charts/llms.txt Installs the Temporal Helm chart with Elasticsearch configured as the visibility store. Ensure all necessary secrets are pre-created. ```bash helm install temporal \ --repo https://go.temporal.io/helm-charts \ -f values.elasticsearch.yaml \ temporal \ --timeout 900s ``` -------------------------------- ### Configure Server Readiness Probes Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Example of configuring readiness probes for server pods, including specific gRPC settings for the frontend readiness probe. ```yaml server: readinessProbe: {} frontend: readinessProbe: grpc: port: 7233 service: temporal.api.workflowservice.v1.WorkflowService ``` -------------------------------- ### Install Temporal with PostgreSQL Persistence Source: https://context7.com/temporalio/helm-charts/llms.txt Installs the Temporal Helm chart using a PostgreSQL database for persistence. Ensure the 'temporal-db-secret' is pre-created with the correct password. ```bash kubectl create secret generic temporal-db-secret \ --from-literal=password=my_pg_password helm install temporal \ --repo https://go.temporal.io/helm-charts \ -f values.postgresql.yaml \ temporal \ --timeout 900s ``` -------------------------------- ### Install Temporal Helm Chart Source: https://context7.com/temporalio/helm-charts/llms.txt Installs or upgrades the Temporal Helm chart from the official repository. Requires a custom values file for persistence configuration. Use `--version` for release candidates. ```bash helm repo add temporal https://go.temporal.io/helm-charts helm repo update helm install temporal \ --repo https://go.temporal.io/helm-charts \ -f my-values.yaml \ temporal \ --timeout 900s helm upgrade temporal \ --repo https://go.temporal.io/helm-charts \ -f my-values.yaml \ temporal \ --timeout 900s helm install temporal \ --repo https://go.temporal.io/helm-charts \ --version '>=1.0.0-0' \ -f my-values.yaml \ temporal \ --timeout 900s ``` -------------------------------- ### Install Temporal with PostgreSQL Source: https://github.com/temporalio/helm-charts/blob/main/README.md Configure persistence for PostgreSQL and install the Temporal Helm chart. Ensure to update the values file with your database connection details and secret references. ```yaml server: config: persistence: datastores: default: sql: createDatabase: true manageSchema: true pluginName: postgres12 driverName: postgres12 databaseName: temporal connectAddr: "postgres.example.com:5432" connectProtocol: tcp user: temporal_user existingSecret: temporal-db-secret secretKey: password visibility: sql: createDatabase: true manageSchema: true pluginName: postgres12 driverName: postgres12 databaseName: temporal_visibility connectAddr: "postgres.example.com:5432" connectProtocol: tcp user: temporal_user existingSecret: temporal-db-secret secretKey: password ``` ```bash helm install --repo https://go.temporal.io/helm-charts -f postgresql.values.yaml temporal temporal --timeout 900s ``` -------------------------------- ### Configure Server Deployment Strategy Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Example of configuring a custom RollingUpdate deployment strategy for server services. ```yaml server: deploymentStrategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 ``` -------------------------------- ### Configure SQL Persistence Stores Source: https://github.com/temporalio/helm-charts/blob/main/README.md Example configuration for SQL persistence stores (default and visibility). It shows how to set database connection details, manage schema creation, and handle credentials using existing secrets. ```yaml server: config: persistence: defaultStore: default visibilityStore: visibility numHistoryShards: 512 datastores: default: sql: createDatabase: true manageSchema: true pluginName: mysql8 # or postgres12, postgres12_pgx driverName: mysql8 databaseName: temporal connectAddr: "mysql.example.com:3306" connectProtocol: tcp user: temporal_user # Option 1: Provide password in values (chart will create a secret) password: your_password # Option 2: Use an existing secret (recommended for production) # existingSecret: temporal-db-secret # secretKey: password maxConns: 20 maxIdleConns: 20 maxConnLifetime: "1h" default: sql: createDatabase: true manageSchema: true pluginName: mysql8 driverName: mysql8 databaseName: temporal connectAddr: "mysql.example.com:3306" connectProtocol: tcp user: temporal_user # Option 1: Provide password in values (chart will create a secret) password: your_password # Option 2: Use an existing secret (recommended for production) # existingSecret: temporal-db-secret # secretKey: password maxConns: 20 maxIdleConns: 20 maxConnLifetime: "1h" visibility: sql: createDatabase: true manageSchema: true pluginName: mysql8 driverName: mysql8 databaseName: temporal_visibility connectAddr: "mysql.example.com:3306" connectProtocol: tcp user: temporal_user # Use existing secret (recommended for production) existingSecret: temporal-db-secret secretKey: password ``` -------------------------------- ### Install Temporal with Dynamic Config Source: https://github.com/temporalio/helm-charts/blob/main/README.md Install a Temporal cluster using Helm, overriding default configurations with a custom YAML file. Use 'helm upgrade' to apply changes to an existing cluster. ```bash helm install --repo https://go.temporal.io/helm-charts -f values/values.dynamic_config.yaml temporal temporal --timeout 900s ``` ```bash helm upgrade --repo https://go.temporal.io/helm-charts -f values/values.dynamic_config.yaml temporal temporal --timeout 900s ``` -------------------------------- ### Install Temporal with S3 Archival Source: https://context7.com/temporalio/helm-charts/llms.txt Install Temporal using Helm charts with S3 archival enabled. Specify the chart repository, values file, and release name. ```bash helm install temporal \ --repo https://go.temporal.io/helm-charts \ -f values.archival.s3.yaml \ temporal \ --timeout 900s ``` -------------------------------- ### Temporal Persistence Configuration Example Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Illustrates the new structure for persistence configuration in v1.0.0-rc.2, using SQL databases like MySQL. Note the use of `server.config.persistence.datastores` and Helm-specific fields like `existingSecret`. ```yaml server: config: persistence: defaultStore: default visibilityStore: visibility numHistoryShards: 512 datastores: default: sql: createDatabase: false manageSchema: false pluginName: mysql8 driverName: mysql8 databaseName: temporal connectAddr: "mysql.example.com:3306" connectProtocol: tcp user: temporal_user existingSecret: temporal-db-secret secretKey: password visibility: sql: createDatabase: false manageSchema: false pluginName: mysql8 driverName: mysql8 databaseName: temporal_visibility connectAddr: "mysql.example.com:3306" connectProtocol: tcp user: temporal_user existingSecret: temporal-db-secret secretKey: password ``` -------------------------------- ### Admin Tools CLI Commands Source: https://context7.com/temporalio/helm-charts/llms.txt Examples of using the `temporal` CLI within the admin tools container for namespace management and port-forwarding for local access. ```bash # Shell into the admin tools container kubectl exec -it services/temporal-admintools -- /bin/bash # List namespaces temporal operator namespace list # Create a namespace temporal operator namespace create -n my-app --retention 7d # Describe a namespace temporal operator namespace describe -n my-app # Port-forward frontend for local SDK access kubectl port-forward services/temporal-frontend-headless 7233:7233 # Port-forward web UI for browser access kubectl port-forward services/temporal-web 8080:8080 # Then navigate to http://127.0.0.1:8080 ``` -------------------------------- ### List Kubernetes Services Source: https://github.com/temporalio/helm-charts/blob/main/README.md Use `kubectl get svc` to list all services in the Kubernetes cluster. This helps in identifying the different components of the Temporal deployment. ```bash $ kubectl get svc NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE ... temporal-admintools ClusterIP 172.20.237.59 22/TCP 15m temporal-frontend-headless ClusterIP None 7233/TCP,9090/TCP 15m temporal-history-headless ClusterIP None 7234/TCP,9090/TCP 15m temporal-matching-headless ClusterIP None 7235/TCP,9090/TCP 15m temporal-worker-headless ClusterIP None 7239/TCP,9090/TCP 15m ... ``` -------------------------------- ### Install Temporal with Elasticsearch for Visibility Source: https://github.com/temporalio/helm-charts/blob/main/README.md Configure a SQL datastore for the default persistence and Elasticsearch for visibility. Update the values file with your Elasticsearch cluster URL and credentials. ```yaml server: config: persistence: datastores: default: # Configure your default store (SQL or Cassandra) sql: createDatabase: true manageSchema: true pluginName: mysql8 driverName: mysql8 databaseName: temporal connectAddr: "mysql.example.com:3306" connectProtocol: tcp user: temporal_user existingSecret: temporal-db-secret secretKey: password visibility: elasticsearch: version: v7 url: scheme: http host: "elasticsearch.example.com:9200" username: "" # Option 1: Provide password in values (chart will create a secret) password: "" # Option 2: Use an existing secret (recommended for production) # existingSecret: temporal-es-secret # secretKey: password logLevel: error indices: visibility: temporal_visibility_v1 ``` ```bash helm install --repo https://go.temporal.io/helm-charts -f elasticsearch.values.yaml temporal temporal --timeout 900s ``` -------------------------------- ### Install Temporal with Cassandra Source: https://github.com/temporalio/helm-charts/blob/main/README.md Configure persistence for Cassandra for the default datastore and use SQL for visibility. Edit the values file with your Cassandra cluster details. Note that Cassandra cannot be used for visibility. ```yaml server: config: persistence: datastores: default: cassandra: createDatabase: true manageSchema: true hosts: "cassandra1.example.com,cassandra2.example.com" port: 9042 keyspace: temporal user: cassandra_user # Option 1: Provide password in values (chart will create a secret) password: your_password # Option 2: Use an existing secret (recommended for production) # existingSecret: temporal-cassandra-secret # secretKey: password replicationFactor: 3 visibility: # Use SQL or Elasticsearch for visibility sql: createDatabase: true manageSchema: true pluginName: mysql8 driverName: mysql8 databaseName: temporal_visibility connectAddr: "mysql.example.com:3306" connectProtocol: tcp user: temporal_user existingSecret: temporal-db-secret secretKey: password ``` ```bash helm install --repo https://go.temporal.io/helm-charts -f cassandra.values.yaml temporal temporal --timeout 900s ``` -------------------------------- ### Verify Temporal Deployment Source: https://github.com/temporalio/helm-charts/blob/main/charts/temporal/templates/NOTES.txt Run this command to check if the Temporal pods have started successfully in your Kubernetes cluster. It filters pods by the instance label associated with your Helm release. ```bash kubectl --namespace={{ .Release.Namespace }} get pods -l "app.kubernetes.io/instance={{ .Release.Name }}" ``` -------------------------------- ### Enable Archival with File Store Source: https://github.com/temporalio/helm-charts/blob/main/README.md Enable archival storage using the File Store provider by specifying the corresponding values file during Helm installation. Archival is enabled for all new namespaces by default when configured. ```bash helm install --repo https://go.temporal.io/helm-charts -f values/values.archival.filestore.yaml temporal temporal --timeout 900s ``` -------------------------------- ### Helm Values for MySQL Database Configuration Source: https://github.com/temporalio/helm-charts/blob/main/README.md Configure Temporal to use a MySQL database by specifying connection details and credentials in the Helm values file. This example shows both direct password provision and using an existing secret. ```yaml server: config: persistence: datastores: default: sql: createDatabase: true manageSchema: true pluginName: mysql8 driverName: mysql8 databaseName: temporal connectAddr: "mysql.example.com:3306" connectProtocol: tcp user: temporal_user # Option 1: Provide password in values (chart will create a secret) password: your_password # Option 2: Use an existing secret (recommended for production) # existingSecret: temporal-db-secret # secretKey: password visibility: sql: createDatabase: true manageSchema: true pluginName: mysql8 driverName: mysql8 databaseName: temporal_visibility connectAddr: "mysql.example.com:3306" connectProtocol: tcp user: temporal_user existingSecret: temporal-db-secret secretKey: password ``` -------------------------------- ### List Kubernetes Pods Source: https://github.com/temporalio/helm-charts/blob/main/README.md Use `kubectl get pods` to list all running pods in the Kubernetes cluster. This is useful for monitoring the health and status of Temporal components. ```bash $ kubectl get pods ... temporal-admintools-7b6c599855-8bk4x 1/1 Running 0 25m temporal-frontend-54d94fdcc4-bx89b 1/1 Running 2 25m temporal-history-86d8d7869-lzb6f 1/1 Running 2 25m temporal-matching-6c7d6d7489-kj5pj 1/1 Running 3 25m temporal-worker-769b996fd-qmvbw 1/1 Running 2 25m ... ``` -------------------------------- ### Configure Temporal Web UI Source: https://context7.com/temporalio/helm-charts/llms.txt Set up the Temporal Web UI deployment, including image details, service type, probes, ingress, and environment variables for customization. ```yaml web: enabled: true replicaCount: 1 image: repository: temporalio/ui tag: 2.49.1 pullPolicy: IfNotPresent service: type: ClusterIP port: 8080 readinessProbe: initialDelaySeconds: 10 httpGet: path: /healthz port: http ingress: enabled: true className: nginx hosts: - "temporal-ui.example.com" tls: - secretName: temporal-ui-tls hosts: - temporal-ui.example.com # Configure via environment variables # https://docs.temporal.io/references/web-ui-environment-variables additionalEnv: - name: TEMPORAL_UI_PUBLIC_PATH value: /temporal # SSO example # additionalEnv: # - name: TEMPORAL_AUTH_ENABLED # value: "true" # - name: TEMPORAL_AUTH_PROVIDER_URL # value: "https://accounts.google.com" # - name: TEMPORAL_AUTH_CLIENT_ID # value: "xxxxx-xxxx.apps.googleusercontent.com" # - name: TEMPORAL_AUTH_CALLBACK_URL # value: "https://temporal-ui.example.com/auth/sso/callback" # additionalEnvSecretName: temporal-ui-oauth-secret podDisruptionBudget: minAvailable: 1 ``` -------------------------------- ### Kubernetes Secret for Database Credentials Source: https://github.com/temporalio/helm-charts/blob/main/README.md Define a Kubernetes Secret to store database credentials. This secret should be created in the same namespace as your Temporal release before installation. ```yaml apiVersion: v1 kind: Secret metadata: name: temporal-db-secret type: Opaque data: password: ``` -------------------------------- ### Migrate Persistence Configuration: Old vs. New Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Illustrates the transformation of persistence configuration from an older, hypothetical format to the new structure under `server.config.persistence.datastores`. This includes details for Cassandra and Elasticsearch datastores. ```yaml cassandra: config: cluster_size: 3 keyspace: temporal elasticsearch: enabled: true replicas: 3 server: config: persistence: default: cassandra: hosts: cassandra keyspace: temporal visibility: elasticsearch: url: elasticsearch:9200 ``` ```yaml server: config: persistence: defaultStore: default visibilityStore: visibility numHistoryShards: 512 datastores: default: cassandra: hosts: "cassandra.example.com:9042" port: 9042 keyspace: temporal user: cassandra_user existingSecret: temporal-cassandra-secret secretKey: password replicationFactor: 3 visibility: elasticsearch: version: v7 url: scheme: http host: "elasticsearch.example.com:9042" username: "" password: "" existingSecret: temporal-es-secret secretKey: password logLevel: error indices: visibility: temporal_visibility_v1 ``` -------------------------------- ### Import Grafana Dashboards Source: https://context7.com/temporalio/helm-charts/llms.txt Download URLs for Grafana dashboards to visualize Temporal metrics, including server, SDK, and frontend-specific dashboards. ```bash # Grafana dashboards to import # Server-General: curl -O https://raw.githubusercontent.com/temporalio/dashboards/helm/server/server-general.json # SDK-General: curl -O https://raw.githubusercontent.com/temporalio/dashboards/helm/sdk/sdk-general.json # Frontend-specific: curl -O https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/frontend-service-specific.json ``` -------------------------------- ### ExternalSecret Operator Configuration Source: https://github.com/temporalio/helm-charts/blob/main/README.md Inject an ExternalSecret Kubernetes manifest using `extraObjects` to manage database credentials externally. This example uses AWS Secrets Manager. ```yaml extraObjects: - | apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: {{ .Release.Name }}-db-secret spec: secretStoreRef: name: aws-secretsmanager kind: SecretStore target: name: {{ .Release.Name }}-db-secret creationPolicy: Owner data: - secretKey: password remoteRef: key: prod/temporal/db property: password ``` -------------------------------- ### Configure Server Min Ready Seconds Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Set the minimum seconds a pod must be ready before being considered available for server deployments. ```yaml server: minReadySeconds: 30 ``` -------------------------------- ### Describe Created Temporal Namespace Source: https://github.com/temporalio/helm-charts/blob/main/README.md After creating a namespace, use `temporal operator namespace -n describe` to view its configuration and status. This confirms the namespace was successfully registered. ```bash bash-5.0# temporal operator namespace -n nonesuch describe NamespaceInfo.Name nonesuch NamespaceInfo.Id ab41501e-ee33-40d8-8b67-bf247e0bc0d2 NamespaceInfo.Description NamespaceInfo.OwnerEmail NamespaceInfo.State Registered NamespaceInfo.Data map[] Config.WorkflowExecutionRetentionTtl 72h0m0s ReplicationConfig.ActiveClusterName active ReplicationConfig.Clusters [{"clusterName":"active"}] ReplicationConfig.State Normal Config.HistoryArchivalState Disabled Config.VisibilityArchivalState Disabled IsGlobalNamespace false FailoverVersion 0 FailoverHistory [] Config.HistoryArchivalUri Config.VisibilityArchivalUri Config.CustomSearchAttributeAliases map[] ``` -------------------------------- ### Port Forward Temporal Frontend Source: https://github.com/temporalio/helm-charts/blob/main/README.md Expose the Temporal frontend port on your local machine for access from applications or samples. Ensure the service name 'temporal-frontend-headless' is correct for your deployment. ```bash $ kubectl port-forward services/temporal-frontend-headless 7233:7233 Forwarding from 127.0.0.1:7233 -> 7233 Forwarding from [::1]:7233 -> 7233 ``` -------------------------------- ### Configure Prometheus Metrics Source: https://context7.com/temporalio/helm-charts/llms.txt Enable Prometheus scrape annotations on server pods or deploy a `ServiceMonitor` for the Prometheus Operator. Includes configuration for metric tags and Prometheus listener. ```yaml server: metrics: annotations: enabled: true # adds prometheus.io/* annotations to all server pods serviceMonitor: enabled: true # requires prometheus-operator CRDs interval: 30s additionalLabels: release: prometheus metricRelabelings: - action: replace sourceLabels: - exported_namespace targetLabel: temporal_namespace config: metrics: tags: environment: production cluster: us-east-1 prometheus: timerType: histogram listenAddress: "0.0.0.0:9090" ``` -------------------------------- ### Configure Per-Service Settings for Temporal Server Source: https://context7.com/temporalio/helm-charts/llms.txt Configure individual Temporal services (frontend, history, matching, worker, internal-frontend) independently. All services inherit global server defaults and can override them. ```yaml server: replicaCount: 1 # global default for all services image: repository: temporalio/server tag: 1.31.0 pullPolicy: IfNotPresent config: logLevel: "info" # one of: debug,info / info / warn / error securityContext: fsGroup: 1000 runAsUser: 1000 frontend: replicaCount: 2 # override global default service: type: ClusterIP port: 7233 # gRPC httpPort: 7243 # HTTP/2 (Connect protocol) membershipPort: 6933 readinessProbe: grpc: port: 7233 service: temporal.api.workflowservice.v1.WorkflowService resources: requests: cpu: 200m memory: 512Mi podDisruptionBudget: minAvailable: 1 deploymentStrategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 topologySpreadConstraints: - maxSkew: 1 topologyKey: kubernetes.io/hostname whenUnsatisfiable: DoNotSchedule labelSelector: matchLabels: app.kubernetes.io/component: frontend history: service: port: 7234 membershipPort: 6934 resources: requests: cpu: 100m memory: 512Mi matching: service: port: 7235 membershipPort: 6935 worker: service: port: 7239 membershipPort: 6939 # Internal frontend (optional; for multi-cluster / worker-only namespaces) internal-frontend: enabled: false service: port: 7236 httpPort: 7246 membershipPort: 6936 ``` -------------------------------- ### Configure Cloud SQL Proxy Sidecar Source: https://context7.com/temporalio/helm-charts/llms.txt Inject an init container running the Cloud SQL Proxy to securely access GCP managed databases. Ensure the secret containing the service account key is correctly mounted. ```yaml # values.cloudsqlproxy.yaml admintools: additionalInitContainers: - name: cloud-sql-proxy image: gcr.io/cloudsql-docker/gce-proxy:1.17 command: - "/cloud_sql_proxy" - "-ip_address_types=PRIVATE" - "-instances=my-project:us-central1:my-instance=tcp:5432" - "-credential_file=/etc/google-cloud-key/key.json" restartPolicy: Always securityContext: runAsNonRoot: true volumeMounts: - name: google-cloud-key mountPath: /etc/google-cloud-key readOnly: true additionalVolumes: - name: google-cloud-key secret: secretName: cloud-sql-proxy-sa server: additionalInitContainers: - name: cloud-sql-proxy image: gcr.io/cloudsql-docker/gce-proxy:1.17 command: - "/cloud_sql_proxy" - "-ip_address_types=PRIVATE" - "-instances=my-project:us-central1:my-instance=tcp:5432" - "-credential_file=/etc/google-cloud-key/key.json" restartPolicy: Always securityContext: runAsNonRoot: true volumeMounts: - name: google-cloud-key mountPath: /etc/google-cloud-key readOnly: true additionalVolumes: - name: google-cloud-key secret: secretName: cloud-sql-proxy-sa ``` -------------------------------- ### Configure Admin Tools Deployment Source: https://context7.com/temporalio/helm-charts/llms.txt Deploy the Temporal admin tools container, specifying image, service port, resource requests, and environment variables for CLI access. ```yaml admintools: enabled: true image: repository: temporalio/admin-tools tag: "1.31.0" pullPolicy: IfNotPresent service: type: ClusterIP port: 22 resources: requests: cpu: 50m memory: 128Mi additionalEnv: - name: TEMPORAL_ADDRESS value: "temporal-frontend:7233" ``` -------------------------------- ### Enable Frontend Ingress Source: https://context7.com/temporalio/helm-charts/llms.txt Configure Kubernetes Ingress to expose the Temporal frontend gRPC service externally. Supports multiple Ingress API versions. ```yaml server: frontend: ingress: enabled: true className: nginx annotations: nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/backend-protocol: "GRPC" hosts: - "temporal.example.com" tls: - secretName: temporal-frontend-tls hosts: - temporal.example.com ``` -------------------------------- ### Configure High Availability Settings for Temporal Services Source: https://context7.com/temporalio/helm-charts/llms.txt Configure Pod Disruption Budgets, resource requests/limits, and affinity rules for production deployments. Per-service settings override global defaults. ```yaml server: frontend: replicaCount: 3 resources: requests: cpu: 200m memory: 512Mi limits: cpu: 1000m memory: 1Gi podDisruptionBudget: minAvailable: 2 affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - frontend topologyKey: kubernetes.io/hostname history: replicaCount: 3 resources: requests: cpu: 200m memory: 512Mi podDisruptionBudget: minAvailable: 2 matching: replicaCount: 3 podDisruptionBudget: minAvailable: 2 worker: replicaCount: 2 podDisruptionBudget: minAvailable: 1 minReadySeconds: 30 terminationGracePeriodSeconds: 60 ``` -------------------------------- ### Apply Dynamic Config ConfigMap Source: https://github.com/temporalio/helm-charts/blob/main/README.md Apply a dynamic configuration to your Temporal cluster by creating a ConfigMap. This method ensures changes are automatically picked up by pods without manual pod restarts. ```bash kubectl apply -f dynamicconfigmap.yaml ``` -------------------------------- ### Enable File Store Archival for Development Source: https://context7.com/temporalio/helm-charts/llms.txt Enable local file-based archival for development and testing. Configure state, read enablement, and file store provider details including directory and file modes. ```yaml # values.archival.filestore.yaml server: archival: history: state: "enabled" enableRead: true provider: filestore: fileMode: "0666" dirMode: "0766" visibility: state: "enabled" enableRead: true provider: filestore: fileMode: "0666" dirMode: "0766" namespaceDefaults: archival: history: state: "enabled" URI: "file:///tmp/temporal_archival/development" visibility: state: "enabled" URI: "file:///tmp/temporal_vis_archival/development" ``` -------------------------------- ### Port Forward Temporal Web UI Source: https://github.com/temporalio/helm-charts/blob/main/README.md Access the Temporal Web UI by forwarding your local machine's port to the Web service. Navigate to http://127.0.0.1:8080 in your browser after execution. ```bash $ kubectl port-forward services/temporal-web 8080:8080 Forwarding from 127.0.0.1:8080 -> 8080 Forwarding from [::1]:8080 -> 8080 ``` -------------------------------- ### Set Environment Variables from ConfigMap Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Configure server, admintools, web, and server-job deployments to load additional environment variables from a specified ConfigMap. ```yaml server: additionalEnvConfigMapName: my-configmap admintools: additionalEnvConfigMapName: my-configmap ``` -------------------------------- ### Configure Temporal with Cassandra Default Store Source: https://context7.com/temporalio/helm-charts/llms.txt Configures Temporal to use an external Cassandra cluster for the default store. Cassandra cannot be used for the visibility store; use SQL or Elasticsearch instead. Ensure the 'temporal-cassandra-secret' is pre-created. ```yaml # values.cassandra.yaml server: config: persistence: defaultStore: default visibilityStore: visibility numHistoryShards: 512 datastores: default: cassandra: hosts: "cassandra.default.svc.cluster.local" # or "host1,host2" port: 9042 keyspace: temporal user: "cassandra_user" existingSecret: temporal-cassandra-secret secretKey: password replicationFactor: 3 consistency: default: consistency: "local_quorum" serialConsistency: "local_serial" visibility: sql: pluginName: mysql8 driverName: mysql8 databaseName: temporal_visibility connectAddr: "mysql.example.com:3306" connectProtocol: "tcp" user: temporal_user existingSecret: temporal-db-secret secretKey: password ``` -------------------------------- ### Configure Server Log Level Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Specify the log level for Temporal server components, accepting multiple levels separated by commas. ```yaml server: config: logLevel: "info,warn" ``` -------------------------------- ### List Temporal System Namespace Source: https://github.com/temporalio/helm-charts/blob/main/README.md Use the `temporal operator namespace list` command within the `temporal-admintools` container to view details of the Temporal system namespace. ```bash bash-5.0# temporal operator namespace list NamespaceInfo.Name temporal-system NamespaceInfo.Id 32049b68-7872-4094-8e63-d0dd59896a83 NamespaceInfo.Description Temporal internal system namespace NamespaceInfo.OwnerEmail temporal-core@temporal.io NamespaceInfo.State Registered NamespaceInfo.Data map[] Config.WorkflowExecutionRetentionTtl 168h0m0s ReplicationConfig.ActiveClusterName active ReplicationConfig.Clusters [{"clusterName":"active"}] ReplicationConfig.State Unspecified Config.HistoryArchivalState Disabled Config.VisibilityArchivalState Disabled IsGlobalNamespace false FailoverVersion 0 FailoverHistory [] Config.HistoryArchivalUri Config.VisibilityArchivalUri Config.CustomSearchAttributeAliases map[] ``` -------------------------------- ### Enable SSO in Temporal UI Source: https://github.com/temporalio/helm-charts/blob/main/README.md Configure these environment variables in `web.additionalEnv` to enable SSO for the Temporal UI. Ensure the `TEMPORAL_AUTH_CLIENT_SECRET` is set in `web.additionalEnvSecretName`. ```yaml - name: TEMPORAL_AUTH_ENABLED value: "true" - name: TEMPORAL_AUTH_PROVIDER_URL value: "https://accounts.google.com" - name: TEMPORAL_AUTH_CLIENT_ID value: "xxxxx-xxxx.apps.googleusercontent.com" - name: TEMPORAL_AUTH_CALLBACK_URL value: "https://xxxx.com:8080/auth/sso/callback" ``` ```yaml TEMPORAL_AUTH_CLIENT_SECRET: xxxxxxxxxxxxxxx ``` -------------------------------- ### Update internalFrontend Key Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Rename `server.internalFrontend` to `server.internal-frontend` in your values file to match the Temporal service name. ```yaml server: internal-frontend: enabled: true ``` -------------------------------- ### Enable Namespace Auto-Creation Source: https://context7.com/temporalio/helm-charts/llms.txt Configure automatic creation of Temporal namespaces after the schema Job completes, ensuring idempotency with `describe || create`. ```yaml server: config: namespaces: create: true namespace: - name: default retention: 3d - name: production retention: 30d - name: staging retention: 7d ``` -------------------------------- ### Configure TLS for Internode and Frontend Communication Source: https://context7.com/temporalio/helm-charts/llms.txt Secure internode and frontend gRPC communication with mutual TLS. Certificates must be mounted via `additionalVolumes` and `additionalVolumeMounts`. Configure server and client TLS settings for both internode and frontend. ```yaml server: config: tls: internode: server: certFile: /etc/temporal/certs/internode/tls.crt keyFile: /etc/temporal/certs/internode/tls.key requireClientAuth: true clientCaFiles: - /etc/temporal/certs/internode/ca.crt client: serverName: temporal-internode rootCaFiles: - /etc/temporal/certs/internode/ca.crt frontend: server: certFile: /etc/temporal/certs/frontend/tls.crt keyFile: /etc/temporal/certs/frontend/tls.key requireClientAuth: true clientCaFiles: - /etc/temporal/certs/frontend/ca.crt client: serverName: temporal-frontend rootCaFiles: - /etc/temporal/certs/frontend/ca.crt additionalVolumes: - name: temporal-certs secret: secretName: temporal-tls-certs additionalVolumeMounts: - name: temporal-certs mountPath: /etc/temporal/certs readOnly: true ``` -------------------------------- ### Apply Dynamic Configuration Changes Source: https://context7.com/temporalio/helm-charts/llms.txt Apply dynamic config changes without a full pod restart using Helm upgrade. Alternatively, generate the ConfigMap and apply it directly to avoid rolling restarts. ```bash # Apply dynamic config changes without full pod restart helm upgrade temporal \ --repo https://go.temporal.io/helm-charts \ -f values.dynamic_config.yaml \ temporal ``` ```bash # Or generate the ConfigMap and apply directly (avoids rolling restart) helm upgrade --dry-run temporal \ --repo https://go.temporal.io/helm-charts \ -f values.dynamic_config.yaml \ temporal \ | grep -A1000 'kind: ConfigMap' | grep -B1000 'dynamic-config' \ > dynamicconfigmap.yaml kubectl apply -f dynamicconfigmap.yaml ``` -------------------------------- ### Update Temporal Web UI Environment Variables Source: https://github.com/temporalio/helm-charts/blob/main/README.md Configure the Temporal Web UI by setting environment variables in the `values.yml` file under `web.additionalEnv`. This allows customization, such as serving the UI from a subpath. ```yaml web: additionalEnv: - name: TEMPORAL_UI_PUBLIC_PATH value: /custom-path ``` -------------------------------- ### Create Temporal Namespace Source: https://github.com/temporalio/helm-charts/blob/main/README.md Create a new Temporal namespace using `temporal operator namespace create -n `. This command registers a new namespace with the Temporal cluster. ```bash bash-5.0# temporal operator namespace create -n nonesuch Namespace nonesuch successfully registered. ``` -------------------------------- ### Configure PostgreSQL Persistence for Temporal Helm Chart Source: https://context7.com/temporalio/helm-charts/llms.txt Configures the Temporal Helm chart to use an external PostgreSQL 12 database for workflow and visibility stores. Requires referencing an existing secret for authentication. ```yaml # values.postgresql.yaml server: config: persistence: defaultStore: default visibilityStore: visibility numHistoryShards: 512 datastores: default: sql: pluginName: postgres12 # or postgres12_pgx databaseName: temporal connectAddr: "postgres.example.com:5432" connectProtocol: "tcp" user: temporal_user existingSecret: temporal-db-secret secretKey: password maxConns: 20 maxIdleConns: 20 maxConnLifetime: "1h" visibility: sql: pluginName: postgres12 databaseName: temporal_visibility connectAddr: "postgres.example.com:5432" connectProtocol: "tcp" user: temporal_user existingSecret: temporal-db-secret secretKey: password ``` -------------------------------- ### Describe Non-existent Temporal Namespace Source: https://github.com/temporalio/helm-charts/blob/main/README.md Attempting to describe a non-existent namespace with `temporal operator namespace -n nonesuch describe` will result in an error message indicating the namespace was not found. ```bash bash-5.0# temporal operator namespace -n nonesuch describe time=2025-12-03T13:49:04.285 level=ERROR msg="unable to describe namespace nonesuch: Namespace nonesuch is not found." ``` -------------------------------- ### Verify Resource Removal with kubectl Source: https://context7.com/temporalio/helm-charts/llms.txt Use this command to check if all Kubernetes resources associated with the 'temporal' application label have been removed. ```bash kubectl get all -l app.kubernetes.io/name=temporal ``` -------------------------------- ### Exec into Temporal Admin Tools Container Source: https://github.com/temporalio/helm-charts/blob/main/README.md Access the `temporal-admintools` container using `kubectl exec` to run Temporal CLI commands. This allows for direct interaction with the Temporal cluster. ```bash $ kubectl exec -it services/temporal-admintools /bin/bash bash-5.0# ``` -------------------------------- ### Configure Service Labels Source: https://github.com/temporalio/helm-charts/blob/main/UPGRADING.md Apply custom labels to server service pods, useful for Kubernetes service discovery or management. ```yaml server: frontend: serviceLabels: app.kubernetes.io/part-of: my-app ``` -------------------------------- ### Configure Temporal with Existing Secret for Credentials Source: https://context7.com/temporalio/helm-charts/llms.txt References a pre-existing Kubernetes Secret for database credentials, avoiding plaintext passwords in values. The chart injects the secret key as an environment variable for the Temporal server. ```yaml # Production pattern: both stores share one secret server: config: persistence: datastores: default: sql: pluginName: postgres12_pgx driverName: postgres12_pgx databaseName: temporal connectAddr: "postgres.example.com:5432" connectProtocol: tcp user: temporal_user existingSecret: temporal-db-secret # name of K8s Secret secretKey: password # key inside the Secret visibility: sql: pluginName: postgres12_pgx driverName: postgres12_pgx databaseName: temporal_visibility connectAddr: "postgres.example.com:5432" connectProtocol: tcp user: temporal_user existingSecret: temporal-db-secret secretKey: password ``` -------------------------------- ### Create Kubernetes Secret for Database Credentials Source: https://context7.com/temporalio/helm-charts/llms.txt Creates a Kubernetes Secret containing database credentials. This can be done directly via kubectl or using a YAML manifest for GitOps workflows. ```bash # Create the secret before helm install kubectl create secret generic temporal-db-secret \ --from-literal=password=my_super_secret_password # Or with a manifest (GitOps-friendly) kubectl apply -f - <