temporal

nameOverride: ""

fullnameOverride: ""

# Chart debug mode

# (eg. disable helm hook delete policy)

debug: false

imagePullSecrets: []

# Custom Service account management

serviceAccount:

# Whether to create service account or not

create: false

# Name of the service account.

# Uses `name` if set.

# If `create: true` defaults to temporal.fullname, otherwise uses the namespace's default serviceAccount.

name:

# extraAnnotations would let users add additional annotations

extraAnnotations:

additionalAnnotations: {}

additionalLabels: {}

# Array of extra K8s manifests to deploy

extraObjects: []

server:

enabled: true

image:

repository: cgr.dev/chainguard-private/temporal-server-fips

tag: 1.32.2-r0@sha256:e8a18a89ea5c7e26976d829f624c3eda2c0216d459b2519f9d079a3e9a4806f3

pullPolicy: IfNotPresent

# Global default settings (can be overridden per service)

# replicaCount: 1

# readinessProbe: {}

# A value replaces the built-in tcpSocket probe whole.

# livenessProbe: {}

metrics:

# Annotate pods and services directly with the following Prometheus annotations.

# prometheus.io/job

# prometheus.io/port

# prometheus.io/scheme

# prometheus.io/scrape

annotations:

enabled: true

# Enable Prometheus ServiceMonitor

# Use this if you installed the Prometheus Operator (https://github.com/coreos/prometheus-operator).

serviceMonitor:

enabled: false

interval: 30s

# Set additional lables to all the ServiceMonitor resources

additionalLabels: {}

# label1: value1

# label2: value2

# Set Prometheus metric_relabel_configs via ServiceMonitor

# Use metricRelabelings to adjust metric and label names as needed

metricRelabelings: []

# - action: replace

# sourceLabels:

# - exported_namespace

# targetLabel: temporal_namespace

# - action: replace

# regex: service_errors_(.+)

# replacement: ${1}

# sourceLabels:

# - __name__

# targetLabel: temporal_error_kind

# - action: replace

# regex: service_errors_.+

# replacement: temporal_service_errors

# sourceLabels:

# - __name__

# targetLabel: __name__

deploymentLabels: {}

deploymentAnnotations: {}

deploymentStrategy: {}

podAnnotations: {}

podLabels: {}

secretLabels: {}

secretAnnotations: {}

resources: {}

# We usually recommend not to specify default resources and to leave this as a conscious

# choice for the user. This also increases chances charts run on environments with little

# resources, such as Minikube. If you do want to specify resources, uncomment the following

# lines, adjust them as necessary, and remove the curly braces after 'resources:'.

# limits:

# cpu: 100m

# memory: 128Mi

# requests:

# cpu: 100m

# memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}

# Default scheduling values for all server services. Each service can override these below.

schedulerName: ""

runtimeClassName: ""

priorityClassName: ""

minReadySeconds: 0

terminationGracePeriodSeconds: null

additionalVolumes: []

additionalVolumeMounts: []

additionalEnv: []

additionalEnvSecretName: ""

additionalEnvConfigMapName: ""

# Wire TLS for the Temporal server without hand-writing volumes, mounts and

# config.tls. Point each section at an existing kubernetes.io/tls secret

# (tls.crt + tls.key, plus ca.crt for verification). The secret can come from

# cert-manager, external-secrets, or be created by hand; the chart does not

# create it. Enabling a section mounts the secret and generates the matching

# `server.config.tls` block. Anything you set under `server.config.tls` is

# deep-merged on top, so individual fields remain overridable.

tls:

internode:

enabled: false

# Existing secret with tls.crt, tls.key and ca.crt for internode traffic.

secretName: ""

# Where the secret is mounted in the server containers.

mountPath: /etc/temporal/tls/internode

# Require and verify client certificates on internode connections.

requireClientAuth: true

# DNS name clients expect in the server certificate (a SAN on the cert).

# Host verification is always on for internode, so this is required when

# internode.enabled is true.

serverName: ""

frontend:

enabled: false

secretName: ""

mountPath: /etc/temporal/tls/frontend

# Require and verify client certificates on frontend connections (mutual

# TLS). The chart's own CLI pods (admintools, namespace job, health check)

# and the Web UI present a client certificate automatically; the internal

# server components present the internode certificate, so enable

# server.tls.internode and issue every certificate from a CA the frontend

# trusts when turning this on.

requireClientAuth: false

# DNS name clients expect in the frontend certificate (a SAN on the cert).

# Required when frontend.enabled is true.

serverName: ""

# for sidecar containers, add containers here with restartPolicy: Always

additionalInitContainers: []

# publicClientHostPort: "temporal-frontend.example.svc:7233"

securityContext:

fsGroup: 1000

runAsUser: 1000

config:

logLevel: "debug,info"

# Define your TLS configuration here. See https://docs.temporal.io/references/configuration#tls

# for configuration options. For most setups prefer the `server.tls` stanza

# above, which mounts the certificates and generates this block for you; use

# this only for advanced fields or to override what `server.tls` generates.

# If you configure TLS here directly you must also use

# `server.additionalVolumeMounts` and `server.additionalVolumes` to mount the

# certificates to the paths you reference below.

# tls:

# internode:

# server:

# certFile: /path/to/internode/cert/file

# keyFile: /path/to/internode/key/file

# requireClientAuth: true

# clientCaFiles:

# - /path/to/internode/serverCa

# client:

# serverName: dnsSanInInternodeCertificate

# rootCaFiles:

# - /path/to/internode/serverCa

# frontend:

# server:

# certFile: /path/to/frontend/cert/file

# keyFile: /path/to/frontend/key/file

# requireClientAuth: true

# clientCaFiles:

# - /path/to/internode/serverCa

# - /path/to/sdkClientPool1/ca

# - /path/to/sdkClientPool2/ca

# client:

# serverName: dnsSanInFrontendCertificate

# rootCaFiles:

# - /path/to/frontend/serverCa

# Define your Authorizer and ClaimMapper configuration here. See https://docs.temporal.io/self-hosted-guide/security#authorization

# authorization:

# jwtKeyProvider:

# keySourceURIs:

# - http://localhost:/jwks.json

# refreshInterval: 1m

# permissionsClaimName: permissions

# authorizer: default

# claimMapper: default

persistence:

defaultStore: default

visibilityStore: visibility

# Important: numHistoryShards cannot be changed after the initial deployment.

numHistoryShards: 512

# Persistence configuration follows the raw Temporal server config format.

# Driver is determined by which top-level key is present (cassandra vs sql).

# For SQL stores, you can use either connectAddr: "host:port" or separate host/port fields.

# Helm-specific fields (existingSecret, secretKey, createDatabase, manageSchema, defaultDb) are stripped before rendering to server config.

datastores:

default:

# Example SQL configuration:

# sql:

# createDatabase: false

# manageSchema: false

# defaultDb: postgres # admin DB for create-database (--defaultdb); e.g. Aiven/Citus: defaultdb

# pluginName: mysql8 # or postgres12, postgres12_pgx

# driverName: mysql8

# databaseName: temporal

# connectAddr: "mysql.example.com:3306" # preferred format

# connectProtocol: "tcp"

# # OR use separate host/port:

# # host: mysql.example.com

# # port: 3306

# user: temporal_user

# password: "" # optional, use existingSecret instead

# existingSecret: temporal-db-secret # Helm-specific, stripped before rendering

# secretKey: password # Helm-specific, default: password

# # Server v1.31+ alternative to password/existingSecret (SQL datastores

# # only). When set, no password Secret is created and no SQL_PASSWORD

# # env is wired; the server invokes the command per new connection.

# passwordCommand:

# command: my-token-helper

# args: []

# timeout: 30s

# maxConns: 20

# maxIdleConns: 20

# maxConnLifetime: "1h"

# connectAttributes:

# tx_isolation: "READ-COMMITTED"

# tls:

# enabled: true

# caFile: /path/to/ca.pem

# Example Cassandra configuration:

# cassandra:

# createDatabase: false

# manageSchema: false

# hosts: "host1,host2"

# port: 9042

# keyspace: temporal

# user: cassandra_user

# password: "" # optional, use existingSecret instead

# existingSecret: temporal-cassandra-secret

# secretKey: password

# replicationFactor: 3

# consistency:

# default:

# consistency: "local_quorum"

# serialConsistency: "local_serial"

visibility:

# Example SQL configuration (same structure as default.sql):

# sql:

# createDatabase: false

# manageSchema: false

# defaultDb: postgres

# pluginName: mysql8

# driverName: mysql8

# databaseName: temporal_visibility

# connectAddr: "mysql.example.com:3306"

# connectProtocol: "tcp"

# user: temporal_user

# existingSecret: temporal-db-secret

# secretKey: password

# Example Elasticsearch configuration:

# elasticsearch:

# version: v7

# url:

# scheme: http

# host: "elasticsearch:9200"

# username: ""

# password: ""

# existingSecret: temporal-es-secret

# secretKey: password

# logLevel: error

# indices:

# visibility: temporal_visibility_v1

# tls:

# enabled: true

# caFile: /path/to/ca.crt

# certFile: /path/to/client.crt

# keyFile: /path/to/client.key

# serverName: elasticsearch.internal

# enableHostVerification: true

# aws-request-signing:

# credentialProvider: environment # static, environment, or aws-sdk-default

# region: us-east-1

# static:

# accessKeyID: ""

# secretAccessKey: ""

# token: ""

# Additional stores can be added here and will pass through directly

# archive:

# sql:

# pluginName: postgres12

# ...

metrics:

# Additional tags to be added to Prometheus metrics

tags: {}

# ... All other fields from https://github.com/temporalio/temporal/blob/main/common/metrics/config.go

# excludeTags: {}

# prefix: ""

# etc.

prometheus:

timerType: histogram

listenAddress: "0.0.0.0:9090"

namespaces:

# Enable this to create namespaces

create: false

# The namespace-setup job is a one-off admin tools invocation. Like the

# admin tools (see admintools.useExternalFrontend) it connects to the

# internal-frontend when that is enabled, which grants admin without an

# external Authorizer. Set this to true to route it through the external

# frontend instead (e.g. when the frontend has an Authorizer and you can

# authenticate the job rather than relying on the internal-frontend bypass).

useExternalFrontend: false

# Use Helm hooks to ensure namespace creation runs as a post-install/post-upgrade step,

# after the frontend is created, and is cleaned up automatically on the next release.

# Set to false if using Flux, Rancher or Terraform.

useHelmHooks: true

namespace:

- name: default

retention: 3d

frontend:

enabled: true

image: {}

service:

# Evaluated as template

annotations: {}

type: ClusterIP

port: 7233

appProtocol: tcp

membershipPort: 6933

membershipAppProtocol: tcp

httpPort: 7243

httpAppProtocol: http

# Defaults to a tcpSocket probe; uncomment below for a gRPC probe.

# gRPC probes don't yet support TLS (kubernetes/enhancements#4939), so opt in only when TLS is off.

readinessProbe: {}

livenessProbe: {}

# readinessProbe:

# grpc:

# port: 7233

# service: temporal.api.workflowservice.v1.WorkflowService

ingress:

enabled: false

# className:

annotations: {}

# kubernetes.io/ingress.class: traefik

# ingress.kubernetes.io/ssl-redirect: "false"

# traefik.frontend.rule.type: PathPrefix

hosts:

- "/"

# - "domain.com/xyz"

# - "domain.com"

tls: []

# - secretName: chart-example-tls

# hosts:

# - chart-example.local

metrics:

annotations:

enabled: true

serviceMonitor: {}

# enabled: false

prometheus: {}

# timerType: histogram

deploymentLabels: {}

deploymentAnnotations: {}

deploymentStrategy: {}

podAnnotations: {}

podLabels: {}

serviceLabels: {}

resources: {}

nodeSelector: {}

tolerations: []

affinity: {}

additionalEnv: []

containerSecurityContext: {}

topologySpreadConstraints: []

schedulerName: ""

runtimeClassName: ""

priorityClassName: ""

podDisruptionBudget: {}

serviceAccount: {}

# serviceAccount:

# create: false

# name: "frontend-service-account"

# extraAnnotations: {}

internal-frontend:

# Enable this to create internal-frontend

enabled: false

image: {}

service:

# Evaluated as template

annotations: {}

type: ClusterIP

port: 7236

appProtocol: tcp

membershipPort: 6936

membershipAppProtocol: tcp

httpPort: 7246

httpAppProtocol: http

# Defaults to a tcpSocket probe; uncomment below for a gRPC probe.

# gRPC probes don't yet support TLS (kubernetes/enhancements#4939), so opt in only when TLS is off.

readinessProbe: {}

livenessProbe: {}

# readinessProbe:

# grpc:

# port: 7236

# service: temporal.api.workflowservice.v1.WorkflowService

metrics:

annotations:

enabled: true

serviceMonitor: {}

# enabled: false

prometheus: {}

# timerType: histogram

deploymentLabels: {}

deploymentAnnotations: {}

deploymentStrategy: {}

podAnnotations: {}

podLabels: {}

serviceLabels: {}

resources: {}

nodeSelector: {}

tolerations: []

affinity: {}

additionalEnv: []

containerSecurityContext: {}

topologySpreadConstraints: []

schedulerName: ""

runtimeClassName: ""

priorityClassName: ""

podDisruptionBudget: {}

serviceAccount: {}

history:

enabled: true

image: {}

service:

# type: ClusterIP

port: 7234

appProtocol: tcp

membershipPort: 6934

membershipAppProtocol: tcp

readinessProbe: {}

livenessProbe: {}

metrics:

annotations:

enabled: true

serviceMonitor: {}

# enabled: false

prometheus: {}

# timerType: histogram

deploymentLabels: {}

deploymentAnnotations: {}

deploymentStrategy: {}

podAnnotations: {}

podLabels: {}

serviceLabels: {}

resources: {}

nodeSelector: {}

tolerations: []

affinity: {}

additionalEnv: []

containerSecurityContext: {}

topologySpreadConstraints: []

schedulerName: ""

runtimeClassName: ""

priorityClassName: ""

podDisruptionBudget: {}

serviceAccount: {}

matching:

enabled: true

image: {}

service:

# type: ClusterIP

port: 7235

appProtocol: tcp

membershipPort: 6935

membershipAppProtocol: tcp

readinessProbe: {}

livenessProbe: {}

metrics:

annotations:

enabled: true

serviceMonitor: {}

# enabled: false

prometheus: {}

# timerType: histogram

deploymentLabels: {}

deploymentAnnotations: {}

deploymentStrategy: {}

podAnnotations: {}

podLabels: {}

serviceLabels: {}

resources: {}

nodeSelector: {}

tolerations: []

affinity: {}

additionalEnv: []

containerSecurityContext: {}

topologySpreadConstraints: []

schedulerName: ""

runtimeClassName: ""

priorityClassName: ""

podDisruptionBudget: {}

serviceAccount: {}

worker:

enabled: true

image: {}

service:

# type: ClusterIP

port: 7239

appProtocol: tcp

membershipPort: 6939

membershipAppProtocol: tcp

readinessProbe: {}

livenessProbe: {}

metrics:

annotations:

enabled: true

serviceMonitor: {}

# enabled: false

prometheus: {}

# timerType: histogram

deploymentLabels: {}

deploymentAnnotations: {}

deploymentStrategy: {}

podAnnotations: {}

podLabels: {}

serviceLabels: {}

resources: {}

nodeSelector: {}

tolerations: []

affinity: {}

additionalEnv: []

containerSecurityContext: {}

topologySpreadConstraints: []

schedulerName: ""

runtimeClassName: ""

priorityClassName: ""

podDisruptionBudget: {}

serviceAccount: {}

admintools:

enabled: true

# By default the admin tools connect to the internal-frontend when it is

# enabled, which grants admin access without an external Authorizer. Set this

# to true to connect through the external frontend instead (e.g. when the

# frontend has an Authorizer and you supply credentials via additionalEnv). If

# server TLS is enabled the chart mounts the matching certificate (internode

# for the internal-frontend, frontend for the external frontend) and sets the

# TEMPORAL_TLS_* env; this is skipped when a custom temporalAddress is set.

useExternalFrontend: false

image:

repository: cgr.dev/chainguard-private/temporal-admin-tools-fips

tag: 1.32.2-r0@sha256:07f73c8cb3264e957c974150b3a93e1a8d5f8e2e0eb5bb50e2bf6adb46ed9281

pullPolicy: IfNotPresent

service:

type: ClusterIP

port: 22

annotations: {}

deploymentLabels: {}

deploymentAnnotations: {}

deploymentStrategy: {}

podLabels: {}

podAnnotations: {}

nodeSelector: {}

tolerations: []

affinity: {}

schedulerName: ""

runtimeClassName: ""

priorityClassName: ""

additionalVolumes: []

additionalVolumeMounts: []

additionalEnv: []

additionalEnvSecretName: ""

additionalEnvConfigMapName: ""

# temporalAddress: "localhost:7233"

# for sidecar containers, add containers here with restartPolicy: Always

additionalInitContainers: []

resources: {}

containerSecurityContext: {}

securityContext: {}

minReadySeconds: 0

podDisruptionBudget: {}

serviceAccount: {}

web:

# additionalInitContainers: []

enabled: true

# replicaCount: 1

image:

repository: cgr.dev/chainguard-private/temporal-ui-server-fips

tag: 2.58.0-r0@sha256:42c8e2628af873563bf52327fe91e5c6afec355c1b75c450612b23ae94cee886

pullPolicy: IfNotPresent

service:

# set type to NodePort if access to web needs access from outside the cluster

# for more info see https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types

type: ClusterIP

# The below clusterIP setting can be set to "None" to make the temporal-web service headless.

# Note that this requires the web.service.type to be the default ClusterIP value.

# clusterIP:

port: 8080

appProtocol: http

annotations: {}

# loadBalancerIP:

# Override the address the UI uses to connect to the Temporal frontend.

# Defaults to <fullname>-frontend.<namespace>.svc:<server.frontend.service.port>.

# Useful when running a proxy sidecar that intercepts gRPC traffic.

# temporalAddress: "localhost:7233"

readinessProbe:

initialDelaySeconds: 10

httpGet:

path: /healthz

port: http

ingress:

enabled: false

# className:

annotations: {}

# kubernetes.io/ingress.class: traefik

# ingress.kubernetes.io/ssl-redirect: "false"

# traefik.frontend.rule.type: PathPrefix

hosts:

- "/"

# - "domain.com/xyz"

# - "domain.com"

tls: []

# - secretName: chart-example-tls

# hosts:

# - chart-example.local

deploymentLabels: {}

deploymentAnnotations: {}

deploymentStrategy: {}

podAnnotations: {}

podLabels: {}

resources: {}

# We usually recommend not to specify default resources and to leave this as a conscious

# choice for the user. This also increases chances charts run on environments with little

# resources, such as Minikube. If you do want to specify resources, uncomment the following

# lines, adjust them as necessary, and remove the curly braces after 'resources:'.

# limits:

# cpu: 100m

# memory: 128Mi

# requests:

# cpu: 100m

# memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}

additionalVolumes: []

additionalVolumeMounts: []

# Wire TLS for the connection from the Web UI to the frontend. Point at an

# existing kubernetes.io/tls secret; the chart mounts it and sets the

# TEMPORAL_TLS_* environment variables. The secret needs ca.crt to verify the

# frontend, plus tls.crt + tls.key when the frontend requires client

# certificates (server.tls.frontend.requireClientAuth: true).

tls:

enabled: false

secretName: ""

mountPath: /etc/temporal/tls

# DNS name expected in the frontend server certificate. Required when

# enableHostVerification is true.

serverName: ""

# Verify the frontend certificate against serverName.

enableHostVerification: false

# Adjust Web UI config with environment variables:

# https://docs.temporal.io/references/web-ui-environment-variables

additionalEnv: []

additionalEnvSecretName: ""

additionalEnvConfigMapName: ""

containerSecurityContext: {}

securityContext: {}

topologySpreadConstraints: []

schedulerName: ""

runtimeClassName: ""

priorityClassName: ""

minReadySeconds: 0

podDisruptionBudget: {}

serviceAccount: {}

schema:

# Use Helm hooks to ensure schema setup completes before server pods start.

# Set to false if using Flux, Rancher or Terraform.

useHelmHooks: true

backoffLimit: 100

activeDeadlineSeconds: null

ttlSecondsAfterFinished: 86400

jobAnnotations: {}

podAnnotations: {}

podLabels: {}

resources: {}

containerSecurityContext: {}

securityContext: {}

serviceAccount: {}

shims:

# Enable compatibility with Temporal 1.29 images. Set to true if using Temporal 1.29.

dockerize: false

# Enable compatibility with Temporal 1.29 images. Set to true if using Temporal 1.29.

elasticsearchTool: false

test:

podAnnotations: {}

podLabels: {}

securityContext: {}

containerSecurityContext: {}

resources: {}

nodeSelector: {}

tolerations: []

affinity: {}

serviceAccount: {}