temporal: Add HA setup

values/temporal/manifests/network/temporal-policies.yaml

@@ -60,4 +60,19 @@ spec:
         protocol: UDP
       - port: "53"
         protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-web-oidc-login
+  namespace: temporal
+spec:
+  description: Allow Temporal Web UI OIDC login to Entra ID
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: web
+  egress:
+  - toFQDNs:
+    - matchName: login.microsoftonline.com
+    - matchPattern: '*.microsoftonline.com'
 {{- end }}

values/temporal/manifests/temporal-db.yaml

@@ -12,9 +12,20 @@ spec:
     initdb:
       database: temporal
       owner: temporal
+  # headroom for ~240 server connections (30/pod x 8 pods) plus CNPG's own
+  postgresql:
+    parameters:
+      max_connections: "300"
+  resources:
+    requests:
+      cpu: 500m
+      memory: 1Gi
+    limits:
+      cpu: "2"
+      memory: 2Gi
   storage:
     resizeInUseVolumes: true
-    size: 10Gi
+    size: 20Gi
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: Database