temporal: Add HA setup

values/temporal/values/temporal.yaml

@@ -1,8 +1,12 @@
 server:
+  # 2 replicas per role for HA; per-role blocks inherit this.
+  replicaCount: 2
   config:
+    logLevel: "info"
     persistence:
       defaultStore: default
       visibilityStore: visibility
+      # immutable after first deploy
       numHistoryShards: 512
       datastores:
         default:
@@ -20,7 +24,7 @@ server:
             maxConns: 20
             maxIdleConns: 20
             maxConnLifetime: "1h"
-        # TODO: migrate visibility to Elasticsearch for advanced visibility search.
+        # Postgres 12+ gives advanced visibility; no Elasticsearch needed.
         visibility:
           sql:
             createDatabase: false
@@ -41,8 +45,127 @@ server:
         timerType: histogram
         listenAddress: "0.0.0.0:9090"
 
+  # this cluster's Prometheus scrapes via ServiceMonitor, not pod annotations
+  metrics:
+    serviceMonitor:
+      enabled: true
+      interval: 30s
+
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "1"
+      memory: 1Gi
+
+  frontend:
+    podDisruptionBudget:
+      maxUnavailable: 1
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: temporal
+          app.kubernetes.io/instance: temporal
+          app.kubernetes.io/component: frontend
+
+  history:
+    # memory-heavy (shard/mutable-state cache)
+    resources:
+      requests:
+        cpu: 250m
+        memory: 768Mi
+      limits:
+        cpu: "1"
+        memory: 1536Mi
+    podDisruptionBudget:
+      maxUnavailable: 1
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: temporal
+          app.kubernetes.io/instance: temporal
+          app.kubernetes.io/component: history
+
+  matching:
+    podDisruptionBudget:
+      maxUnavailable: 1
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: temporal
+          app.kubernetes.io/instance: temporal
+          app.kubernetes.io/component: matching
+
+  worker:
+    podDisruptionBudget:
+      maxUnavailable: 1
+    topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/name: temporal
+          app.kubernetes.io/instance: temporal
+          app.kubernetes.io/component: worker
+
+# no persistent debug pod; use temporalio/admin-tools on demand
+admintools:
+  enabled: false
+
 web:
   enabled: true
+  replicaCount: 2
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 250m
+      memory: 256Mi
+  podDisruptionBudget:
+    maxUnavailable: 1
+  topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: kubernetes.io/hostname
+    whenUnsatisfiable: ScheduleAnyway
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: temporal
+        app.kubernetes.io/instance: temporal
+        app.kubernetes.io/component: web
+  # native OIDC SSO via Entra ID (same oceanbox-oidc secret as Grafana); gates UI login only
+  additionalEnv:
+    - name: TEMPORAL_AUTH_ENABLED
+      value: "true"
+    - name: TEMPORAL_AUTH_TYPE
+      value: "oidc"
+    - name: TEMPORAL_AUTH_PROVIDER_URL
+      value: "https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/v2.0"
+    - name: TEMPORAL_AUTH_CLIENT_ID
+      valueFrom:
+        secretKeyRef:
+          name: oceanbox-oidc
+          key: client_id
+    - name: TEMPORAL_AUTH_CLIENT_SECRET
+      valueFrom:
+        secretKeyRef:
+          name: oceanbox-oidc
+          key: client_secret
+    - name: TEMPORAL_AUTH_CALLBACK_URL
+      value: "https://temporal.ekman.oceanbox.io/auth/sso/callback"
+    - name: TEMPORAL_AUTH_SCOPES
+      value: "openid,profile,email"
 
 schema:
   useHelmHooks: false