temporal: Support huge cookie

values/temporal/manifests/ingress.yaml

@@ -8,6 +8,8 @@ metadata:
     cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
     nginx.ingress.kubernetes.io/backend-protocol: HTTP
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
+    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "24k"
     oceanbox.io/expose: internal
   labels:
     app.kubernetes.io/name: temporal

values/temporal/values/temporal.yaml

@@ -1,5 +1,4 @@
 server:
-  # 2 replicas per role for HA; per-role blocks inherit this.
   replicaCount: 2
   config:
     logLevel: "info"
@@ -24,7 +23,7 @@ server:
             maxConns: 20
             maxIdleConns: 20
             maxConnLifetime: "1h"
-        # Postgres 12+ gives advanced visibility; no Elasticsearch needed.
+        # NOTE: Postgres 12+ gives advanced visibility; no Elasticsearch needed.
         visibility:
           sql:
             createDatabase: false
@@ -45,7 +44,6 @@ server:
         timerType: histogram
         listenAddress: "0.0.0.0:9090"
 
-  # this cluster's Prometheus scrapes via ServiceMonitor, not pod annotations
   metrics:
     serviceMonitor:
       enabled: true
@@ -73,7 +71,6 @@ server:
           app.kubernetes.io/component: frontend
 
   history:
-    # memory-heavy (shard/mutable-state cache)
     resources:
       requests:
         cpu: 250m
@@ -144,7 +141,7 @@ web:
         app.kubernetes.io/name: temporal
         app.kubernetes.io/instance: temporal
         app.kubernetes.io/component: web
-  # native OIDC SSO via Entra ID (same oceanbox-oidc secret as Grafana); gates UI login only
+  # NOTE: native OIDC SSO via Entra ID (same oceanbox-oidc secret as Grafana); gates UI login only
   additionalEnv:
     - name: TEMPORAL_AUTH_ENABLED
       value: "true"
@@ -165,12 +162,11 @@ web:
     - name: TEMPORAL_AUTH_CALLBACK_URL
       value: "https://temporal.ekman.oceanbox.io/auth/sso/callback"
     - name: TEMPORAL_AUTH_SCOPES
-      value: "openid,profile,email"
+      value: "openid,profile,email,offline_access"
 
 schema:
   useHelmHooks: false
-  # run as an ArgoCD sync hook so the controller-mutated Job (auto selector +
+  # NOTE: run as an ArgoCD sync hook so the controller-mutated Job isn't diffed and stays OutOfSync forever
-  # controller-uid/job-name labels) isn't diffed and stays OutOfSync forever
   jobAnnotations:
     argocd.argoproj.io/hook: Sync
     argocd.argoproj.io/hook-delete-policy: BeforeHookCreation