manifests/values/temporal/values/temporal.yaml

server:
  replicaCount: 2
  config:
    logLevel: "info"
    persistence:
      defaultStore: default
      visibilityStore: visibility
      # immutable after first deploy
      numHistoryShards: 512
      datastores:
        default:
          sql:
            createDatabase: false
            manageSchema: true
            pluginName: postgres12
            driverName: postgres12
            databaseName: temporal
            connectAddr: "temporal-db-rw.temporal:5432"
            connectProtocol: tcp
            user: temporal
            existingSecret: temporal-db-app
            secretKey: password
            maxConns: 20
            maxIdleConns: 20
            maxConnLifetime: "1h"
        # NOTE: Postgres 12+ gives advanced visibility; no Elasticsearch needed.
        visibility:
          sql:
            createDatabase: false
            manageSchema: true
            pluginName: postgres12
            driverName: postgres12
            databaseName: temporal_visibility
            connectAddr: "temporal-db-rw.temporal:5432"
            connectProtocol: tcp
            user: temporal
            existingSecret: temporal-db-app
            secretKey: password
            maxConns: 10
            maxIdleConns: 10
            maxConnLifetime: "1h"
    metrics:
      prometheus:
        timerType: histogram
        listenAddress: "0.0.0.0:9090"

  metrics:
    serviceMonitor:
      enabled: true
      interval: 30s

  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: "1"
      memory: 1Gi

  frontend:
    podDisruptionBudget:
      maxUnavailable: 1
    topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: kubernetes.io/hostname
      whenUnsatisfiable: ScheduleAnyway
      labelSelector:
        matchLabels:
          app.kubernetes.io/name: temporal
          app.kubernetes.io/instance: temporal
          app.kubernetes.io/component: frontend

  history:
    resources:
      requests:
        cpu: 250m
        memory: 768Mi
      limits:
        cpu: "1"
        memory: 1536Mi
    podDisruptionBudget:
      maxUnavailable: 1
    topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: kubernetes.io/hostname
      whenUnsatisfiable: ScheduleAnyway
      labelSelector:
        matchLabels:
          app.kubernetes.io/name: temporal
          app.kubernetes.io/instance: temporal
          app.kubernetes.io/component: history

  matching:
    podDisruptionBudget:
      maxUnavailable: 1
    topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: kubernetes.io/hostname
      whenUnsatisfiable: ScheduleAnyway
      labelSelector:
        matchLabels:
          app.kubernetes.io/name: temporal
          app.kubernetes.io/instance: temporal
          app.kubernetes.io/component: matching

  worker:
    podDisruptionBudget:
      maxUnavailable: 1
    topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: kubernetes.io/hostname
      whenUnsatisfiable: ScheduleAnyway
      labelSelector:
        matchLabels:
          app.kubernetes.io/name: temporal
          app.kubernetes.io/instance: temporal
          app.kubernetes.io/component: worker

# no persistent debug pod; use temporalio/admin-tools on demand
admintools:
  enabled: false

web:
  enabled: true
  replicaCount: 2
  resources:
    requests:
      cpu: 50m
      memory: 128Mi
    limits:
      cpu: 250m
      memory: 256Mi
  podDisruptionBudget:
    maxUnavailable: 1
  topologySpreadConstraints:
  - maxSkew: 1
    topologyKey: kubernetes.io/hostname
    whenUnsatisfiable: ScheduleAnyway
    labelSelector:
      matchLabels:
        app.kubernetes.io/name: temporal
        app.kubernetes.io/instance: temporal
        app.kubernetes.io/component: web
  # NOTE: native OIDC SSO via Entra ID (same oceanbox-oidc secret as Grafana); gates UI login only
  additionalEnv:
    - name: TEMPORAL_AUTH_ENABLED
      value: "true"
    - name: TEMPORAL_AUTH_TYPE
      value: "oidc"
    - name: TEMPORAL_AUTH_PROVIDER_URL
      value: "https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/v2.0"
    - name: TEMPORAL_AUTH_CLIENT_ID
      valueFrom:
        secretKeyRef:
          name: oceanbox-oidc
          key: client_id
    - name: TEMPORAL_AUTH_CLIENT_SECRET
      valueFrom:
        secretKeyRef:
          name: oceanbox-oidc
          key: client_secret
    - name: TEMPORAL_AUTH_CALLBACK_URL
      value: "https://temporal.ekman.oceanbox.io/auth/sso/callback"
    - name: TEMPORAL_AUTH_SCOPES
      value: "openid,profile,email,offline_access"

schema:
  useHelmHooks: false
  # NOTE: run as an ArgoCD sync hook so the controller-mutated Job isn't diffed and stays OutOfSync forever
  jobAnnotations:
    argocd.argoproj.io/hook: Sync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation