From 3c5136212f6e46b068fd13afe43fa2bc9d0bfcd0 Mon Sep 17 00:00:00 2001 From: Akash LM Date: Tue, 31 Oct 2023 20:19:40 +0530 Subject: [PATCH] updated temporal chart --- charts/temporal/Chart.yaml | 9 +- charts/temporal/README.md | 594 +++++++++++++++++- charts/temporal/templates/_helpers.tpl | 11 + .../templates/admintools-deployment.yaml | 22 + .../temporal/templates/server-configmap.yaml | 50 +- .../temporal/templates/server-deployment.yaml | 23 +- charts/temporal/templates/server-hpa.yaml | 40 -- charts/temporal/templates/server-job.yaml | 141 ++++- charts/temporal/templates/server-pdb.yaml | 27 + charts/temporal/templates/server-secret.yaml | 7 + charts/temporal/templates/web-deployment.yaml | 18 + charts/temporal/templates/web-ingress.yaml | 3 + charts/temporal/values.yaml | 336 +++++----- .../values/values.archival.filestore.yaml | 25 + .../values/values.archival.gcloud.yaml | 23 + .../temporal/values/values.archival.s3.yaml | 23 + charts/temporal/values/values.cassandra.yaml | 45 +- charts/temporal/values/values.postgresql.yaml | 23 + .../values/values.prometheus.external.yaml | 28 + 19 files changed, 1167 insertions(+), 281 deletions(-) delete mode 100644 charts/temporal/templates/server-hpa.yaml create mode 100644 charts/temporal/templates/server-pdb.yaml create mode 100644 charts/temporal/values/values.archival.filestore.yaml create mode 100644 charts/temporal/values/values.archival.gcloud.yaml create mode 100644 charts/temporal/values/values.archival.s3.yaml create mode 100644 charts/temporal/values/values.prometheus.external.yaml diff --git a/charts/temporal/Chart.yaml b/charts/temporal/Chart.yaml index bedac27..7250c46 100644 --- a/charts/temporal/Chart.yaml +++ b/charts/temporal/Chart.yaml @@ -1,6 +1,7 @@ + annotations: artifacthub.io/changes: | - - "✨ update chart to version 0.17.5 " + - "✨ update chart to version 0.29.0" apiVersion: v2 name: temporal @@ -33,7 +34,7 @@ dependencies: condition: prometheus.enabled - name: elasticsearch repository: https://helm.elastic.co - version: 7.16.3 + version: 7.17.3 condition: elasticsearch.enabled - name: grafana repository: https://grafana.github.io/helm-charts @@ -52,8 +53,8 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 0.1.7 +version: 0.1.8 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. -appVersion: 1.17.5 +appVersion: 1.22.1 diff --git a/charts/temporal/README.md b/charts/temporal/README.md index 7c8094e..97d798c 100644 --- a/charts/temporal/README.md +++ b/charts/temporal/README.md @@ -1,21 +1,575 @@ -## Temporal -### Prerequisites -- k8ssandra - -#### pre-installation setup -Copy the secret from k8ssandra-operator namespace to temporal namespace -```sh -kubectl get secret temporal-superuser --namespace=k8ssandra-operator -o yaml | sed 's/namespace: .*/namespace: temporal/' | kubectl apply -f - -``` -### Intallation -Note: when installing it for the first set the values for schema create and update to true in values/values.cassandra.yaml file, once the installation is complete set them to false for subsequent releases. Here is the values stanza for reference. -```yaml -schema: - setup: - enabled: true - update: - enabled: true -``` -```sh -helm install -f values.yaml -f values/values.cassandra.yaml -n temporal temporal . +# Temporal Helm Chart +[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Ftemporalio%2Ftemporal-helm-charts.svg?type=shield)](https://app.fossa.com/projects/git%2Bgithub.com%2Ftemporalio%2Ftemporal-helm-charts?ref=badge_shield) + +Temporal is a distributed, scalable, durable, and highly available orchestration engine designed to execute asynchronous long-running business logic in a resilient way. + +This repo contains a basic V3 [Helm](https://helm.sh) chart that deploys Temporal to a Kubernetes cluster. The dependencies that are bundled with this solution by default offer an easy way to experiment with Temporal software. This Helm chart can also be used to install just the Temporal server, configured to connect to dependencies (such as a Cassandra, MySQL, or PostgreSQL database) that you may already have available in your environment. + +The only portions of the helm chart that are production ready are the parts that configure and manage Temporal Server itself—not Cassandra, Elasticsearch, Prometheus, or Grafana. + +This Helm Chart code is tested by a dedicated test pipeline. It is also used extensively by other Temporal pipelines for testing various aspects of Temporal systems. Our test pipeline currently uses Helm 3.1.1. + +# Install Temporal service on a Kubernetes cluster + +## Prerequisites + +This sequence assumes +* that your system is configured to access a kubernetes cluster (e. g. [AWS EKS](https://aws.amazon.com/eks/), [kind](https://kind.sigs.k8s.io/), or [minikube](https://kubernetes.io/docs/tasks/tools/install-minikube/)), and +* that your machine has + - [AWS CLI V2](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html), + - [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/), and + - [Helm v3](https://helm.sh) + installed and able to access your cluster. + +## Download Helm Chart Dependencies + +Download Helm dependencies: + +```bash +~/temporal-helm$ helm dependencies update +``` + +## Install Temporal with Helm Chart + +Temporal can be configured to run with various dependencies. The default "Batteries Included" Helm Chart configuration deploys and configures the following components: + +* Cassandra +* ElasticSearch +* Prometheus +* Grafana + +The sections that follow describe various deployment configurations, from a minimal one-replica installation using included dependencies, to a replicated deployment on existing infrastructure. + +### Minimal installation with required dependencies only + +To install Temporal in a limited but working and self-contained configuration (one replica of Cassandra and each of Temporal's services, no metrics or ElasticSearch), you can run the following command + +``` +~/temporal-helm$ helm install \ + --set server.replicaCount=1 \ + --set cassandra.config.cluster_size=1 \ + --set prometheus.enabled=false \ + --set grafana.enabled=false \ + --set elasticsearch.enabled=false \ + temporaltest . --timeout 15m +``` + +This configuration consumes limited resources and it is useful for small scale tests (such as using minikube). + +Below is an example of an environment installed in this configuration: + +``` +$ kubectl get pods +NAME READY STATUS RESTARTS AGE +temporaltest-admintools-6cdf56b869-xdxz2 1/1 Running 0 11m +temporaltest-cassandra-0 1/1 Running 0 11m +temporaltest-frontend-5d5b6d9c59-v9g5j 1/1 Running 2 11m +temporaltest-history-64b9ddbc4b-bwk6j 1/1 Running 2 11m +temporaltest-matching-c8887ddc4-jnzg2 1/1 Running 2 11m +temporaltest-metrics-server-7fbbf65cff-rp2ks 1/1 Running 0 11m +temporaltest-web-77f68bff76-ndkzf 1/1 Running 0 11m +temporaltest-worker-7c9d68f4cf-8tzfw 1/1 Running 2 11m ``` + +### Install with required and optional dependencies + +This method requires a three node kubernetes cluster to successfully bring up all the dependencies. + +By default, Temporal Helm Chart configures Temporal to run with a three node Cassandra cluster (for persistence) and Elasticsearch (for "visibility" features), Prometheus, and Grafana. By default, Temporal Helm Chart installs all dependencies, out of the box. + +To install Temporal with all of its dependencies run this command: + +```bash +~/temporal-helm$ helm install temporaltest . --timeout 900s +``` + +To use your own instance of ElasticSearch, MySQL, PostgreSQL, or Cassandra, please read the "Bring Your Own" sections below. + +Other components (Prometheus, Grafana) can be omitted from the installation by setting their corresponding `enable` flag to `false`: + +```bash +~/temporal-helm$ helm install \ + --set prometheus.enabled=false \ + --set grafana.enabled=false \ + temporaltest . --timeout 900s +``` + +### Install with sidecar containers + +You may need to provide your own sidecar containers. + +To do so, you may look at the example for Google's `cloud sql proxy` in the `values/values.cloudsqlproxy.yaml` and pass that file to `helm install`. + +Example: + +```bash +~/temporal-helm$ helm install -f values/values.cloudsqlproxy.yaml temporaltest . --timeout 900s +``` + +### Install with your own ElasticSearch + +You might already be operating an instance of ElasticSearch that you want to use with Temporal. + +To do so, fill in the relevant configuration values in `values.elasticsearch.yaml`, and pass the file to 'helm install'. + +Example: + +```bash +~/temporal-helm$ helm install -f values/values.elasticsearch.yaml temporaltest . --timeout 900s +``` + +### Install with your own MySQL + +You might already be operating a MySQL instance that you want to use with Temporal. + +In this case, create and configure temporal databases on your MySQL host with `temporal-sql-tool`. The tool is part of [temporal repo](https://github.com/temporalio/temporal), and it relies on the schema definition, in the same repo. + +Here are examples of commands you can use to create and initialize the databases: + +```bash +# in https://github.com/temporalio/temporal git repo dir +export SQL_PLUGIN=mysql +export SQL_HOST=mysql_host +export SQL_PORT=3306 +export SQL_USER=mysql_user +export SQL_PASSWORD=mysql_password + +make temporal-sql-tool + +./temporal-sql-tool --database temporal create-database +SQL_DATABASE=temporal ./temporal-sql-tool setup-schema -v 0.0 +SQL_DATABASE=temporal ./temporal-sql-tool update -schema-dir schema/mysql/v57/temporal/versioned + +./temporal-sql-tool --database temporal_visibility create-database +SQL_DATABASE=temporal_visibility ./temporal-sql-tool setup-schema -v 0.0 +SQL_DATABASE=temporal_visibility ./temporal-sql-tool update -schema-dir schema/mysql/v57/visibility/versioned +``` + +Once you initialized the two databases, fill in the configuration values in `values/values.mysql.yaml`, and run + +```bash +# in https://github.com/temporalio/helm-charts git repo dir +helm install -f values/values.mysql.yaml temporaltest . --timeout 900s +``` + +Alternatively, instead of modifying `values/values.mysql.yaml`, you can supply those values in your command line: + +```bash +# in https://github.com/temporalio/helm-charts git repo dir +helm install -f values/values.mysql.yaml temporaltest \ + --set elasticsearch.enabled=false \ + --set server.config.persistence.default.sql.user=mysql_user \ + --set server.config.persistence.default.sql.password=mysql_password \ + --set server.config.persistence.visibility.sql.user=mysql_user \ + --set server.config.persistence.visibility.sql.password=mysql_password \ + --set server.config.persistence.default.sql.host=mysql_host \ + --set server.config.persistence.visibility.sql.host=mysql_host . --timeout 900s +``` +*NOTE:* For MYSQL <5.7.20 (e.g AWS Aurora MySQL) use `values/values.aurora-mysql.yaml` + +### Install with your own PostgreSQL + +You might already be operating a PostgreSQL instance that you want to use with Temporal. + +In this case, create and configure temporal databases on your PostgreSQL host with `temporal-sql-tool`. The tool is part of [temporal repo](https://github.com/temporalio/temporal), and it relies on the schema definition, in the same repo. + +Here are examples of commands you can use to create and initialize the databases: + +```bash +# in https://github.com/temporalio/temporal git repo dir +export SQL_PLUGIN=postgres +export SQL_HOST=postgresql_host +export SQL_PORT=5432 +export SQL_USER=postgresql_user +export SQL_PASSWORD=postgresql_password + +make temporal-sql-tool + +./temporal-sql-tool --database temporal create-database +SQL_DATABASE=temporal ./temporal-sql-tool setup-schema -v 0.0 +SQL_DATABASE=temporal ./temporal-sql-tool update -schema-dir schema/postgresql/v96/temporal/versioned + +./temporal-sql-tool --database temporal_visibility create-database +SQL_DATABASE=temporal_visibility ./temporal-sql-tool setup-schema -v 0.0 +SQL_DATABASE=temporal_visibility ./temporal-sql-tool update -schema-dir schema/postgresql/v96/visibility/versioned +``` + +Once you initialized the two databases, fill in the configuration values in `values/values.postgresql.yaml`, and run + +```bash +# in https://github.com/temporalio/helm-charts git repo dir +helm install -f values/values.postgresql.yaml temporaltest . --timeout 900s +``` + +Alternatively, instead of modifying `values/values.postgresql.yaml`, you can supply those values in your command line: + +```bash +# in https://github.com/temporalio/helm-charts git repo dir +helm install -f values/values.postgresql.yaml temporaltest \ + --set elasticsearch.enabled=false \ + --set server.config.persistence.default.sql.user=postgresql_user \ + --set server.config.persistence.default.sql.password=postgresql_password \ + --set server.config.persistence.visibility.sql.user=postgresql_user \ + --set server.config.persistence.visibility.sql.password=postgresql_password \ + --set server.config.persistence.default.sql.host=postgresql_host \ + --set server.config.persistence.visibility.sql.host=postgresql_host . --timeout 900s +``` + +### Install with your own Cassandra + +You might already be operating a Cassandra instance that you want to use with Temporal. + +In this case, create and setup keyspaces in your Cassandra instance with `temporal-cassandra-tool`. The tool is part of [temporal repo](https://github.com/temporalio/temporal), and it relies on the schema definition, in the same repo. + + +Here are examples of commands you can use to create and initialize the keyspaces: + +```bash +# in https://github.com/temporalio/temporal git repo dir +export CASSANDRA_HOST=cassandra_host +export CASSANDRA_PORT=9042 +export CASSANDRA_USER=cassandra_user +export CASSANDRA_PASSWORD=cassandra_user_password + +./temporal-cassandra-tool create-Keyspace -k temporal +CASSANDRA_KEYSPACE=temporal ./temporal-cassandra-tool setup-schema -v 0.0 +CASSANDRA_KEYSPACE=temporal ./temporal-cassandra-tool update -schema-dir schema/cassandra/temporal/versioned + +./temporal-cassandra-tool create-Keyspace -k temporal_visibility +CASSANDRA_KEYSPACE=temporal_visibility ./temporal-cassandra-tool setup-schema -v 0.0 +CASSANDRA_KEYSPACE=temporal_visibility ./temporal-cassandra-tool update -schema-dir schema/cassandra/visibility/versioned +``` + +Once you initialized the two keyspaces, fill in the configuration values in `values/values.cassandra.yaml`, and run + +```bash +~/temporal-helm$ helm install -f values/values.cassandra.yaml temporaltest . --timeout 900s +``` + +### Enable Archival + +By default archival is disabled. You can enable it by picking one of the three provider options: + +* File Store, values file `values/values.archival.filestore.yaml` +* S3, values file `values/values.archival.s3.yaml` +* GCloud, values file `values/values.archival.gcloud.yaml` + +So to use the minimal command again and to enable archival with file store provider: +```bash +helm install -f values/values.archival.filestore.yaml \ + --set server.replicaCount=1 \ + --set cassandra.config.cluster_size=1 \ + --set prometheus.enabled=false \ + --set grafana.enabled=false \ + --set elasticsearch.enabled=false \ + temporaltest . --timeout 15m +``` + +Note that if archival is enabled, it is also enabled for all newly created namespaces. +Make sure to update the specific archival provider values file to set your configs. + +### Install and configure Temporal + +If a live application environment already uses systems that Temporal can use as dependencies, then those systems can continue to be used. This Helm chart can install the minimal pieces of Temporal such that it can then be configured to use those systems as its dependencies. + +The example below demonstrates a few things: + +1. How to set values via the command line rather than the environment. +2. How to configure a database (shows Cassandra, but MySQL works the same way) +3. How to enable TLS for the database connection. +4. How to enable Auth for the Web UI + +```bash +helm install temporaltest \ + -f values/values.cassandra.yaml \ + -f values/values.elasticsearch.yaml \ + --set grafana.enabled=false \ + --set prometheus.enabled=false \ + --set server.replicaCount=5 \ + --set server.config.persistence.default.cassandra.hosts=cassandra.data.host.example \ + --set server.config.persistence.default.cassandra.user=cassandra_user \ + --set server.config.persistence.default.cassandra.password=cassandra_user_password \ + --set server.config.persistence.default.cassandra.tls.caData=$(base64 --wrap=0 cassandra.ca.pem) \ + --set server.config.persistence.default.cassandra.tls.enabled=true \ + --set server.config.persistence.default.cassandra.replicationFactor=3 \ + --set server.config.persistence.default.cassandra.keyspace=temporal \ + --set server.config.persistence.visibility.cassandra.hosts=cassandra.vis.host.example \ + --set server.config.persistence.visibility.cassandra.user=cassandra_user_vis \ + --set server.config.persistence.visibility.cassandra.password=cassandra_user_vis_password \ + --set server.config.persistence.visibility.cassandra.tls.caData=$(base64 --wrap=0 cassandra.ca.pem) \ + --set server.config.persistence.visibility.cassandra.tls.enabled=true \ + --set server.config.persistence.visibility.cassandra.replicationFactor=3 \ + --set server.config.persistence.visibility.cassandra.keyspace=temporal_visibility \ + . \ + --timeout 15m \ + --wait +``` + +## Play With It + +### Exploring Your Cluster + +You can use your favorite kubernetes tools ([k9s](https://github.com/derailed/k9s), [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/), etc.) to interact with your cluster. + +```bash +$ kubectl get svc +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +... +temporaltest-admintools ClusterIP 172.20.237.59 22/TCP 15m +temporaltest-frontend-headless ClusterIP None 7233/TCP,9090/TCP 15m +temporaltest-history-headless ClusterIP None 7234/TCP,9090/TCP 15m +temporaltest-matching-headless ClusterIP None 7235/TCP,9090/TCP 15m +temporaltest-worker-headless ClusterIP None 7239/TCP,9090/TCP 15m +... +``` + +``` +$ kubectl get pods +... +temporaltest-admintools-7b6c599855-8bk4x 1/1 Running 0 25m +temporaltest-frontend-54d94fdcc4-bx89b 1/1 Running 2 25m +temporaltest-history-86d8d7869-lzb6f 1/1 Running 2 25m +temporaltest-matching-6c7d6d7489-kj5pj 1/1 Running 3 25m +temporaltest-worker-769b996fd-qmvbw 1/1 Running 2 25m +... +``` + +### Running Temporal CLI From the Admin Tools Container + +You can also shell into `admin-tools` container via [k9s](https://github.com/derailed/k9s) or by running + +``` +$ kubectl exec -it services/temporaltest-admintools /bin/bash +bash-5.0# +``` + +and run Temporal CLI from there: + +``` +bash-5.0# tctl namespace list +Name: temporal-system +Id: 32049b68-7872-4094-8e63-d0dd59896a83 +Description: Temporal internal system namespace +OwnerEmail: temporal-core@temporal.io +NamespaceData: map[string]string(nil) +Status: Registered +RetentionInDays: 7 +EmitMetrics: true +ActiveClusterName: active +Clusters: active +HistoryArchivalStatus: Disabled +VisibilityArchivalStatus: Disabled +Bad binaries to reset: ++-----------------+----------+------------+--------+ +| BINARY CHECKSUM | OPERATOR | START TIME | REASON | ++-----------------+----------+------------+--------+ ++-----------------+----------+------------+--------+ +``` + +``` +bash-5.0# tctl --namespace nonesuch namespace desc +Error: Namespace nonesuch does not exist. +Error Details: Namespace nonesuch does not exist. +``` +``` +bash-5.0# tctl --namespace nonesuch namespace re +Namespace nonesuch successfully registered. +``` +``` +bash-5.0# tctl --namespace nonesuch namespace desc +Name: nonesuch +UUID: 465bb575-8c01-43f8-a67d-d676e1ae5eae +Description: +OwnerEmail: +NamespaceData: map[string]string(nil) +Status: Registered +RetentionInDays: 3 +EmitMetrics: false +ActiveClusterName: active +Clusters: active +HistoryArchivalStatus: ArchivalStatusDisabled +VisibilityArchivalStatus: ArchivalStatusDisabled +Bad binaries to reset: ++-----------------+----------+------------+--------+ +| BINARY CHECKSUM | OPERATOR | START TIME | REASON | ++-----------------+----------+------------+--------+ ++-----------------+----------+------------+--------+ +``` + +### Forwarding Your Machine's Local Port to Temporal FrontEnd + +You can also expose your instance's front end port on your local machine: + +``` +$ kubectl port-forward services/temporaltest-frontend-headless 7233:7233 +Forwarding from 127.0.0.1:7233 -> 7233 +Forwarding from [::1]:7233 -> 7233 +``` + +and, from a separate window, use the local port to access the service from your application or Temporal samples. + +### Forwarding Your Machine's Local Port to Temporal Web UI + +Similarly to how you accessed Temporal front end via kubernetes port forwarding, you can access your Temporal instance's web user interface. + +To do so, forward your machine's local port to the Web service in your Temporal installation + +``` +$ kubectl port-forward services/temporaltest-web 8080:8080 +Forwarding from 127.0.0.1:8080 -> 8080 +Forwarding from [::1]:8080 -> 8080 +``` + +and navigate to http://127.0.0.1:8080 in your browser. + + +### Exploring Metrics via Grafana + +By default, the full "Batteries Included" configuration comes with a few Grafana dashboards. + +To access those dashboards, follow the following steps: + +1. Extract Grafana's `admin` password from your installation: + +``` +$ kubectl get secret --namespace default temporaltest-grafana -o jsonpath="{.data.admin-password}" | base64 --decode + +t7EqZQpiB6BztZV321dEDppXbeisdpiEAMgnu6yy% +``` + +2. Setup port forwarding, so you can access Grafana from your host: + +``` +$ kubectl port-forward services/temporaltest-grafana 8081:80 +Forwarding from 127.0.0.1:8081 -> 3000 +Forwarding from [::1]:8081 -> 3000 +... +``` + +3. Navigate to the forwarded Grafana port in your browser (http://localhost:8081/), login as `admin` (using the password from step 1), and click on the "Home" button (upper left corner) to see available dashboards. + +### Updating Dynamic Configs +By default dynamic config is empty, if you want to override some properties for your cluster, you should: +1. Create a yaml file with your config (for example dc.yaml). +2. Populate it with some values under server.dynamicConfig prefix (use the sample provided at `values/values.dynamic_config.yaml` as a starting point) +3. Install your helm configuration: +```bash +$ helm install -f values/values.dynamic_config.yaml temporaltest . --timeout 900s +``` +Note that if you already have a running cluster you can use the "helm upgrade" command to change dynamic config values: +```bash +$ helm upgrade -f values/values.dynamic_config.yaml temporaltest . --timeout 900s +``` + +WARNING: The "helm upgrade" approach will trigger a rolling upgrade of all the pods. + +If a rolling upgrade is not desirable, you can also generate the ConfigMap file explicitly and then apply it using the following command: + +```bash +$ kubectl apply -f dynamicconfigmap.yaml +``` +You can use helm upgrade with the "--dry-run" option to generate the content for the dynamicconfigmap.yaml. + +The dynamic-config ConfigMap is referenced as a mounted volume within the Temporal Containers, so any applied change will be automatically picked up by all pods within a few minutes without the need for pod recycling. See k8S documentation (https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#mounted-configmaps-are-updated-automatically) for more details on how this works. + +### Updating Temporal Web Config +the config file `server/config.yml` for the temporal web ui is referenced as a mounted volume within the Temporal Web UI Container and can be populated by inserting values in the `web.config` section in the `values.yml` for possible config check (https://github.com/temporalio/web#configuring-authentication-optional) + +## Uninstalling + +Note: in this example chart, uninstalling a Temporal instance also removes all the data that might have been created during its lifetime. + +```bash +~/temporal-helm $ helm uninstall temporaltest +``` + +## Upgrading + +To upgrade your cluster, upgrade your database schema (if the release includes schema changes), and then use `helm upgrade` command to perform a rolling upgrade of your installation. + +Note: +* Not supported: running newer binaries with an older schema. +* Supported: downgrading binaries – running older binaries with a newer schema. + +Example: + +### Upgrade Schema + +Here are examples of commands you can use to upgrade the "default" and "visibility" schemas in your "bring your own" Cassandra database. + +Upgrade default schema: + +``` +temporal_v1.2.1 $ temporal-cassandra-tool \ + --tls \ + --tls-ca-file ... \ + --user cassandra-user \ + --password cassandra-password \ + --endpoint cassandra.example.com \ + --keyspace temporal \ + --timeout 120 \ + update \ + --schema-dir ./schema/cassandra/temporal/versioned +``` + +Upgrade visibility schema: + +``` +temporal_v1.2.1 $ temporal-cassandra-tool \ + --tls \ + --tls-ca-file ... \ + --user cassandra-user \ + --password cassandra-password \ + --endpoint cassandra.example.com \ + --keyspace temporal_visibility \ + --timeout 120 \ + update \ + --schema-dir ./schema/cassandra/visibility/versioned +``` + +To upgrade your MySQL database, please use `temporal-sql-tool` tool instead of `temporal-cassandra-tool`. + +### Upgrade Temporal Instance's Docker Images + +Here is an example of a `helm upgrade` command that can be used to upgrade a cluster: + +``` +helm-charts $ helm \ + upgrade \ + temporaltest \ + -f values/values.cassandra.yaml \ + --set elasticsearch.enabled=true \ + --set server.replicaCount=8 \ + --set server.config.persistence.default.cassandra.hosts='{c1.example.com,c2.example.com,c3.example.com}' \ + --set server.config.persistence.default.cassandra.user=cassandra-user \ + --set server.config.persistence.default.cassandra.password=cassandra-password \ + --set server.config.persistence.default.cassandra.tls.caData=... \ + --set server.config.persistence.default.cassandra.tls.enabled=true \ + --set server.config.persistence.default.cassandra.replicationFactor=3 \ + --set server.config.persistence.default.cassandra.keyspace=temporal \ + --set server.config.persistence.visibility.cassandra.hosts='{c1.example.com,c2.example.com,c3.example.com}' \ + --set server.config.persistence.visibility.cassandra.user=cassandra-user \ + --set server.config.persistence.visibility.cassandra.password=cassandra-password \ + --set server.config.persistence.visibility.cassandra.tls.caData=... \ + --set server.config.persistence.visibility.cassandra.tls.enabled=true \ + --set server.config.persistence.visibility.cassandra.replicationFactor=3 \ + --set server.config.persistence.visibility.cassandra.keyspace=temporal_visibility \ + --set server.image.tag=1.2.1 \ + --set server.image.repository=temporalio/server \ + --set admintools.image.tag=1.2.1 \ + --set admintools.image.repository=temporalio/admin-tools \ + --set web.image.tag=1.1.1 \ + --set web.image.repository=temporalio/web \ + . \ + --wait \ + --timeout 15m +``` + + +# Acknowledgements + +Many thanks to [Banzai Cloud](https://github.com/banzaicloud) whose [Cadence Helm Charts](https://github.com/banzaicloud/banzai-charts/tree/master/cadence) heavily inspired this work. + + +## License +[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Ftemporalio%2Ftemporal-helm-charts.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Ftemporalio%2Ftemporal-helm-charts?ref=badge_large) diff --git a/charts/temporal/templates/_helpers.tpl b/charts/temporal/templates/_helpers.tpl index 74b7d0a..dbf2146 100644 --- a/charts/temporal/templates/_helpers.tpl +++ b/charts/temporal/templates/_helpers.tpl @@ -206,6 +206,17 @@ Source: https://stackoverflow.com/a/52024583/3027614 {{- print "password" -}} {{- end -}} +{{- define "temporal.persistence.sql.database" -}} +{{- $global := index . 0 -}} +{{- $store := index . 1 -}} +{{- $storeConfig := index $global.Values.server.config.persistence $store -}} +{{- if $storeConfig.sql.database -}} +{{- $storeConfig.sql.database -}} +{{- else -}} +{{- required (printf "Please specify database for %s store" $store) -}} +{{- end -}} +{{- end -}} + {{- define "temporal.persistence.sql.driver" -}} {{- $global := index . 0 -}} {{- $store := index . 1 -}} diff --git a/charts/temporal/templates/admintools-deployment.yaml b/charts/temporal/templates/admintools-deployment.yaml index f269365..3de2099 100644 --- a/charts/temporal/templates/admintools-deployment.yaml +++ b/charts/temporal/templates/admintools-deployment.yaml @@ -31,6 +31,10 @@ spec: {{- with $.Values.admintools.podLabels }} {{- toYaml . | nindent 8 }} {{- end }} + {{- with $.Values.admintools.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} spec: {{ include "temporal.serviceAccount" . }} containers: @@ -42,8 +46,14 @@ spec: containerPort: 22 protocol: TCP env: + # TEMPORAL_CLI_ADDRESS is deprecated, use TEMPORAL_ADDRESS instead - name: TEMPORAL_CLI_ADDRESS value: {{ include "temporal.fullname" . }}-frontend:{{ include "temporal.frontend.grpcPort" . }} + - name: TEMPORAL_ADDRESS + value: {{ include "temporal.fullname" . }}-frontend:{{ include "temporal.frontend.grpcPort" . }} + {{- if .Values.admintools.additionalEnv }} + {{- toYaml .Values.admintools.additionalEnv | nindent 12 }} + {{- end }} livenessProbe: exec: command: @@ -51,6 +61,18 @@ spec: - / initialDelaySeconds: 5 periodSeconds: 5 + {{- with .Values.admintools.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.admintools.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.admintools.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} {{- with $.Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} diff --git a/charts/temporal/templates/server-configmap.yaml b/charts/temporal/templates/server-configmap.yaml index acd69e0..8abf0f0 100644 --- a/charts/temporal/templates/server-configmap.yaml +++ b/charts/temporal/templates/server-configmap.yaml @@ -19,9 +19,10 @@ data: persistence: defaultStore: {{ $.Values.server.config.persistence.defaultStore }} - visibilityStore: visibility {{- if or $.Values.elasticsearch.enabled $.Values.elasticsearch.external }} advancedVisibilityStore: es-visibility + {{- else }} + visibilityStore: visibility {{- end }} numHistoryShards: {{ $.Values.server.config.numHistoryShards }} datastores: @@ -38,11 +39,9 @@ data: {{- toYaml . | nindent 12 }} {{- end }} {{- end }} - {{- if $.Values.server.config.persistence.faultinjection}} - {{- if $.Values.server.config.persistence.faultinjection.rate }} + {{- with $.Values.server.config.persistence.default.faultInjection}} faultInjection: - rate: {{ $.Values.server.config.persistence.faultinjection.rate }} - {{- end }} + {{- toYaml . | nindent 12 }} {{- end }} {{- if eq (include "temporal.persistence.driver" (list $ "default")) "sql" }} sql: @@ -103,14 +102,30 @@ data: pprof: port: 7936 - + metrics: tags: type: {{ $service }} + {{- with $.Values.server.metrics.tags }} + {{- toYaml . | nindent 10 }} + {{- end }} + {{- if $.Values.server.config.prometheus }} + prometheus: + {{- with $.Values.server.config.prometheus }} + {{- toYaml . | nindent 10 }} + {{- end }} + {{- else }} prometheus: timerType: histogram listenAddress: "0.0.0.0:9090" + {{- end }} + {{- if $.Values.server.config.tls }} + tls: + {{- with $.Values.server.config.tls }} + {{- toYaml . | nindent 10 }} + {{- end }} + {{- end }} services: frontend: @@ -156,12 +171,35 @@ data: rpcAddress: "127.0.0.1:7933" {{- end }} + {{- if $.Values.server.config.dcRedirectionPolicy }} + dcRedirectionPolicy: + {{- with $.Values.server.config.dcRedirectionPolicy }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- else }} dcRedirectionPolicy: policy: "noop" toDC: "" + {{- end }} + {{- if $.Values.server.archival }} + archival: + {{- with $.Values.server.archival }} + {{- toYaml . | nindent 6 }} + {{- end }} + {{- else }} archival: status: "disabled" + {{- end }} + + {{- if $.Values.server.namespaceDefaults }} + namespaceDefaults: + {{- with $.Values.server.namespaceDefaults }} + {{- toYaml . | nindent 6 }} + {{- end }} + {{- else }} + + {{- end }} publicClient: hostPort: "{{ include "temporal.componentname" (list $ "frontend") }}:{{ $.Values.server.frontend.service.port }}" diff --git a/charts/temporal/templates/server-deployment.yaml b/charts/temporal/templates/server-deployment.yaml index ffc8f36..8c23e20 100644 --- a/charts/temporal/templates/server-deployment.yaml +++ b/charts/temporal/templates/server-deployment.yaml @@ -47,9 +47,10 @@ spec: {{ include "temporal.serviceAccount" $ }} {{- if or $.Values.cassandra.enabled (or $.Values.elasticsearch.enabled $.Values.elasticsearch.external)}} {{- if semverCompare ">=1.13.0" $.Chart.AppVersion}} + {{- with $.Values.server.securityContext }} securityContext: - fsGroup: 1000 #temporal group - runAsUser: 1000 #temporal user + {{- toYaml . | nindent 8 }} + {{- end }} {{- end }} initContainers: {{- if $.Values.cassandra.enabled }} @@ -73,7 +74,7 @@ spec: - name: check-elasticsearch-index image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}" imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }} - command: ['sh', '-c', 'until curl --silent --fail --user {{ $.Values.elasticsearch.username }}:{{ $.Values.elasticsearch.password }} {{ $.Values.elasticsearch.scheme }}://{{ $.Values.elasticsearch.host }}:{{ $.Values.elasticsearch.port }}/{{ $.Values.elasticsearch.visibilityIndex }} 2>&1 > /dev/null; do echo waiting for elasticsearch index to become ready; sleep 1; done;'] + command: ['sh', '-c', 'until curl --silent --fail {{- if and $.Values.elasticsearch.username $.Values.elasticsearch.password }} --user {{ $.Values.elasticsearch.username }}:{{ $.Values.elasticsearch.password }} {{- end }} {{ $.Values.elasticsearch.scheme }}://{{ $.Values.elasticsearch.host }}:{{ $.Values.elasticsearch.port }}/{{ $.Values.elasticsearch.visibilityIndex }} 2>&1 > /dev/null; do echo waiting for elasticsearch index to become ready; sleep 1; done;'] {{- end }} {{- end }} containers: @@ -117,6 +118,9 @@ spec: - name: TEMPORAL_VERSION_CHECK_DISABLED value: "1" {{- end }} + {{- if or $.Values.server.additionalEnv $serviceValues.additionalEnv }} + {{- toYaml (default $.Values.server.additionalEnv $serviceValues.additionalEnv) | nindent 12 }} + {{- end }} ports: - name: rpc containerPort: {{ include (printf "temporal.%s.grpcPort" $service) $ }} @@ -137,14 +141,17 @@ spec: - name: dynamic-config mountPath: /etc/temporal/dynamic_config {{- if $.Values.server.additionalVolumeMounts }} - {{- toYaml $.Values.server.additionalVolumeMounts | nindent 12}} + {{- toYaml $.Values.server.additionalVolumeMounts | nindent 12}} {{- end }} resources: {{- toYaml (default $.Values.server.resources $serviceValues.resources) | nindent 12 }} + {{- with $serviceValues.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} {{- if $.Values.server.sidecarContainers }} {{- toYaml $.Values.server.sidecarContainers | nindent 8 }} {{- end }} - {{- with $.Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} @@ -160,7 +167,7 @@ spec: - key: dynamic_config.yaml path: dynamic_config.yaml {{- if $.Values.server.additionalVolumes }} - {{- toYaml $.Values.server.additionalVolumes | nindent 8}} + {{- toYaml $.Values.server.additionalVolumes | nindent 8}} {{- end }} {{- with (default $.Values.server.nodeSelector $serviceValues.nodeSelector) }} nodeSelector: @@ -174,6 +181,10 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- with $serviceValues.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} --- {{- end }} {{- end }} diff --git a/charts/temporal/templates/server-hpa.yaml b/charts/temporal/templates/server-hpa.yaml deleted file mode 100644 index f4e2d79..0000000 --- a/charts/temporal/templates/server-hpa.yaml +++ /dev/null @@ -1,40 +0,0 @@ -{{- if $.Values.server.enabled }} -{{- if $.Values.server.autoscaling.enabled }} -{{- range $service := (list "frontend" "history" "matching" "worker") }} -{{- $serviceValues := index $.Values.server $service -}} -apiVersion: autoscaling/v2beta1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "temporal.componentname" (list $ $service) }} - labels: - app.kubernetes.io/name: {{ include "temporal.name" $ }} - helm.sh/chart: {{ include "temporal.chart" $ }} - app.kubernetes.io/managed-by: {{ $.Release.Service }} - app.kubernetes.io/instance: {{ $.Release.Name }} - app.kubernetes.io/version: {{ $.Chart.AppVersion | replace "+" "_" }} - app.kubernetes.io/component: {{ $service }} - app.kubernetes.io/part-of: {{ $.Chart.Name }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "temporal.componentname" (list $ $service) }} - minReplicas: {{ $serviceValues.autoscaling.minReplicas }} - maxReplicas: {{ $serviceValues.autoscaling.maxReplicas }} - metrics: - {{- if $serviceValues.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - targetAverageUtilization: {{ $serviceValues.autoscaling.targetCPUUtilizationPercentage }} - {{- end }} - {{- if $serviceValues.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - targetAverageUtilization: {{ $serviceValues.autoscaling.targetMemoryUtilizationPercentage }} - {{- end }} ---- -{{- end }} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/temporal/templates/server-job.yaml b/charts/temporal/templates/server-job.yaml index 7459ace..77c5e9b 100644 --- a/charts/temporal/templates/server-job.yaml +++ b/charts/temporal/templates/server-job.yaml @@ -55,7 +55,7 @@ spec: - name: create-{{ $store }}-store image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}" imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }} - command: ['sh', '-c', 'temporal-cassandra-tool create -k {{ $storeConfig.cassandra.keyspace }} --replication-factor {{ $storeConfig.cassandra.replicationFactor }}'] + command: ['temporal-cassandra-tool', 'create', '-k', '{{ $storeConfig.cassandra.keyspace }}', '--replication-factor', '{{ $storeConfig.cassandra.replicationFactor }}'] env: - name: CASSANDRA_HOST value: {{ first (splitList "," (include "temporal.persistence.cassandra.hosts" (list $ $store))) }} @@ -80,6 +80,38 @@ spec: {{- end }} {{- end }} {{- end }} + {{- else if or (eq (include "temporal.persistence.driver" (list $ "default")) "sql") (eq (include "temporal.persistence.driver" (list $ "visibility")) "sql") }} + {{- range $store := (list "default" "visibility") }} + {{- $storeConfig := index $.Values.server.config.persistence $store }} + {{- if eq (include "temporal.persistence.driver" (list $ $store)) "sql" }} + - name: create-{{ $store }}-store + image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}" + imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }} + command: ['temporal-sql-tool', '--database', '{{ include "temporal.persistence.sql.database" (list $ $store) }}', 'create-database'] + env: + - name: SQL_PLUGIN + value: {{ include "temporal.persistence.sql.driver" (list $ $store) }} + - name: SQL_HOST + value: {{ include "temporal.persistence.sql.host" (list $ $store) }} + - name: SQL_PORT + value: {{ include "temporal.persistence.sql.port" (list $ $store) | quote }} + {{- if $storeConfig.sql.user }} + - name: SQL_USER + value: {{ $storeConfig.sql.user }} + {{- end }} + {{- if (or $storeConfig.sql.password $storeConfig.sql.existingSecret) }} + - name: SQL_PASSWORD + {{- if $storeConfig.sql.existingSecret }} + valueFrom: + secretKeyRef: + name: {{ include "temporal.persistence.secretName" (list $ $store) }} + key: {{ include "temporal.persistence.secretKey" (list $ $store) }} + {{- else }} + value: {{ $storeConfig.sql.password }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} {{- else }} [] {{- end }} @@ -89,7 +121,7 @@ spec: - name: {{ $store }}-schema image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}" imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }} - command: ["temporal-{{ include "temporal.persistence.driver" (list $ $store) }}-tool", "setup-schema", "-v", "0.0"] + command: ['temporal-{{ include "temporal.persistence.driver" (list $ $store) }}-tool', 'setup-schema', '-v', '0.0'] env: {{- if eq (include "temporal.persistence.driver" (list $ $store)) "cassandra" }} - name: CASSANDRA_HOST @@ -113,8 +145,44 @@ spec: value: {{ $storeConfig.cassandra.password }} {{- end }} {{- end }} + {{- else if eq (include "temporal.persistence.driver" (list $ $store)) "sql" }} + - name: SQL_PLUGIN + value: {{ include "temporal.persistence.sql.driver" (list $ $store) }} + - name: SQL_HOST + value: {{ include "temporal.persistence.sql.host" (list $ $store) }} + - name: SQL_PORT + value: {{ include "temporal.persistence.sql.port" (list $ $store) | quote }} + - name: SQL_DATABASE + value: {{ include "temporal.persistence.sql.database" (list $ $store) }} + {{- if $storeConfig.sql.user }} + - name: SQL_USER + value: {{ $storeConfig.sql.user }} + {{- end }} + {{- if (or $storeConfig.sql.password $storeConfig.sql.existingSecret) }} + - name: SQL_PASSWORD + {{- if $storeConfig.sql.existingSecret }} + valueFrom: + secretKeyRef: + name: {{ include "temporal.persistence.secretName" (list $ $store) }} + key: {{ include "temporal.persistence.secretKey" (list $ $store) }} + {{- else }} + value: {{ $storeConfig.sql.password }} + {{- end }} + {{- end }} {{- end }} {{- end }} + {{- with .Values.schema.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.schema.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.schema.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} {{- with $.Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} @@ -191,7 +259,15 @@ spec: image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}" imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }} {{- if eq (include "temporal.persistence.driver" (list $ $store)) "cassandra" }} - command: ['sh', '-c', 'temporal-cassandra-tool update-schema -d /etc/temporal/schema/cassandra/{{ include "temporal.persistence.schema" $store }}/versioned'] + command: ['temporal-{{ include "temporal.persistence.driver" (list $ $store) }}-tool', 'update-schema', '--schema-dir', '/etc/temporal/schema/cassandra/{{ include "temporal.persistence.schema" $store }}/versioned'] + {{- else if eq (include "temporal.persistence.sql.driver" (list $ $store)) "mysql" }} + command: ['temporal-{{ include "temporal.persistence.driver" (list $ $store) }}-tool', 'update-schema', '--schema-dir', '/etc/temporal/schema/mysql/v57/{{ include "temporal.persistence.schema" $store }}/versioned'] + {{- else if eq (include "temporal.persistence.sql.driver" (list $ $store)) "mysql8" }} + command: ['temporal-{{ include "temporal.persistence.driver" (list $ $store) }}-tool', 'update-schema', '--schema-dir', '/etc/temporal/schema/mysql/v8/{{ include "temporal.persistence.schema" $store }}/versioned'] + {{- else if eq (include "temporal.persistence.sql.driver" (list $ $store)) "postgres" }} + command: ['temporal-{{ include "temporal.persistence.driver" (list $ $store) }}-tool', 'update-schema', '--schema-dir', '/etc/temporal/schema/postgresql/v96/{{ include "temporal.persistence.schema" $store }}/versioned'] + {{- else if eq (include "temporal.persistence.sql.driver" (list $ $store)) "postgres12" }} + command: ['temporal-{{ include "temporal.persistence.driver" (list $ $store) }}-tool', 'update-schema', '--schema-dir', '/etc/temporal/schema/postgresql/v12/{{ include "temporal.persistence.schema" $store }}/versioned'] {{- end }} env: {{- if eq (include "temporal.persistence.driver" (list $ $store)) "cassandra" }} @@ -216,8 +292,44 @@ spec: value: {{ $storeConfig.cassandra.password }} {{- end }} {{- end }} + {{- else if eq (include "temporal.persistence.driver" (list $ $store)) "sql" }} + - name: SQL_PLUGIN + value: {{ include "temporal.persistence.sql.driver" (list $ $store) }} + - name: SQL_HOST + value: {{ include "temporal.persistence.sql.host" (list $ $store) }} + - name: SQL_PORT + value: {{ include "temporal.persistence.sql.port" (list $ $store) | quote }} + - name: SQL_DATABASE + value: {{ include "temporal.persistence.sql.database" (list $ $store) }} + {{- if $storeConfig.sql.user }} + - name: SQL_USER + value: {{ $storeConfig.sql.user }} + {{- end }} + {{- if (or $storeConfig.sql.password $storeConfig.sql.existingSecret) }} + - name: SQL_PASSWORD + {{- if $storeConfig.sql.existingSecret }} + valueFrom: + secretKeyRef: + name: {{ include "temporal.persistence.secretName" (list $ $store) }} + key: {{ include "temporal.persistence.secretKey" (list $ $store) }} + {{- else }} + value: {{ $storeConfig.sql.password }} + {{- end }} + {{- end }} {{- end }} {{- end }} + {{- with .Values.schema.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.schema.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.schema.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} {{- with (default $.Values.admintools.nodeSelector) }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -232,7 +344,7 @@ spec: {{- end }} --- {{- end }} -{{- if or $.Values.elasticsearch.enabled $.Values.elasticsearch.external }} +{{- if and (or $.Values.elasticsearch.enabled $.Values.elasticsearch.external) .Values.schema.setup.enabled }} apiVersion: batch/v1 kind: Job metadata: @@ -272,21 +384,30 @@ spec: {{ include "temporal.serviceAccount" . }} restartPolicy: "OnFailure" initContainers: - - name: check-elasticsearch-service - image: busybox - command: ['sh', '-c', 'until nslookup {{ .Values.elasticsearch.host }}; do echo waiting for elasticsearch service; sleep 1; done;'] - name: check-elasticsearch image: "{{ .Values.admintools.image.repository }}:{{ .Values.admintools.image.tag }}" imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }} - command: ['sh', '-c', 'until curl --silent --fail --user {{ .Values.elasticsearch.username }}:{{ .Values.elasticsearch.password }} {{ .Values.elasticsearch.scheme }}://{{ .Values.elasticsearch.host }}:{{ .Values.elasticsearch.port }} 2>&1 > /dev/null; do echo waiting for elasticsearch to start; sleep 1; done;'] + command: ['sh', '-c', 'until curl --silent --fail {{- if and .Values.elasticsearch.username .Values.elasticsearch.password }} --user {{ .Values.elasticsearch.username }}:{{ .Values.elasticsearch.password }} {{- end }} {{ .Values.elasticsearch.scheme }}://{{ .Values.elasticsearch.host }}:{{ .Values.elasticsearch.port }} 2>&1 > /dev/null; do echo waiting for elasticsearch to start; sleep 1; done;'] containers: - name: create-elasticsearch-index image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}" imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }} command: ['sh', '-c'] args: - - 'curl -X PUT --fail --user {{ .Values.elasticsearch.username }}:{{ .Values.elasticsearch.password }} {{ .Values.elasticsearch.scheme }}://{{ .Values.elasticsearch.host }}:{{ .Values.elasticsearch.port }}/_template/temporal_visibility_v1_template -H "Content-Type: application/json" --data-binary "@schema/elasticsearch/visibility/index_template_{{ .Values.elasticsearch.version }}.json" 2>&1 && - curl -X PUT --fail --user {{ .Values.elasticsearch.username }}:{{ .Values.elasticsearch.password }} {{ .Values.elasticsearch.scheme }}://{{ .Values.elasticsearch.host }}:{{ .Values.elasticsearch.port }}/{{ .Values.elasticsearch.visibilityIndex }} 2>&1' + - 'curl -X PUT --fail {{- if and .Values.elasticsearch.username .Values.elasticsearch.password }} --user {{ .Values.elasticsearch.username }}:{{ .Values.elasticsearch.password }} {{- end }} {{ .Values.elasticsearch.scheme }}://{{ .Values.elasticsearch.host }}:{{ .Values.elasticsearch.port }}/_template/temporal_visibility_v1_template -H "Content-Type: application/json" --data-binary "@schema/elasticsearch/visibility/index_template_{{ .Values.elasticsearch.version }}.json" 2>&1 && + curl -X PUT --fail {{- if and .Values.elasticsearch.username .Values.elasticsearch.password }} --user {{ .Values.elasticsearch.username }}:{{ .Values.elasticsearch.password }} {{- end }} {{ .Values.elasticsearch.scheme }}://{{ .Values.elasticsearch.host }}:{{ .Values.elasticsearch.port }}/{{ .Values.elasticsearch.visibilityIndex }} 2>&1' + {{- with .Values.schema.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.schema.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.schema.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} {{- with (default $.Values.admintools.nodeSelector) }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/temporal/templates/server-pdb.yaml b/charts/temporal/templates/server-pdb.yaml new file mode 100644 index 0000000..4371372 --- /dev/null +++ b/charts/temporal/templates/server-pdb.yaml @@ -0,0 +1,27 @@ +{{- if $.Values.server.enabled }} +{{- range $service := (list "frontend" "history" "matching" "worker") }} +{{- $serviceValues := index $.Values.server $service -}} +{{- if and (gt ($serviceValues.replicaCount | int) 1) ($serviceValues.podDisruptionBudget) }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "temporal.componentname" (list $ $service) }}-pdb + labels: + app.kubernetes.io/name: {{ include "temporal.name" $ }} + helm.sh/chart: {{ include "temporal.chart" $ }} + app.kubernetes.io/managed-by: {{ $.Release.Service }} + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/version: {{ $.Chart.AppVersion | replace "+" "_" }} + app.kubernetes.io/component: {{ $service }} + app.kubernetes.io/part-of: {{ $.Chart.Name }} +spec: + {{ toYaml $serviceValues.podDisruptionBudget }} + selector: + matchLabels: + app.kubernetes.io/name: {{ include "temporal.name" $ }} + app.kubernetes.io/instance: {{ $.Release.Name }} + app.kubernetes.io/component: {{ $service }} +{{- end }} +--- +{{- end }} +{{- end }} diff --git a/charts/temporal/templates/server-secret.yaml b/charts/temporal/templates/server-secret.yaml index 5d8c026..55f16a6 100644 --- a/charts/temporal/templates/server-secret.yaml +++ b/charts/temporal/templates/server-secret.yaml @@ -16,6 +16,13 @@ metadata: app.kubernetes.io/instance: {{ $.Release.Name }} app.kubernetes.io/version: {{ $.Chart.AppVersion | replace "+" "_" }} app.kubernetes.io/part-of: {{ $.Chart.Name }} + {{- with $.Values.server.secretLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $.Values.server.secretAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} type: Opaque data: {{- if eq (include "temporal.persistence.driver" (list $ $store)) "cassandra" }} diff --git a/charts/temporal/templates/web-deployment.yaml b/charts/temporal/templates/web-deployment.yaml index 67e647f..df01029 100644 --- a/charts/temporal/templates/web-deployment.yaml +++ b/charts/temporal/templates/web-deployment.yaml @@ -41,6 +41,9 @@ spec: - name: {{ .Chart.Name }}-web-config configMap: name: {{ include "temporal.componentname" (list . "web") }}-config + {{- if .Values.web.additionalVolumes }} + {{- toYaml .Values.web.additionalVolumes | nindent 8 }} + {{- end }} containers: - name: {{ .Chart.Name }}-web image: "{{ .Values.web.image.repository }}:{{ .Values.web.image.tag }}" @@ -48,12 +51,27 @@ spec: env: - name: TEMPORAL_ADDRESS value: "{{ include "temporal.fullname" . }}-frontend.{{ .Release.Namespace }}.svc:{{ .Values.server.frontend.service.port }}" + {{- if .Values.web.additionalEnv }} + {{- toYaml .Values.web.additionalEnv | nindent 12 }} + {{- end }} ports: - name: http containerPort: 8080 protocol: TCP resources: {{- toYaml .Values.web.resources | nindent 12 }} + {{- with .Values.web.containerSecurityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.web.additionalVolumeMounts }} + volumeMounts: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.web.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} {{- with .Values.web.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/temporal/templates/web-ingress.yaml b/charts/temporal/templates/web-ingress.yaml index 4a337a4..68c52cd 100644 --- a/charts/temporal/templates/web-ingress.yaml +++ b/charts/temporal/templates/web-ingress.yaml @@ -22,6 +22,9 @@ metadata: {{ toYaml . | indent 4 }} {{- end }} spec: + {{- with .Values.web.ingress.className }} + ingressClassName: {{ . | quote }} + {{- end }} {{- if .Values.web.ingress.tls }} tls: {{- range .Values.web.ingress.tls }} diff --git a/charts/temporal/values.yaml b/charts/temporal/values.yaml index 8d4b6d9..247ce2e 100644 --- a/charts/temporal/values.yaml +++ b/charts/temporal/values.yaml @@ -18,10 +18,10 @@ serviceAccount: server: enabled: true - sidecarContainers: + sidecarContainers: {} image: - repository: ghcr.io/kube-tarian/helmrepo-supporting-tools/server - tag: 1.17.5 + repository: temporalio/server + tag: 1.22.1 pullPolicy: IfNotPresent # Global default settings (can be overridden per service) @@ -31,6 +31,8 @@ server: # Use this if you installed Prometheus from a Helm chart. annotations: enabled: true + # Additional tags to be added to Prometheus metrics + tags: {} # Enable Prometheus ServiceMonitor # Use this if you installed the Prometheus Operator (https://github.com/coreos/prometheus-operator). serviceMonitor: @@ -63,98 +65,73 @@ server: timerType: histogram podAnnotations: {} podLabels: {} - resources: - limits: - cpu: 100m - memory: 128Mi - requests: - cpu: 100m - memory: 128Mi + secretLabels: {} + secretAnnotations: {} + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi nodeSelector: {} tolerations: [] affinity: {} additionalVolumes: [] additionalVolumeMounts: [] - autoscaling: - enabled: true - minReplicas: 2 - maxReplicas: 5 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 + additionalEnv: [] + securityContext: + fsGroup: 1000 + runAsUser: 1000 config: logLevel: "debug,info" - - # IMPORTANT: This value cannot be changed, once it's set. numHistoryShards: 512 - persistence: defaultStore: default - additionalStores: {} - default: - driver: "cassandra" - - cassandra: - hosts: ["temporal-temporal-service"] - port: 9042 - keyspace: "temporal" - user: "temporal-superuser" - existingSecret: "temporal-superuser" - replicationFactor: 3 - consistency: - default: - consistency: "local_quorum" - serialConsistency: "local_serial" - # datacenter: "us-east-1a" - # maxQPS: 1000 - # maxConns: 2 + driver: "sql" sql: - driver: "mysql" - host: "mysql" - port: 3306 - database: "temporal" - user: "temporal" - password: "temporal" - existingSecret: "" - secretName: "" + driver: "postgres" + host: postgres-postgresql + port: 5432 + database: temporal + user: temporal + existingSecret: postgres-postgresql + # password: + # for a production deployment use this instead of `password` and provision the secret beforehand e.g. with a sealed secret + # it has a single key called `password` maxConns: 20 maxConnLifetime: "1h" - # connectAttributes: - # tx_isolation: 'READ-COMMITTED' + # tls: + # enabled: true + # enableHostVerification: true + # serverName: _HOST_ # this is strictly required when using serverless CRDB offerings visibility: - driver: "cassandra" - - cassandra: - hosts: ["temporal-temporal-service"] - port: 9042 - keyspace: "temporal_visibility" - user: "temporal-superuser" - existingSecret: "temporal-superuser" - # datacenter: "us-east-1a" - # maxQPS: 1000 - # maxConns: 2 - replicationFactor: 3 - consistency: - default: - consistency: "local_quorum" - serialConsistency: "local_serial" + driver: "sql" sql: - driver: "mysql" - host: "mysql" - port: 3306 - database: "temporal_visibility" - user: "temporal" - password: "temporal" - existingSecret: "" - secretName: "" + driver: "postgres" + host: postgres-postgresql + port: 5432 + database: temporal_visibility + user: temporal + existingSecret: postgres-postgresql + # password: + # for a production deployment use this instead of `password` and provision the secret beforehand e.g. with a sealed secret + # it has a single key called `password` maxConns: 20 maxConnLifetime: "1h" - # connectAttributes: - # tx_isolation: 'READ-COMMITTED' + # tls: + # enabled: true + # enableHostVerification: true + # serverName: _HOST_ # this is strictly required when using serverless CRDB offerings frontend: replicaCount: 2 @@ -165,28 +142,20 @@ server: metrics: annotations: enabled: true - serviceMonitor: + serviceMonitor: enabled: true prometheus: {} # timerType: histogram podAnnotations: {} podLabels: {} - resources: - limits: - cpu: 100m - memory: 128Mi - requests: - cpu: 100m - memory: 128Mi + resources: {} nodeSelector: {} tolerations: [] affinity: {} - autoscaling: - enabled: true - minReplicas: 2 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 + additionalEnv: [] + containerSecurityContext: {} + topologySpreadConstraints: {} + podDisruptionBudget: {} history: replicaCount: 2 @@ -196,28 +165,20 @@ server: metrics: annotations: enabled: true - serviceMonitor: + serviceMonitor: enabled: true prometheus: {} # timerType: histogram podAnnotations: {} podLabels: {} - resources: - limits: - cpu: 200m - memory: 256Mi - requests: - cpu: 200m - memory: 256Mi + resources: {} nodeSelector: {} tolerations: [] affinity: {} - autoscaling: - enabled: true - minReplicas: 1 - maxReplicas: 5 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 + additionalEnv: [] + containerSecurityContext: {} + topologySpreadConstraints: {} + podDisruptionBudget: {} matching: replicaCount: 2 @@ -233,22 +194,14 @@ server: # timerType: histogram podAnnotations: {} podLabels: {} + resources: {} nodeSelector: {} - resources: - limits: - cpu: 100m - memory: 128Mi - requests: - cpu: 100m - memory: 128Mi tolerations: [] affinity: {} - autoscaling: - enabled: true - minReplicas: 2 - maxReplicas: 5 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 + additionalEnv: [] + containerSecurityContext: {} + topologySpreadConstraints: {} + podDisruptionBudget: {} worker: replicaCount: 3 @@ -264,28 +217,20 @@ server: # timerType: histogram podAnnotations: {} podLabels: {} - resources: - limits: - cpu: 100m - memory: 128Mi - requests: - cpu: 100m - memory: 128Mi + resources: {} nodeSelector: {} tolerations: [] affinity: {} - autoscaling: - enabled: true - minReplicas: 2 - maxReplicas: 5 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 + additionalEnv: [] + containerSecurityContext: {} + topologySpreadConstraints: {} + podDisruptionBudget: {} admintools: enabled: true image: - repository: ghcr.io/kube-tarian/helmrepo-supporting-tools/admin-tools - tag: 1.17.5 + repository: temporalio/admin-tools + tag: 1.22.1 pullPolicy: IfNotPresent service: @@ -293,12 +238,18 @@ admintools: port: 22 annotations: {} podLabels: {} + podAnnotations: {} nodeSelector: {} tolerations: [] affinity: {} + additionalEnv: [] + resources: {} + containerSecurityContext: {} + securityContext: {} + podDisruptionBudget: {} web: - enabled: true + enabled: false config: # server/config.yml file content auth: @@ -307,12 +258,11 @@ web: default_to_namespace: # internal use only issue_report_link: https://github.com/temporalio/web/issues/new/choose # set this field if you need to direct people to internal support forums - replicaCount: 1 image: - repository: ghcr.io/kube-tarian/helmrepo-supporting-tools/ui - tag: latest + repository: temporalio/ui + tag: 2.16.2 pullPolicy: IfNotPresent service: @@ -325,6 +275,7 @@ web: ingress: enabled: false + # className: annotations: {} # kubernetes.io/ingress.class: traefik # ingress.kubernetes.io/ssl-redirect: "false" @@ -341,17 +292,33 @@ web: podAnnotations: {} podLabels: {} - resources: - limits: - cpu: 100m - memory: 128Mi - requests: - cpu: 100m - memory: 128Mi + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + nodeSelector: {} + tolerations: [] + affinity: {} + additionalVolumes: [] + additionalVolumeMounts: [] + + additionalEnv: [] + + containerSecurityContext: {} + + securityContext: {} + schema: setup: enabled: true @@ -359,13 +326,16 @@ schema: update: enabled: true backoffLimit: 100 + resources: {} + containerSecurityContext: {} + securityContext: {} elasticsearch: enabled: false replicas: 3 persistence: enabled: false - imageTag: 7.16.2 + imageTag: 7.17.3 host: elasticsearch-master-headless scheme: http port: 9200 @@ -393,56 +363,56 @@ grafana: dashboardproviders.yaml: apiVersion: 1 providers: - - name: 'default' - orgId: 1 - folder: '' - type: file - disableDeletion: false - editable: true - options: - path: /var/lib/grafana/dashboards/default + - name: "default" + orgId: 1 + folder: "" + type: file + disableDeletion: false + editable: true + options: + path: /var/lib/grafana/dashboards/default datasources: - datasources.yaml: - apiVersion: 1 - datasources: - - name: TemporalMetrics - type: prometheus - url: http://{{ .Release.Name }}-prometheus-server - access: proxy - isDefault: true + datasources.yaml: + apiVersion: 1 + datasources: + - name: TemporalMetrics + type: prometheus + url: http://{{ .Release.Name }}-prometheus-server + access: proxy + isDefault: true dashboards: - default: - server-general-github: - url: https://raw.githubusercontent.com/temporalio/dashboards/helm/server/server-general.json - datasource: TemporalMetrics - sdk-general-github: - url: https://raw.githubusercontent.com/temporalio/dashboards/helm/sdk/sdk-general.json - datasource: TemporalMetrics - misc-advanced-visibility-specific-github: - url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/advanced-visibility-specific.json - datasource: TemporalMetrics - misc-clustermonitoring-kubernetes-github: - url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/clustermonitoring-kubernetes.json - datasource: TemporalMetrics - misc-frontend-service-specific-github: - url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/frontend-service-specific.json - datasource: TemporalMetrics - misc-history-service-specific-github: - url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/history-service-specific.json - datasource: TemporalMetrics - misc-matching-service-specific-github: - url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/matching-service-specific.json - datasource: TemporalMetrics - misc-worker-service-specific-github: - url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/worker-service-specific.json - datasource: TemporalMetrics + default: + server-general-github: + url: https://raw.githubusercontent.com/temporalio/dashboards/helm/server/server-general.json + datasource: TemporalMetrics + sdk-general-github: + url: https://raw.githubusercontent.com/temporalio/dashboards/helm/sdk/sdk-general.json + datasource: TemporalMetrics + misc-advanced-visibility-specific-github: + url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/advanced-visibility-specific.json + datasource: TemporalMetrics + misc-clustermonitoring-kubernetes-github: + url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/clustermonitoring-kubernetes.json + datasource: TemporalMetrics + misc-frontend-service-specific-github: + url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/frontend-service-specific.json + datasource: TemporalMetrics + misc-history-service-specific-github: + url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/history-service-specific.json + datasource: TemporalMetrics + misc-matching-service-specific-github: + url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/matching-service-specific.json + datasource: TemporalMetrics + misc-worker-service-specific-github: + url: https://raw.githubusercontent.com/temporalio/dashboards/helm/misc/worker-service-specific.json + datasource: TemporalMetrics cassandra: enabled: false persistence: enabled: false image: - repo: ghcr.io/kube-tarian/helmrepo-supporting-tools/cassandra + repo: cassandra tag: 3.11.3 pullPolicy: IfNotPresent config: diff --git a/charts/temporal/values/values.archival.filestore.yaml b/charts/temporal/values/values.archival.filestore.yaml new file mode 100644 index 0000000..c4693d1 --- /dev/null +++ b/charts/temporal/values/values.archival.filestore.yaml @@ -0,0 +1,25 @@ +server: + archival: + history: + state: "enabled" + enableRead: true + provider: + filestore: + fileMode: "0666" + dirMode: "0766" + visibility: + state: "enabled" + enableRead: true + provider: + filestore: + fileMode: "0666" + dirMode: "0766" + + namespaceDefaults: + archival: + history: + state: "enabled" + URI: "file:///tmp/temporal_archival/development" + visibility: + state: "enabled" + URI: "file:///tmp/temporal_vis_archival/development" \ No newline at end of file diff --git a/charts/temporal/values/values.archival.gcloud.yaml b/charts/temporal/values/values.archival.gcloud.yaml new file mode 100644 index 0000000..e6f3511 --- /dev/null +++ b/charts/temporal/values/values.archival.gcloud.yaml @@ -0,0 +1,23 @@ +server: + archival: + history: + state: "enabled" + enableRead: true + provider: + gstorage: + credentialsPath: "/tmp/keyfile.json" + visibility: + state: "enabled" + enableRead: true + provider: + gstorage: + credentialsPath: "/tmp/keyfile.json" + + namespaceDefaults: + archival: + history: + state: "enabled" + URI: "gs://my-bucket-cad/temporal_archival/development" + visibility: + state: "enabled" + URI: "gs://my-bucket-cad/temporal_archival/visibility" \ No newline at end of file diff --git a/charts/temporal/values/values.archival.s3.yaml b/charts/temporal/values/values.archival.s3.yaml new file mode 100644 index 0000000..8a62c5d --- /dev/null +++ b/charts/temporal/values/values.archival.s3.yaml @@ -0,0 +1,23 @@ +server: + archival: + history: + state: "enabled" + enableRead: true + provider: + s3store: + region: "us-east-1" + visibility: + state: "enabled" + enableRead: true + provider: + s3store: + region: "us-east-1" + + namespaceDefaults: + archival: + history: + state: "enabled" + URI: "s3://archival-bucket-name" + visibility: + state: "enabled" + URI: "s3://visibility-archival-bucket-name" \ No newline at end of file diff --git a/charts/temporal/values/values.cassandra.yaml b/charts/temporal/values/values.cassandra.yaml index 81d053e..4163698 100644 --- a/charts/temporal/values/values.cassandra.yaml +++ b/charts/temporal/values/values.cassandra.yaml @@ -1,17 +1,39 @@ server: config: logLevel: "debug,info" + numHistoryShards: 512 + persistence: default: driver: "cassandra" + +# faultInjection: +# targets: +# dataStores: +# ExecutionStore: +# methods: +# GetCurrentExecution: +# errors: +# ResourceExhausted: 0.1 +# AppendHistoryNodes: +# errors: +# ResourceExhausted: 0.05 +# UpdateWorkflowExecution: +# errors: +# ResourceExhausted: 0.15 +# GetWorkflowExecution: +# errors: +# ResourceExhausted: 0.15 + cassandra: - hosts: ["temporal-temporal-service.k8ssandra-operator.svc.cluster.local"] + hosts: ["cassandra.default.svc.cluster.local"] port: 9042 keyspace: temporal - user: "temporal-superuser" - existingSecret: "temporal-superuser" - replicationFactor: 3 + user: "user" + password: "password" + existingSecret: "" + replicationFactor: 1 consistency: default: consistency: "local_quorum" @@ -21,12 +43,13 @@ server: driver: "cassandra" cassandra: - hosts: ["temporal-temporal-service.k8ssandra-operator.svc.cluster.local"] + hosts: ["cassandra.default.svc.cluster.local"] port: 9042 keyspace: temporal_visibility - user: "temporal-superuser" - existingSecret: "temporal-superuser" - replicationFactor: 3 + user: "user" + password: "password" + existingSecret: "" + replicationFactor: 1 consistency: default: consistency: "local_quorum" @@ -41,10 +64,8 @@ mysql: postgresql: enabled: false - -## set to true when the chart is set up for the first time, then set to false schema: setup: - enabled: true + enabled: false update: - enabled: true + enabled: false diff --git a/charts/temporal/values/values.postgresql.yaml b/charts/temporal/values/values.postgresql.yaml index 2460e1a..1c84bad 100644 --- a/charts/temporal/values/values.postgresql.yaml +++ b/charts/temporal/values/values.postgresql.yaml @@ -11,8 +11,15 @@ server: database: temporal user: _USERNAME_ password: _PASSWORD_ + # for a production deployment use this instead of `password` and provision the secret beforehand e.g. with a sealed secret + # it has a single key called `password` + # existingSecret: temporal-default-store maxConns: 20 maxConnLifetime: "1h" + # tls: + # enabled: true + # enableHostVerification: true + # serverName: _HOST_ # this is strictly required when using serverless CRDB offerings visibility: driver: "sql" @@ -24,8 +31,15 @@ server: database: temporal_visibility user: _USERNAME_ password: _PASSWORD_ + # for a production deployment use this instead of `password` and provision the secret beforehand e.g. with a sealed secret + # it has a single key called `password` + # existingSecret: temporal-visibility-store maxConns: 20 maxConnLifetime: "1h" + # tls: + # enabled: true + # enableHostVerification: true + # serverName: _HOST_ # this is strictly required when using serverless CRDB offerings cassandra: enabled: false @@ -36,6 +50,15 @@ mysql: postgresql: enabled: true +prometheus: + enabled: true + +grafana: + enabled: true + +elasticsearch: + enabled: true + schema: setup: enabled: false diff --git a/charts/temporal/values/values.prometheus.external.yaml b/charts/temporal/values/values.prometheus.external.yaml new file mode 100644 index 0000000..b70fef3 --- /dev/null +++ b/charts/temporal/values/values.prometheus.external.yaml @@ -0,0 +1,28 @@ +prometheus: + alertmanager: + enabled: false + alertmanagerFiles: + alertmanager.yml: {} + kubeStateMetrics: + enabled: false + nodeExporter: + enabled: false + pushgateway: + enabled: false + server: + persistentVolume: + enabled: false + extraArgs: + # minimal possible values + storage.tsdb.retention: 6h + storage.tsdb.min-block-duration: 2h + storage.tsdb.max-block-duration: 2h + serverFiles: + alerts: {} + prometheus.yml: + remote_write: + - url: _URL_ + basic_auth: + password: _PASSWORD_ + username: _USERNAME_ + rules: {}