Merge branch 'main' into job-annotations

.github/workflows/publish-charts.yml

@@ -10,7 +10,7 @@ on:
         description: "Temporal Admin Tools version to use for release (for example 1.24.1-tctl-1.18.1-cli-0.12.0)"
         required: true
       ui_version:
-        description: "Temporal UI version to use for release (for example 2.27.2)"
+        description: "Temporal UI version to use for release (for example 2.27.2). Please make sure to use version from https://github.com/temporalio/ui-server/releases!"
         required: true
       bump:
         description: "Chart version bump level"

charts/temporal/Chart.yaml

@@ -39,6 +39,7 @@ dependencies:
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
+version: 0.45.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: 1.24.2
+appVersion: 1.25.0

charts/temporal/templates/server-configmap.yaml

@@ -35,7 +35,7 @@ data:
             connectAddr: "{{ include "temporal.persistence.sql.host" (list $ "default") }}:{{ include "temporal.persistence.sql.port" (list $ "default") }}"
             connectProtocol: "tcp"
             user: {{ include "temporal.persistence.sql.user" (list $ "default") }}
-            password: "{{ `{{ .Env.TEMPORAL_STORE_PASSWORD }}` }}"
+            password: {{ `{{ .Env.TEMPORAL_STORE_PASSWORD | quote }}` }}
             {{- with (omit $server.config.persistence.default.sql "driver" "driverName" "host" "port" "connectAddr" "connectProtocol" "database" "databaseName" "user" "password" "existingSecret") }}
               {{- toYaml . | nindent 12 }}
             {{- end }}
@@ -102,6 +102,11 @@ data:
         {{- toYaml . | nindent 10 }}
       {{- end }}
 
+      {{- with $server.config.authorization }}
+      authorization:
+        {{- toYaml . | nindent 10 }}
+      {{- end }}
+
     services:
       frontend:
         rpc:

charts/temporal/templates/server-deployment.yaml

@@ -55,7 +55,9 @@ spec:
         - name: check-elasticsearch-index
           image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}"
           imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }}
-          command: ['sh', '-c', 'until curl --silent --fail {{- if and $.Values.elasticsearch.username $.Values.elasticsearch.password }} --user "{{ $.Values.elasticsearch.username }}:{{ $.Values.elasticsearch.password }}" {{- end }} {{ $.Values.elasticsearch.scheme }}://{{ $.Values.elasticsearch.host }}:{{ $.Values.elasticsearch.port }}/{{ $.Values.elasticsearch.visibilityIndex }} 2>&1 > /dev/null; do echo waiting for elasticsearch index to become ready; sleep 1; done;']
+          command: ['sh', '-c', 'until curl --silent --fail --user "$ES_USER:$ES_PWD" $ES_SCHEME://$ES_HOST:$ES_PORT/$ES_VISIBILITY_INDEX 2>&1 > /dev/null; do echo waiting for elasticsearch index to become ready; sleep 1; done;']
+          env:
+            {{- include "temporal.admintools-env" (list $ "visibility") | nindent 12 }}
         {{- end }}
       {{- end }}
       containers:

charts/temporal/templates/server-job.yaml

@@ -131,6 +131,30 @@ spec:
             {{- end }}
           {{- end }}
         {{- end }}
+        {{- if $.Values.server.config.namespaces.create }}
+          {{- range $namespace := $.Values.server.config.namespaces.namespace }}
+        - name: create-{{ $namespace.name }}-namespace
+          image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}"
+          imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }}
+          command: ['/bin/sh','-c']
+          args: ['temporal operator namespace describe -n {{ $namespace.name }} || temporal operator namespace create -n {{ $namespace.name }}{{- if hasKey $namespace "retention" }} --retention {{ $namespace.retention }}{{- end }}']
+          env:
+            - name: TEMPORAL_ADDRESS
+              value: "{{ include "temporal.fullname" $ }}-frontend.{{ $.Release.Namespace }}.svc:{{ $.Values.server.frontend.service.port }}"
+              {{- with $.Values.server.additionalVolumeMounts }}
+          volumeMounts:
+                {{- toYaml . | nindent 12 }}
+              {{- end }}
+              {{- with $.Values.schema.resources }}
+          resources:
+                {{- toYaml . | nindent 12 }}
+              {{- end }}
+              {{- with $.Values.schema.containerSecurityContext }}
+          securityContext:
+                {{- toYaml . | nindent 12 }}
+              {{- end }}
+          {{- end }}
+        {{- end }}
       containers:
         - name: done
           image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}"

charts/temporal/values.yaml

@@ -18,7 +18,7 @@ server:
   sidecarContainers: []
   image:
     repository: temporalio/server
-    tag: 1.24.2
+    tag: 1.25.0
     pullPolicy: IfNotPresent
   # Global default settings (can be overridden per service)
   replicaCount: 1
@@ -115,6 +115,15 @@ server:
     #       serverName: dnsSanInFrontendCertificate
     #       rootCaFiles:
     #         - /path/to/frontend/serverCa
+    # Define your Authorizer and ClaimMapper configuration here. See https://docs.temporal.io/self-hosted-guide/security#authorization
+    # authorization:
+    #   jwtKeyProvider:
+    #     keySourceURIs:
+    #       - http://localhost:/jwks.json
+    #     refreshInterval: 1m
+    #   permissionsClaimName: permissions
+    #   authorizer: default
+    #   claimMapper: default
     persistence:
       defaultStore: default
       additionalStores: {}
@@ -178,6 +187,12 @@ server:
           maxConnLifetime: "1h"
           # connectAttributes:
           #   tx_isolation: 'READ-COMMITTED'
+    namespaces:
+      # Enable this to create namespaces
+      create: false
+      namespace:
+        - name: default
+          retention: 3d
   frontend:
     service:
       # Evaluated as template
@@ -288,7 +303,7 @@ admintools:
   enabled: true
   image:
     repository: temporalio/admin-tools
-    tag: 1.24.2-tctl-1.18.1-cli-0.13.0
+    tag: 1.25.0-tctl-1.18.1-cli-1.0.0
     pullPolicy: IfNotPresent
   service:
     type: ClusterIP
@@ -309,7 +324,7 @@ web:
   replicaCount: 1
   image:
     repository: temporalio/ui
-    tag: 2.28.0
+    tag: 2.30.2
     pullPolicy: IfNotPresent
   service:
     # set type to NodePort if access to web needs access from outside the cluster