[OPS-2868] Merge latest upstream master into fm-devops

.github/workflows/publish-charts.yml

@@ -10,7 +10,7 @@ on:
         description: "Temporal Admin Tools version to use for release (for example 1.24.1-tctl-1.18.1-cli-0.12.0)"
         required: true
       ui_version:
-        description: "Temporal UI version to use for release (for example 2.27.2)"
+        description: "Temporal UI version to use for release (for example 2.27.2). Please make sure to use version from https://github.com/temporalio/ui-server/releases!"
         required: true
       bump:
         description: "Chart version bump level"

charts/temporal/Chart.yaml

@@ -39,7 +39,7 @@ dependencies:
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: 0.44.0
+version: 0.46.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: 1.24.2
+appVersion: 1.25.0

charts/temporal/templates/_helpers.tpl

@@ -89,7 +89,7 @@ app.kubernetes.io/managed-by: {{ index $global "Release" "Service" }}
 app.kubernetes.io/instance: {{ index $global "Release" "Name" }}
 app.kubernetes.io/version: {{ include "temporal.appVersion" $global }}
 app.kubernetes.io/part-of: {{ $global.Chart.Name }}
-{{- with $resourceType -}}
+{{ with $resourceType -}}
 {{- $resourceTypeKey := printf "%sLabels" . -}}
 {{- $resourceLabels := dict -}}
 {{- if or (eq $scope "") (ne $component "server") -}}

charts/temporal/templates/admintools-deployment.yaml

@@ -2,26 +2,26 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "temporal.componentname" (list . "admintools") }}
+  name: {{ include "temporal.componentname" (list $ "admintools") }}
   labels:
-    {{- include "temporal.resourceLabels" (list . "admintools" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "admintools" "") | nindent 4 }}
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app.kubernetes.io/name: {{ include "temporal.name" . }}
+      app.kubernetes.io/name: {{ include "temporal.name" $ }}
       app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: admintools
   template:
     metadata:
       labels:
-        {{- include "temporal.resourceLabels" (list . "admintools" "pod") | nindent 8 }}
+        {{- include "temporal.resourceLabels" (list $ "admintools" "pod") | nindent 8 }}
       {{- with $.Values.admintools.podAnnotations }}
       annotations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
     spec:
-      {{ include "temporal.serviceAccount" . }}
+      {{ include "temporal.serviceAccount" $ }}
       containers:
         - name: admin-tools
           image: "{{ .Values.admintools.image.repository }}:{{ .Values.admintools.image.tag }}"
@@ -33,9 +33,9 @@ spec:
           env:
             # TEMPORAL_CLI_ADDRESS is deprecated, use TEMPORAL_ADDRESS instead
             - name: TEMPORAL_CLI_ADDRESS
-              value: {{ include "temporal.fullname" . }}-frontend:{{ .Values.server.frontend.service.port }}
+              value: {{ include "temporal.fullname" $ }}-frontend:{{ .Values.server.frontend.service.port }}
             - name: TEMPORAL_ADDRESS
-              value: {{ include "temporal.fullname" . }}-frontend:{{ .Values.server.frontend.service.port }}
+              value: {{ include "temporal.fullname" $ }}-frontend:{{ .Values.server.frontend.service.port }}
           {{- if .Values.admintools.additionalEnv }}
           {{- toYaml .Values.admintools.additionalEnv | nindent 12 }}
           {{- end }}

charts/temporal/templates/admintools-service.yaml

@@ -2,9 +2,9 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "temporal.componentname" (list . "admintools") }}
+  name: {{ include "temporal.componentname" (list $ "admintools") }}
   labels:
-    {{- include "temporal.resourceLabels" (list . "admintools" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "admintools" "") | nindent 4 }}
 spec:
   type: ClusterIP 
   ports:
@@ -14,7 +14,7 @@ spec:
       name: ssh
 
   selector:
-    app.kubernetes.io/name: {{ include "temporal.name" . }}
+    app.kubernetes.io/name: {{ include "temporal.name" $ }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admintools
 {{- end }}

charts/temporal/templates/frontend-ingress.yaml

@@ -8,9 +8,9 @@ apiVersion: extensions/v1beta1
   {{- end }}
 kind: Ingress
 metadata:
-  name: {{ include "temporal.componentname" (list . "frontend") }}
+  name: {{ include "temporal.componentname" (list $ "frontend") }}
   labels:
-    {{- include "temporal.resourceLabels" (list . "frontend" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "frontend" "") | nindent 4 }}
 {{- with .Values.server.frontend.ingress.annotations }}
   annotations:
 {{ toYaml . | indent 4 }}

charts/temporal/templates/server-configmap.yaml

@@ -6,7 +6,7 @@ kind: ConfigMap
 metadata:
   name: "{{ include "temporal.fullname" $ }}-config"
   labels:
-    {{- include "temporal.resourceLabels" (list . "" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "" "") | nindent 4 }}
 data:
   config_template.yaml: |-
     log:
@@ -35,7 +35,7 @@ data:
             connectAddr: "{{ include "temporal.persistence.sql.host" (list $ "default") }}:{{ include "temporal.persistence.sql.port" (list $ "default") }}"
             connectProtocol: "tcp"
             user: {{ include "temporal.persistence.sql.user" (list $ "default") }}
-            password: "{{ `{{ .Env.TEMPORAL_STORE_PASSWORD }}` }}"
+            password: {{ `{{ .Env.TEMPORAL_STORE_PASSWORD | quote }}` }}
             {{- with (omit $server.config.persistence.default.sql "driver" "driverName" "host" "port" "connectAddr" "connectProtocol" "database" "databaseName" "user" "password" "existingSecret") }}
               {{- toYaml . | nindent 12 }}
             {{- end }}
@@ -88,6 +88,10 @@ data:
           {{- with $server.metrics.tags }}
             {{- toYaml . | nindent 10 }}
           {{- end }}
+        {{- with $server.metrics.excludeTags }}
+        excludeTags:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
         {{- with $server.config.prometheus }}
         prometheus:
           {{- toYaml . | nindent 10 }}
@@ -97,22 +101,16 @@ data:
           listenAddress: "0.0.0.0:9090"
         {{- end }}
 
-      {{- if $server.authorization }}
-      authorization:
-        jwtKeyProvider:
-          keySourceURIs:
-            - "{{ $server.authorization.keySourceURI }}"
-          refreshInterval: {{ default "1m" $server.authorization.refreshInterval }}
-        permissionsClaimName: {{ default "permissions" $server.authorization.permissionsClaimName }}
-        authorizer: {{ default "default" $server.authorization.authorizer }}
-        claimMapper: {{ default "default" $server.authorization.claimMapper }}
-      {{- end }}
-
       {{- with $server.config.tls }}
       tls:
         {{- toYaml . | nindent 10 }}
       {{- end }}
 
+      {{- with $server.config.authorization }}
+      authorization:
+        {{- toYaml . | nindent 10 }}
+      {{- end }}
+
     services:
       frontend:
         rpc:

charts/temporal/templates/server-deployment.yaml

@@ -66,7 +66,9 @@ spec:
         - name: check-elasticsearch-index
           image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}"
           imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }}
-          command: ['sh', '-c', 'until curl --silent --fail {{- if and $.Values.elasticsearch.username $.Values.elasticsearch.password }} --user "{{ $.Values.elasticsearch.username }}:{{ $.Values.elasticsearch.password }}" {{- end }} {{ $.Values.elasticsearch.scheme }}://{{ $.Values.elasticsearch.host }}:{{ $.Values.elasticsearch.port }}/{{ $.Values.elasticsearch.visibilityIndex }} 2>&1 > /dev/null; do echo waiting for elasticsearch index to become ready; sleep 1; done;']
+          command: ['sh', '-c', 'until curl --silent --fail --user "$ES_USER:$ES_PWD" $ES_SCHEME://$ES_HOST:$ES_PORT/$ES_VISIBILITY_INDEX 2>&1 > /dev/null; do echo waiting for elasticsearch index to become ready; sleep 1; done;']
+          env:
+            {{- include "temporal.admintools-env" (list $ "visibility") | nindent 12 }}
         {{- end }}
       {{- end }}
       containers:

charts/temporal/templates/server-dynamicconfigmap.yaml

@@ -2,9 +2,9 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: "{{ include "temporal.fullname" . }}-dynamic-config"
+  name: "{{ include "temporal.fullname" $ }}-dynamic-config"
   labels:
-    {{- include "temporal.resourceLabels" (list . "" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "" "") | nindent 4 }}
 data:
   dynamic_config.yaml: |-
   {{- if $.Values.server.dynamicConfig }}

charts/temporal/templates/server-job.yaml

@@ -1,21 +1,26 @@
-
 {{- if $.Values.server.enabled }}{{- if or $.Values.schema.createDatabase.enabled $.Values.schema.setup.enabled $.Values.schema.update.enabled }}
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ include "temporal.componentname" (list . "schema") }}
+  name: {{ include "temporal.componentname" (list $ "schema") }}
   labels:
-    {{- include "temporal.resourceLabels" (list . "database" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "database" "") | nindent 4 }}
 spec:
   backoffLimit: {{ $.Values.schema.setup.backoffLimit }}
   template:
     metadata:
-      name: {{ include "temporal.componentname" (list . "schema") }}
+      name: {{ include "temporal.componentname" (list $ "schema") }}
       labels:
-        # Currently there are no labels for job type
-        {{- include "temporal.resourceLabels" (list . "database" "") | nindent 8 }}
+        {{- include "temporal.resourceLabels" (list $ "database" "") | nindent 8 }}
+        {{- with $.Values.schema.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with $.Values.schema.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     spec:
-      {{ include "temporal.serviceAccount" . }}
+      {{ include "temporal.serviceAccount" $ }}
       restartPolicy: OnFailure
       initContainers:
         {{- if $.Values.cassandra.enabled }}
@@ -126,6 +131,30 @@ spec:
             {{- end }}
           {{- end }}
         {{- end }}
+        {{- if $.Values.server.config.namespaces.create }}
+          {{- range $namespace := $.Values.server.config.namespaces.namespace }}
+        - name: create-{{ $namespace.name }}-namespace
+          image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}"
+          imagePullPolicy: {{ $.Values.admintools.image.pullPolicy }}
+          command: ['/bin/sh','-c']
+          args: ['temporal operator namespace describe -n {{ $namespace.name }} || temporal operator namespace create -n {{ $namespace.name }}{{- if hasKey $namespace "retention" }} --retention {{ $namespace.retention }}{{- end }}']
+          env:
+            - name: TEMPORAL_ADDRESS
+              value: "{{ include "temporal.fullname" $ }}-frontend.{{ $.Release.Namespace }}.svc:{{ $.Values.server.frontend.service.port }}"
+              {{- with $.Values.server.additionalVolumeMounts }}
+          volumeMounts:
+                {{- toYaml . | nindent 12 }}
+              {{- end }}
+              {{- with $.Values.schema.resources }}
+          resources:
+                {{- toYaml . | nindent 12 }}
+              {{- end }}
+              {{- with $.Values.schema.containerSecurityContext }}
+          securityContext:
+                {{- toYaml . | nindent 12 }}
+              {{- end }}
+          {{- end }}
+        {{- end }}
       containers:
         - name: done
           image: "{{ $.Values.admintools.image.repository }}:{{ $.Values.admintools.image.tag }}"

charts/temporal/templates/server-pdb.yaml

@@ -7,7 +7,7 @@ kind: PodDisruptionBudget
 metadata:
   name: {{ include "temporal.componentname" (list $ $service) }}-pdb
   labels:
-    {{- include "temporal.resourceLabels" (list . $service "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ $service "") | nindent 4 }}
 spec:
   {{ toYaml $serviceValues.podDisruptionBudget }}
   selector:

charts/temporal/templates/server-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "temporal.componentname" (list . "frontend") }}
+  name: {{ include "temporal.componentname" (list $ "frontend") }}
   labels:
     {{- include "temporal.resourceLabels" (list $ "frontend" "") | nindent 4 }}
   {{- if .Values.server.frontend.service.annotations }}
@@ -24,7 +24,7 @@ spec:
       name: http
       # TODO: Allow customizing the node HTTP port
   selector:
-    app.kubernetes.io/name: {{ include "temporal.name" . }}
+    app.kubernetes.io/name: {{ include "temporal.name" $ }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: frontend
 

charts/temporal/templates/serviceaccount.yaml

@@ -2,9 +2,8 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "temporal.serviceAccountName" . }}
+  name: {{ include "temporal.serviceAccountName" $ }}
   labels:
-    {{- include "temporal.resourceLabels" (list . "" "") | nindent 4 }}
   annotations:
     {{- with .Values.serviceAccount.extraAnnotations }}
       {{- toYaml . | nindent 4 }}

charts/temporal/templates/web-deployment.yaml

@@ -2,14 +2,14 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "temporal.componentname" (list . "web") }}
+  name: {{ include "temporal.componentname" (list $ "web") }}
   labels:
-    {{- include "temporal.resourceLabels" (list . "web" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "web" "") | nindent 4 }}
 spec:
   replicas: {{ .Values.web.replicaCount }}
   selector:
     matchLabels:
-      app.kubernetes.io/name: {{ include "temporal.name" . }}
+      app.kubernetes.io/name: {{ include "temporal.name" $ }}
       app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: web
   template:
@@ -21,7 +21,7 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
     spec:
-      {{ include "temporal.serviceAccount" . }}
+      {{ include "temporal.serviceAccount" $ }}
       {{- if .Values.web.additionalVolumes }}
       volumes:
       {{- toYaml .Values.web.additionalVolumes | nindent 8 }}
@@ -32,7 +32,7 @@ spec:
           imagePullPolicy: {{ .Values.web.image.pullPolicy }}
           env:
             - name: TEMPORAL_ADDRESS
-              value: "{{ include "temporal.fullname" . }}-frontend.{{ .Release.Namespace }}.svc:{{ .Values.server.frontend.service.port }}"
+              value: "{{ include "temporal.fullname" $ }}-frontend.{{ .Release.Namespace }}.svc:{{ .Values.server.frontend.service.port }}"
           {{- if .Values.web.additionalEnv }}
           {{- toYaml .Values.web.additionalEnv | nindent 12 }}
           {{- end }}

charts/temporal/templates/web-ingress.yaml

@@ -8,9 +8,9 @@ apiVersion: extensions/v1beta1
   {{- end }}
 kind: Ingress
 metadata:
-  name: {{ include "temporal.componentname" (list . "web") }}
+  name: {{ include "temporal.componentname" (list $ "web") }}
   labels:
-    {{- include "temporal.resourceLabels" (list . "web" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "web" "") | nindent 4 }}
 {{- with .Values.web.ingress.annotations }}
   annotations:
 {{ toYaml . | indent 4 }}

charts/temporal/templates/web-pdb.yaml

@@ -3,9 +3,9 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
-  name: {{ include "temporal.componentname" (list . "web") }}-pdb
+  name: {{ include "temporal.componentname" (list $ "web") }}-pdb
   labels:
-    {{- include "temporal.resourceLabels" (list . "web" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "web" "") | nindent 4 }}
 spec:
   {{ toYaml $.Values.web.podDisruptionBudget }}
   selector:

charts/temporal/templates/web-service.yaml

@@ -2,9 +2,9 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "temporal.componentname" (list . "web") }}
+  name: {{ include "temporal.componentname" (list $ "web") }}
   labels:
-    {{- include "temporal.resourceLabels" (list . "web" "") | nindent 4 }}
+    {{- include "temporal.resourceLabels" (list $ "web" "") | nindent 4 }}
   {{- if .Values.web.service.annotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.web.service.annotations "context" $) | nindent 4 }}
   {{- end }}
@@ -22,7 +22,7 @@ spec:
       nodePort: {{ .Values.web.service.nodePort }}
       {{- end }}
   selector:
-    app.kubernetes.io/name: {{ include "temporal.name" . }}
+    app.kubernetes.io/name: {{ include "temporal.name" $ }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: web
   {{- end }}