mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
81841c1865
## What changed? Support for text/template was added to the config loading system. Sprig is used for some useful templating functions, as used by dockerize and helm. ## Why? This avoids the need to use dockerize to render config templates when deploying in containers. Without the need to write the intermediate config to disk, the image can be immutable. Any volumes used to copy over an alternative template can be read-only also, enabling more secure deployment. ## How did you test it? Built a `FROM scratch` image using the updated temporal-server binary and confirmed that it would work when deployed using (slightly adjusted) version of our helm charts. ## Potential risks None. ## Documentation Documentation should be updated to explain this new feature, but given it's so close to the standard deployment setup with dockerize, this doesn't need to block release of the feature imho. ## Is hotfix candidate? No --------- Co-authored-by: David Reiss <[email protected]>
355 lines
16 KiB
YAML
355 lines
16 KiB
YAML
# enable-template
|
|
|
|
log:
|
|
stdout: true
|
|
level: {{ default "info" (env "LOG_LEVEL") }}
|
|
|
|
persistence:
|
|
numHistoryShards: {{ default "4" (env "NUM_HISTORY_SHARDS") }}
|
|
|
|
defaultStore: default
|
|
visibilityStore: visibility
|
|
|
|
{{- $db := env "DB" -}}
|
|
{{- if not (eq $db "cassandra" "mysql8" "postgres12" "postgres12_pgx") -}}
|
|
{{- fail "Invalid DB value. Supported values are cassandra, mysql8, postgres12, postgres12_pgx" -}}
|
|
{{- end }}
|
|
|
|
datastores:
|
|
default:
|
|
{{- if eq $db "cassandra" }}
|
|
cassandra:
|
|
hosts: {{ env "CASSANDRA_SEEDS" }}
|
|
keyspace: {{ default "temporal" (env "KEYSPACE") | quote }}
|
|
user: {{ env "CASSANDRA_USER" | quote }}
|
|
password: {{ env "CASSANDRA_PASSWORD" | quote }}
|
|
{{- if env "CASSANDRA_ALLOWED_AUTHENTICATORS" }}
|
|
allowedAuthenticators: {{ range splitList "," (env "CASSANDRA_ALLOWED_AUTHENTICATORS") }}
|
|
- {{ trim . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
port: {{ default "9042" (env "CASSANDRA_PORT") }}
|
|
maxConns: {{ default "20" (env "CASSANDRA_MAX_CONNS") }}
|
|
tls:
|
|
enabled: {{ default "false" (env "CASSANDRA_TLS_ENABLED") }}
|
|
caFile: {{ env "CASSANDRA_CA" }}
|
|
certFile: {{ env "CASSANDRA_CERT" }}
|
|
keyFile: {{ env "CASSANDRA_CERT_KEY" }}
|
|
caData: {{ env "CASSANDRA_CA_DATA" }}
|
|
certData: {{ env "CASSANDRA_CERT_DATA" }}
|
|
keyData: {{ env "CASSANDRA_CERT_KEY_DATA" }}
|
|
enableHostVerification: {{ default "false" (env "CASSANDRA_HOST_VERIFICATION") }}
|
|
serverName: {{ env "CASSANDRA_HOST_NAME" }}
|
|
{{- if env "CASSANDRA_ADDRESS_TRANSLATOR" }}
|
|
addressTranslator:
|
|
translator: {{ env "CASSANDRA_ADDRESS_TRANSLATOR" }}
|
|
{{- if env "CASSANDRA_ADDRESS_TRANSLATOR_OPTIONS" }}
|
|
options:
|
|
advertised-hostname: {{ env "CASSANDRA_ADDRESS_TRANSLATOR_OPTIONS" }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- else if eq $db "mysql8" }}
|
|
sql:
|
|
pluginName: {{ $db }}
|
|
databaseName: {{ default "temporal" (env "DBNAME") | quote }}
|
|
connectAddr: {{ env "MYSQL_SEEDS" }}:{{ default "3306" (env "DB_PORT") }}
|
|
connectProtocol: "tcp"
|
|
user: {{ env "MYSQL_USER" | quote }}
|
|
password: {{ env "MYSQL_PWD" | quote }}
|
|
{{- if env "MYSQL_TX_ISOLATION_COMPAT" }}
|
|
connectAttributes:
|
|
tx_isolation: "'READ-COMMITTED'"
|
|
{{- end }}
|
|
maxConns: {{ default "20" (env "SQL_MAX_CONNS") }}
|
|
maxIdleConns: {{ default "20" (env "SQL_MAX_IDLE_CONNS") }}
|
|
maxConnLifetime: {{ default "1h" (env "SQL_MAX_CONN_TIME") }}
|
|
tls:
|
|
enabled: {{ default "false" (env "SQL_TLS_ENABLED") }}
|
|
caFile: {{ env "SQL_CA" }}
|
|
certFile: {{ env "SQL_CERT" }}
|
|
keyFile: {{ env "SQL_CERT_KEY" }}
|
|
enableHostVerification: {{ default "false" (env "SQL_HOST_VERIFICATION") }}
|
|
serverName: {{ env "SQL_HOST_NAME" }}
|
|
{{- else if eq $db "postgres12" "postgres12_pgx" }}
|
|
sql:
|
|
pluginName: {{ $db }}
|
|
databaseName: {{ default "temporal" (env "DBNAME") | quote }}
|
|
connectAddr: {{ env "POSTGRES_SEEDS" }}:{{ default "5432" (env "DB_PORT") }}
|
|
connectProtocol: "tcp"
|
|
user: {{ env "POSTGRES_USER" | quote }}
|
|
password: {{ env "POSTGRES_PWD" | quote }}
|
|
maxConns: {{ default "20" (env "SQL_MAX_CONNS") }}
|
|
maxIdleConns: {{ default "20" (env "SQL_MAX_IDLE_CONNS") }}
|
|
maxConnLifetime: {{ default "1h" (env "SQL_MAX_CONN_TIME") }}
|
|
tls:
|
|
enabled: {{ default "false" (env "SQL_TLS_ENABLED") }}
|
|
caFile: {{ env "SQL_CA" }}
|
|
certFile: {{ env "SQL_CERT" }}
|
|
keyFile: {{ env "SQL_CERT_KEY" }}
|
|
enableHostVerification: {{ default "false" (env "SQL_HOST_VERIFICATION") }}
|
|
serverName: {{ env "SQL_HOST_NAME" }}
|
|
{{- end }}
|
|
|
|
visibility:
|
|
{{- if eq (env "ENABLE_ES") "true" }}
|
|
elasticsearch:
|
|
version: {{ env "ES_VERSION" }}
|
|
url:
|
|
scheme: {{ default "http" (env "ES_SCHEME") }}
|
|
host: {{ env "ES_SEEDS" }}:{{ default "9200" (env "ES_PORT") }}
|
|
username: {{ env "ES_USER" | quote }}
|
|
password: {{ env "ES_PWD" | quote }}
|
|
indices:
|
|
visibility: {{ default "temporal_visibility_v1_dev" (env "ES_VIS_INDEX") | quote }}
|
|
{{- with env "ES_SEC_VIS_INDEX" }}
|
|
secondary_visibility: {{ . | quote }}
|
|
{{- end }}
|
|
{{- else if eq $db "mysql8" }}
|
|
sql:
|
|
{{ $visibility_seeds := coalesce (env "VISIBILITY_MYSQL_SEEDS") (env "MYSQL_SEEDS") }}
|
|
{{ $visibility_port := coalesce (env "VISIBILITY_DB_PORT") (env "DB_PORT") "3306" }}
|
|
{{ $visibility_user := coalesce (env "VISIBILITY_MYSQL_USER") (env "MYSQL_USER") }}
|
|
{{ $visibility_pwd := coalesce (env "VISIBILITY_MYSQL_PWD") (env "MYSQL_PWD") }}
|
|
pluginName: {{ $db }}
|
|
databaseName: {{ default "temporal_visibility" (env "VISIBILITY_DBNAME") | quote }}
|
|
connectAddr: {{ $visibility_seeds }}:{{ $visibility_port }}
|
|
connectProtocol: "tcp"
|
|
user: {{ $visibility_user | quote }}
|
|
password: {{ $visibility_pwd | quote }}
|
|
{{- if env "MYSQL_TX_ISOLATION_COMPAT" }}
|
|
connectAttributes:
|
|
tx_isolation: "'READ-COMMITTED'"
|
|
{{- end }}
|
|
maxConns: {{ default "10" (env "SQL_VIS_MAX_CONNS") }}
|
|
maxIdleConns: {{ default "10" (env "SQL_VIS_MAX_IDLE_CONNS") }}
|
|
maxConnLifetime: {{ default "1h" (env "SQL_VIS_MAX_CONN_TIME") }}
|
|
tls:
|
|
enabled: {{ default "false" (env "SQL_TLS_ENABLED") }}
|
|
caFile: {{ env "SQL_CA" }}
|
|
certFile: {{ env "SQL_CERT" }}
|
|
keyFile: {{ env "SQL_CERT_KEY" }}
|
|
enableHostVerification: {{ default "false" (env "SQL_HOST_VERIFICATION") }}
|
|
serverName: {{ env "SQL_HOST_NAME" }}
|
|
{{- else if eq $db "postgres12" "postgres12_pgx" }}
|
|
sql:
|
|
{{ $visibility_seeds := coalesce (env "VISIBILITY_POSTGRES_SEEDS") (env "POSTGRES_SEEDS") }}
|
|
{{ $visibility_port := coalesce (env "VISIBILITY_DB_PORT") (env "POSTGRES_PORT") "5432" }}
|
|
{{ $visibility_user := coalesce (env "VISIBILITY_POSTGRES_USER") (env "POSTGRES_USER") }}
|
|
{{ $visibility_pwd := coalesce (env "VISIBILITY_POSTGRES_PWD") (env "POSTGRES_PWD") }}
|
|
pluginName: {{ $db }}
|
|
databaseName: {{ default "temporal_visibility" (env "VISIBILITY_DBNAME") | quote }}
|
|
connectAddr: {{ $visibility_seeds }}:{{ $visibility_port }}
|
|
connectProtocol: "tcp"
|
|
user: {{ $visibility_user | quote }}
|
|
password: {{ $visibility_pwd | quote }}
|
|
maxConns: {{ default "10" (env "SQL_VIS_MAX_CONNS") }}
|
|
maxIdleConns: {{ default "10" (env "SQL_VIS_MAX_IDLE_CONNS") }}
|
|
maxConnLifetime: {{ default "1h" (env "SQL_VIS_MAX_CONN_TIME") }}
|
|
tls:
|
|
enabled: {{ default "false" (env "SQL_TLS_ENABLED") }}
|
|
caFile: {{ env "SQL_CA" }}
|
|
certFile: {{ env "SQL_CERT" }}
|
|
keyFile: {{ env "SQL_CERT_KEY" }}
|
|
enableHostVerification: {{ default "false" (env "SQL_HOST_VERIFICATION") }}
|
|
serverName: {{ env "SQL_HOST_NAME" }}
|
|
{{- else -}}
|
|
{{- fail "No visibility configured. Cassandra is no longer supported for visibility." -}}
|
|
{{- end }}
|
|
|
|
global:
|
|
membership:
|
|
maxJoinDuration: 30s
|
|
broadcastAddress: "{{ env "TEMPORAL_BROADCAST_ADDRESS" }}"
|
|
pprof:
|
|
port: {{ default "0" (env "PPROF_PORT") }}
|
|
tls:
|
|
refreshInterval: {{ default "0s" (env "TEMPORAL_TLS_REFRESH_INTERVAL") }}
|
|
expirationChecks:
|
|
warningWindow: {{ default "0s" (env "TEMPORAL_TLS_EXPIRATION_CHECKS_WARNING_WINDOW") }}
|
|
errorWindow: {{ default "0s" (env "TEMPORAL_TLS_EXPIRATION_CHECKS_ERROR_WINDOW") }}
|
|
checkInterval: {{ default "0s" (env "TEMPORAL_TLS_EXPIRATION_CHECKS_CHECK_INTERVAL") }}
|
|
internode:
|
|
# This server section configures the TLS certificate that internal temporal
|
|
# cluster nodes (history, matching, and internal-frontend) present to other
|
|
# clients within the Temporal Cluster.
|
|
server:
|
|
requireClientAuth: {{ default "false" (env "TEMPORAL_TLS_REQUIRE_CLIENT_AUTH") }}
|
|
|
|
certFile: {{ env "TEMPORAL_TLS_SERVER_CERT" }}
|
|
keyFile: {{ env "TEMPORAL_TLS_SERVER_KEY" }}
|
|
{{- with env "TEMPORAL_TLS_SERVER_CA_CERT" }}
|
|
clientCaFiles:
|
|
- {{ . }}
|
|
{{- end }}
|
|
|
|
certData: {{ env "TEMPORAL_TLS_SERVER_CERT_DATA" }}
|
|
keyData: {{ env "TEMPORAL_TLS_SERVER_KEY_DATA" }}
|
|
{{- with env "TEMPORAL_TLS_SERVER_CA_CERT_DATA" }}
|
|
clientCaData:
|
|
- {{ . }}
|
|
{{- end }}
|
|
|
|
# This client section is used to configure the TLS clients within
|
|
# the Temporal Cluster that connect to an Internode (history, matching, or
|
|
# internal-frontend)
|
|
client:
|
|
serverName: {{ env "TEMPORAL_TLS_INTERNODE_SERVER_NAME" }}
|
|
disableHostVerification: {{ default "false" (env "TEMPORAL_TLS_INTERNODE_DISABLE_HOST_VERIFICATION") }}
|
|
{{- with env "TEMPORAL_TLS_SERVER_CA_CERT" }}
|
|
rootCaFiles:
|
|
- {{ . }}
|
|
{{- end }}
|
|
{{- with env "TEMPORAL_TLS_SERVER_CA_CERT_DATA" }}
|
|
rootCaData:
|
|
- {{ . }}
|
|
{{- end }}
|
|
frontend:
|
|
# This server section configures the TLS certificate that the Frontend
|
|
# server presents to external clients.
|
|
server:
|
|
requireClientAuth: {{ default "false" (env "TEMPORAL_TLS_REQUIRE_CLIENT_AUTH") }}
|
|
certFile: {{ env "TEMPORAL_TLS_FRONTEND_CERT" }}
|
|
keyFile: {{ env "TEMPORAL_TLS_FRONTEND_KEY" }}
|
|
{{- if env "TEMPORAL_TLS_CLIENT1_CA_CERT" }}
|
|
clientCaFiles:
|
|
- {{ env "TEMPORAL_TLS_CLIENT1_CA_CERT" }}
|
|
- {{ env "TEMPORAL_TLS_CLIENT2_CA_CERT" }}
|
|
{{- end }}
|
|
|
|
certData: {{ env "TEMPORAL_TLS_FRONTEND_CERT_DATA" }}
|
|
keyData: {{ env "TEMPORAL_TLS_FRONTEND_KEY_DATA" }}
|
|
{{- if env "TEMPORAL_TLS_CLIENT1_CA_CERT_DATA" }}
|
|
clientCaData:
|
|
- {{ env "TEMPORAL_TLS_CLIENT1_CA_CERT_DATA" }}
|
|
- {{ env "TEMPORAL_TLS_CLIENT2_CA_CERT_DATA" }}
|
|
{{- end }}
|
|
|
|
# This client section is used to configure the TLS clients within
|
|
# the Temporal Cluster (specifically the Worker role) that connect to the Frontend service
|
|
client:
|
|
serverName: {{ env "TEMPORAL_TLS_FRONTEND_SERVER_NAME" }}
|
|
disableHostVerification: {{ default "false" (env "TEMPORAL_TLS_FRONTEND_DISABLE_HOST_VERIFICATION") }}
|
|
{{- with env "TEMPORAL_TLS_SERVER_CA_CERT" }}
|
|
rootCaFiles:
|
|
- {{ . }}
|
|
{{- end }}
|
|
{{- with env "TEMPORAL_TLS_SERVER_CA_CERT_DATA" }}
|
|
rootCaData:
|
|
- {{ . }}
|
|
{{- end }}
|
|
{{- with env "STATSD_ENDPOINT" }}
|
|
metrics:
|
|
statsd:
|
|
hostPort: {{ . }}
|
|
prefix: "temporal"
|
|
{{- end }}
|
|
{{- with env "PROMETHEUS_ENDPOINT" }}
|
|
metrics:
|
|
prometheus:
|
|
timerType: {{ default "histogram" (env "PROMETHEUS_TIMER_TYPE") }}
|
|
listenAddress: {{ . }}
|
|
{{- end }}
|
|
authorization:
|
|
jwtKeyProvider:
|
|
keySourceURIs:
|
|
{{- with env "TEMPORAL_JWT_KEY_SOURCE1" }}
|
|
- {{ . }}
|
|
{{- end }}
|
|
{{- with env "TEMPORAL_JWT_KEY_SOURCE2" }}
|
|
- {{ . }}
|
|
{{- end }}
|
|
refreshInterval: {{ default "1m" (env "TEMPORAL_JWT_KEY_REFRESH") }}
|
|
permissionsClaimName: {{ default "permissions" (env "TEMPORAL_JWT_PERMISSIONS_CLAIM") }}
|
|
authorizer: {{ env "TEMPORAL_AUTH_AUTHORIZER" }}
|
|
claimMapper: {{ env "TEMPORAL_AUTH_CLAIM_MAPPER" }}
|
|
|
|
{{- $temporalGrpcPort := default "7233" (env "FRONTEND_GRPC_PORT") }}
|
|
{{- $temporalHTTPPort := default "7243" (env "FRONTEND_HTTP_PORT") }}
|
|
services:
|
|
frontend:
|
|
rpc:
|
|
grpcPort: {{ $temporalGrpcPort }}
|
|
membershipPort: {{ default "6933" (env "FRONTEND_MEMBERSHIP_PORT") }}
|
|
bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}
|
|
httpPort: {{ $temporalHTTPPort }}
|
|
|
|
{{- if env "USE_INTERNAL_FRONTEND" }}
|
|
internal-frontend:
|
|
rpc:
|
|
grpcPort: {{ default "7236" (env "INTERNAL_FRONTEND_GRPC_PORT") }}
|
|
membershipPort: {{ default "6936" (env "INTERNAL_FRONTEND_MEMBERSHIP_PORT") }}
|
|
bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}
|
|
{{- end }}
|
|
|
|
matching:
|
|
rpc:
|
|
grpcPort: {{ default "7235" (env "MATCHING_GRPC_PORT") }}
|
|
membershipPort: {{ default "6935" (env "MATCHING_MEMBERSHIP_PORT") }}
|
|
bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}
|
|
|
|
history:
|
|
rpc:
|
|
grpcPort: {{ default "7234" (env "HISTORY_GRPC_PORT") }}
|
|
membershipPort: {{ default "6934" (env "HISTORY_MEMBERSHIP_PORT") }}
|
|
bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}
|
|
|
|
worker:
|
|
rpc:
|
|
grpcPort: {{ default "7239" (env "WORKER_GRPC_PORT") }}
|
|
membershipPort: {{ default "6939" (env "WORKER_MEMBERSHIP_PORT") }}
|
|
bindOnIP: {{ default "127.0.0.1" (env "BIND_ON_IP") }}
|
|
|
|
clusterMetadata:
|
|
enableGlobalNamespace: false
|
|
failoverVersionIncrement: 10
|
|
masterClusterName: "active"
|
|
currentClusterName: "active"
|
|
clusterInformation:
|
|
active:
|
|
enabled: true
|
|
initialFailoverVersion: 1
|
|
rpcName: "frontend"
|
|
rpcAddress: "127.0.0.1:{{ $temporalGrpcPort }}"
|
|
httpAddress: "127.0.0.1:{{ $temporalHTTPPort }}"
|
|
|
|
dcRedirectionPolicy:
|
|
policy: "noop"
|
|
|
|
archival:
|
|
history:
|
|
state: "enabled"
|
|
enableRead: true
|
|
provider:
|
|
filestore:
|
|
fileMode: "0666"
|
|
dirMode: "0766"
|
|
visibility:
|
|
state: "enabled"
|
|
enableRead: true
|
|
provider:
|
|
filestore:
|
|
fileMode: "0666"
|
|
dirMode: "0766"
|
|
|
|
namespaceDefaults:
|
|
archival:
|
|
history:
|
|
state: "disabled"
|
|
URI: "file:///tmp/temporal_archival/development"
|
|
visibility:
|
|
state: "disabled"
|
|
URI: "file:///tmp/temporal_vis_archival/development"
|
|
|
|
{{- if or (env "USE_INTERNAL_FRONTEND") (and (not (env "TEMPORAL_AUTH_AUTHORIZER")) (not (env "TEMPORAL_AUTH_CLAIM_MAPPER"))) }}
|
|
{{/* publicClient is not needed with internal frontend, or if not using authorizer + claim mapper */}}
|
|
{{- else }}
|
|
{{ $publicIp := default "127.0.0.1" (env "BIND_ON_IP") -}}
|
|
{{- $defaultPublicHostPost := print $publicIp ":" $temporalGrpcPort -}}
|
|
publicClient:
|
|
hostPort: "{{ default $defaultPublicHostPost (env "PUBLIC_FRONTEND_ADDRESS") }}"
|
|
{{- end }}
|
|
|
|
dynamicConfigClient:
|
|
filepath: "{{ default "/etc/temporal/config/dynamicconfig/docker.yaml" (env "DYNAMIC_CONFIG_FILE_PATH") }}"
|
|
pollInterval: "60s"
|