temporal

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

nameOverride: ""

fullnameOverride: ""

# Chart debug mode

# (eg. disable helm hook delete policy)

debug: false

imagePullSecrets: []

# Custom Service account management

serviceAccount:

# Whether to create service account or not

create: false

# Name of the service account.

# Uses `name` if set.

# If `create: true` defaults to temporal.fullname, otherwise uses the namespace's default serviceAccount.

name:

# extraAnnotations would let users add additional annotations

extraAnnotations:

additionalAnnotations: {}

additionalLabels: {}

# Array of extra K8s manifests to deploy

extraObjects: []

server:

enabled: true

image:

repository: cgr.dev/chainguard-private/temporal-server-fips

tag: 1.31.3@sha256:f56bb8346582f212e3520c1fdf726348f5281ee124b0ea84386b16fb5ca12eb1

pullPolicy: IfNotPresent

# Global default settings (can be overridden per service)

# replicaCount: 1

# readinessProbe: {}

# A value replaces the built-in tcpSocket probe whole.

# livenessProbe: {}

metrics:

# Annotate pods and services directly with the following Prometheus annotations.

# prometheus.io/job

# prometheus.io/port

# prometheus.io/scheme

# prometheus.io/scrape

annotations:

enabled: true

# Enable Prometheus ServiceMonitor

# Use this if you installed the Prometheus Operator (https://github.com/coreos/prometheus-operator).

serviceMonitor:

enabled: false

interval: 30s

# Set additional lables to all the ServiceMonitor resources

additionalLabels: {}

# label1: value1

# label2: value2

# Set Prometheus metric_relabel_configs via ServiceMonitor

# Use metricRelabelings to adjust metric and label names as needed

metricRelabelings: []

# - action: replace

# sourceLabels:

# - exported_namespace

# targetLabel: temporal_namespace

# - action: replace

# regex: service_errors_(.+)

# replacement: ${1}

# sourceLabels:

# - __name__

# targetLabel: temporal_error_kind

# - action: replace

# regex: service_errors_.+

# replacement: temporal_service_errors

# sourceLabels:

# - __name__

# targetLabel: __name__

deploymentLabels: {}

deploymentAnnotations: {}

deploymentStrategy: {}

podAnnotations: {}

podLabels: {}

secretLabels: {}

secretAnnotations: {}

resources: {}

# We usually recommend not to specify default resources and to leave this as a conscious

# choice for the user. This also increases chances charts run on environments with little

# resources, such as Minikube. If you do want to specify resources, uncomment the following

# lines, adjust them as necessary, and remove the curly braces after 'resources:'.

# limits:

# cpu: 100m

# memory: 128Mi

# requests:

# cpu: 100m

# memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}

# Default scheduling values for all server services. Each service can override these below.

schedulerName: ""

runtimeClassName: ""

priorityClassName: ""

minReadySeconds: 0

terminationGracePeriodSeconds: null

additionalVolumes: []

additionalVolumeMounts: []

additionalEnv: []

additionalEnvSecretName: ""

additionalEnvConfigMapName: ""

100

# Wire TLS for the Temporal server without hand-writing volumes, mounts and

101

# config.tls. Point each section at an existing kubernetes.io/tls secret

102

# (tls.crt + tls.key, plus ca.crt for verification). The secret can come from

103

# cert-manager, external-secrets, or be created by hand; the chart does not

104

# create it. Enabling a section mounts the secret and generates the matching

105

# `server.config.tls` block. Anything you set under `server.config.tls` is

106

# deep-merged on top, so individual fields remain overridable.

107

tls:

108

internode:

109

enabled: false

110

# Existing secret with tls.crt, tls.key and ca.crt for internode traffic.

111

secretName: ""

112

# Where the secret is mounted in the server containers.

113

mountPath: /etc/temporal/tls/internode

114

# Require and verify client certificates on internode connections.

115

requireClientAuth: true

116

# DNS name clients expect in the server certificate (a SAN on the cert).

117

# Host verification is always on for internode, so this is required when

118

# internode.enabled is true.

119

serverName: ""

120

frontend:

121

enabled: false

122

secretName: ""

123

mountPath: /etc/temporal/tls/frontend

124

# Require and verify client certificates on frontend connections (mutual

125

# TLS). The chart's own CLI pods (admintools, namespace job, health check)

126

# and the Web UI present a client certificate automatically; the internal

127

# server components present the internode certificate, so enable

128

# server.tls.internode and issue every certificate from a CA the frontend

129

# trusts when turning this on.

130

requireClientAuth: false

131

# DNS name clients expect in the frontend certificate (a SAN on the cert).

132

# Required when frontend.enabled is true.

133

serverName: ""

134

# for sidecar containers, add containers here with restartPolicy: Always

135

additionalInitContainers: []

136

# publicClientHostPort: "temporal-frontend.example.svc:7233"

137

securityContext:

138

fsGroup: 1000

139

runAsUser: 1000

140

config:

141

logLevel: "debug,info"

142

# Define your TLS configuration here. See https://docs.temporal.io/references/configuration#tls

143

# for configuration options. For most setups prefer the `server.tls` stanza

144

# above, which mounts the certificates and generates this block for you; use

145

# this only for advanced fields or to override what `server.tls` generates.

146

# If you configure TLS here directly you must also use

147

# `server.additionalVolumeMounts` and `server.additionalVolumes` to mount the

148

# certificates to the paths you reference below.

149

# tls:

150

# internode:

151

# server:

152

# certFile: /path/to/internode/cert/file

153

# keyFile: /path/to/internode/key/file

154

# requireClientAuth: true

155

# clientCaFiles:

156

# - /path/to/internode/serverCa

157

# client:

158

# serverName: dnsSanInInternodeCertificate

159

# rootCaFiles:

160

# - /path/to/internode/serverCa

161

# frontend:

162

# server:

163

# certFile: /path/to/frontend/cert/file

164

# keyFile: /path/to/frontend/key/file

165

# requireClientAuth: true

166

# clientCaFiles:

167

# - /path/to/internode/serverCa

168

# - /path/to/sdkClientPool1/ca

169

# - /path/to/sdkClientPool2/ca

170

# client:

171

# serverName: dnsSanInFrontendCertificate

172

# rootCaFiles:

173

# - /path/to/frontend/serverCa

174

# Define your Authorizer and ClaimMapper configuration here. See https://docs.temporal.io/self-hosted-guide/security#authorization

175

# authorization:

176

# jwtKeyProvider:

177

# keySourceURIs:

178

# - http://localhost:/jwks.json

179

# refreshInterval: 1m

180

# permissionsClaimName: permissions

181

# authorizer: default

182

# claimMapper: default

183

persistence:

184

defaultStore: default

185

visibilityStore: visibility

186

# Important: numHistoryShards cannot be changed after the initial deployment.

187

numHistoryShards: 512

188

# Persistence configuration follows the raw Temporal server config format.

189

# Driver is determined by which top-level key is present (cassandra vs sql).

190

# For SQL stores, you can use either connectAddr: "host:port" or separate host/port fields.

191

# Helm-specific fields (existingSecret, secretKey) are stripped before rendering to server config.

192

datastores:

193

default:

194

# Example SQL configuration:

195

# sql:

196

# createDatabase: false

197

# manageSchema: false

198

# pluginName: mysql8 # or postgres12, postgres12_pgx

199

# driverName: mysql8

200

# databaseName: temporal

201

# connectAddr: "mysql.example.com:3306" # preferred format

202

# connectProtocol: "tcp"

203

# # OR use separate host/port:

204

# # host: mysql.example.com

205

# # port: 3306

206

# user: temporal_user

207

# password: "" # optional, use existingSecret instead

208

# existingSecret: temporal-db-secret # Helm-specific, stripped before rendering

209

# secretKey: password # Helm-specific, default: password

210

# # Server v1.31+ alternative to password/existingSecret (SQL datastores

211

# # only). When set, no password Secret is created and no SQL_PASSWORD

212

# # env is wired; the server invokes the command per new connection.

213

# passwordCommand:

214

# command: my-token-helper

215

# args: []

216

# timeout: 30s

217

# maxConns: 20

218

# maxIdleConns: 20

219

# maxConnLifetime: "1h"

220

# connectAttributes:

221

# tx_isolation: "READ-COMMITTED"

222

# tls:

223

# enabled: true

224

# caFile: /path/to/ca.pem

225

# Example Cassandra configuration:

226

# cassandra:

227

# createDatabase: false

228

# manageSchema: false

229

# hosts: "host1,host2"

230

# port: 9042

231

# keyspace: temporal

232

# user: cassandra_user

233

# password: "" # optional, use existingSecret instead

234

# existingSecret: temporal-cassandra-secret

235

# secretKey: password

236

# replicationFactor: 3

237

# consistency:

238

# default:

239

# consistency: "local_quorum"

240

# serialConsistency: "local_serial"

241

visibility:

242

# Example SQL configuration (same structure as default.sql):

243

# sql:

244

# createDatabase: false

245

# manageSchema: false

246

# pluginName: mysql8

247

# driverName: mysql8

248

# databaseName: temporal_visibility

249

# connectAddr: "mysql.example.com:3306"

250

# connectProtocol: "tcp"

251

# user: temporal_user

252

# existingSecret: temporal-db-secret

253

# secretKey: password

254

# Example Elasticsearch configuration:

255

# elasticsearch:

256

# version: v7

257

# url:

258

# scheme: http

259

# host: "elasticsearch:9200"

260

# username: ""

261

# password: ""

262

# existingSecret: temporal-es-secret

263

# secretKey: password

264

# logLevel: error

265

# indices:

266

# visibility: temporal_visibility_v1

267

# tls:

268

# enabled: true

269

# caFile: /path/to/ca.crt

270

# certFile: /path/to/client.crt

271

# keyFile: /path/to/client.key

272

# serverName: elasticsearch.internal

273

# enableHostVerification: true

274

# aws-request-signing:

275

# credentialProvider: environment # static, environment, or aws-sdk-default

276

# region: us-east-1

277

# static:

278

# accessKeyID: ""

279

# secretAccessKey: ""

280

# token: ""

281

# Additional stores can be added here and will pass through directly

282

# archive:

283

# sql:

284

# pluginName: postgres12

285

# ...

286

metrics:

287

# Additional tags to be added to Prometheus metrics

288

tags: {}

289

# ... All other fields from https://github.com/temporalio/temporal/blob/main/common/metrics/config.go

290

# excludeTags: {}

291

# prefix: ""

292

# etc.

293

prometheus:

294

timerType: histogram

295

listenAddress: "0.0.0.0:9090"

296

namespaces:

297

# Enable this to create namespaces

298

create: false

299

# The namespace-setup job is a one-off admin tools invocation. Like the

300

# admin tools (see admintools.useExternalFrontend) it connects to the

301

# internal-frontend when that is enabled, which grants admin without an

302

# external Authorizer. Set this to true to route it through the external

303

# frontend instead (e.g. when the frontend has an Authorizer and you can

304

# authenticate the job rather than relying on the internal-frontend bypass).

305

useExternalFrontend: false

306

# Use Helm hooks to ensure namespace creation runs as a post-install/post-upgrade step,

307

# after the frontend is created, and is cleaned up automatically on the next release.

308

# Set to false if using Flux, Rancher or Terraform.

309

useHelmHooks: true

310

namespace:

311

- name: default

312

retention: 3d

313

frontend:

314

enabled: true

315

service:

316

# Evaluated as template

317

annotations: {}

318

type: ClusterIP

319

port: 7233

320

appProtocol: tcp

321

membershipPort: 6933

322

membershipAppProtocol: tcp

323

httpPort: 7243

324

httpAppProtocol: http

325

# Defaults to a tcpSocket probe; uncomment below for a gRPC probe.

326

# gRPC probes don't yet support TLS (kubernetes/enhancements#4939), so opt in only when TLS is off.

327

readinessProbe: {}

328

livenessProbe: {}

329

# readinessProbe:

330

# grpc:

331

# port: 7233

332

# service: temporal.api.workflowservice.v1.WorkflowService

333

ingress:

334

enabled: false

335

# className:

336

annotations: {}

337

# kubernetes.io/ingress.class: traefik

338

# ingress.kubernetes.io/ssl-redirect: "false"

339

# traefik.frontend.rule.type: PathPrefix

340

hosts:

341

- "/"

342

# - "domain.com/xyz"

343

# - "domain.com"

344

tls: []

345

# - secretName: chart-example-tls

346

# hosts:

347

# - chart-example.local

348

metrics:

349

annotations:

350

enabled: true

351

serviceMonitor: {}

352

# enabled: false

353

prometheus: {}

354

# timerType: histogram

355

deploymentLabels: {}

356

deploymentAnnotations: {}

357

deploymentStrategy: {}

358

podAnnotations: {}

359

podLabels: {}

360

serviceLabels: {}

361

resources: {}

362

nodeSelector: {}

363

tolerations: []

364

affinity: {}

365

additionalEnv: []

366

containerSecurityContext: {}

367

topologySpreadConstraints: []

368

schedulerName: ""

369

runtimeClassName: ""

370

priorityClassName: ""

371

podDisruptionBudget: {}

372

serviceAccount: {}

373

# serviceAccount:

374

# create: false

375

# name: "frontend-service-account"

376

# extraAnnotations: {}

377

internal-frontend:

378

# Enable this to create internal-frontend

379

enabled: false

380

service:

381

# Evaluated as template

382

annotations: {}

383

type: ClusterIP

384

port: 7236

385

appProtocol: tcp

386

membershipPort: 6936

387

membershipAppProtocol: tcp

388

httpPort: 7246

389

httpAppProtocol: http

390

# Defaults to a tcpSocket probe; uncomment below for a gRPC probe.

391

# gRPC probes don't yet support TLS (kubernetes/enhancements#4939), so opt in only when TLS is off.

392

readinessProbe: {}

393

livenessProbe: {}

394

# readinessProbe:

395

# grpc:

396

# port: 7236

397

# service: temporal.api.workflowservice.v1.WorkflowService

398

metrics:

399

annotations:

400

enabled: true

401

serviceMonitor: {}

402

# enabled: false

403

prometheus: {}

404

# timerType: histogram

405

deploymentLabels: {}

406

deploymentAnnotations: {}

407

deploymentStrategy: {}

408

podAnnotations: {}

409

podLabels: {}

410

serviceLabels: {}

411

resources: {}

412

nodeSelector: {}

413

tolerations: []

414

affinity: {}

415

additionalEnv: []

416

containerSecurityContext: {}

417

topologySpreadConstraints: []

418

schedulerName: ""

419

runtimeClassName: ""

420

priorityClassName: ""

421

podDisruptionBudget: {}

422

serviceAccount: {}

423

history:

424

enabled: true

425

service:

426

# type: ClusterIP

427

port: 7234

428

appProtocol: tcp

429

membershipPort: 6934

430

membershipAppProtocol: tcp

431

readinessProbe: {}

432

livenessProbe: {}

433

metrics:

434

annotations:

435

enabled: true

436

serviceMonitor: {}

437

# enabled: false

438

prometheus: {}

439

# timerType: histogram

440

deploymentLabels: {}

441

deploymentAnnotations: {}

442

deploymentStrategy: {}

443

podAnnotations: {}

444

podLabels: {}

445

serviceLabels: {}

446

resources: {}

447

nodeSelector: {}

448

tolerations: []

449

affinity: {}

450

additionalEnv: []

451

containerSecurityContext: {}

452

topologySpreadConstraints: []

453

schedulerName: ""

454

runtimeClassName: ""

455

priorityClassName: ""

456

podDisruptionBudget: {}

457

serviceAccount: {}

458

matching:

459

enabled: true

460

service:

461

# type: ClusterIP

462

port: 7235

463

appProtocol: tcp

464

membershipPort: 6935

465

membershipAppProtocol: tcp

466

readinessProbe: {}

467

livenessProbe: {}

468

metrics:

469

annotations:

470

enabled: true

471

serviceMonitor: {}

472

# enabled: false

473

prometheus: {}

474

# timerType: histogram

475

deploymentLabels: {}

476

deploymentAnnotations: {}

477

deploymentStrategy: {}

478

podAnnotations: {}

479

podLabels: {}

480

serviceLabels: {}

481

resources: {}

482

nodeSelector: {}

483

tolerations: []

484

affinity: {}

485

additionalEnv: []

486

containerSecurityContext: {}

487

topologySpreadConstraints: []

488

schedulerName: ""

489

runtimeClassName: ""

490

priorityClassName: ""

491

podDisruptionBudget: {}

492

serviceAccount: {}

493

worker:

494

enabled: true

495

service:

496

# type: ClusterIP

497

port: 7239

498

appProtocol: tcp

499

membershipPort: 6939

500

membershipAppProtocol: tcp

501

readinessProbe: {}

502

livenessProbe: {}

503

metrics:

504

annotations:

505

enabled: true

506

serviceMonitor: {}

507

# enabled: false

508

prometheus: {}

509

# timerType: histogram

510

deploymentLabels: {}

511

deploymentAnnotations: {}

512

deploymentStrategy: {}

513

podAnnotations: {}

514

podLabels: {}

515

serviceLabels: {}

516

resources: {}

517

nodeSelector: {}

518

tolerations: []

519

affinity: {}

520

additionalEnv: []

521

containerSecurityContext: {}

522

topologySpreadConstraints: []

523

schedulerName: ""

524

runtimeClassName: ""

525

priorityClassName: ""

526

podDisruptionBudget: {}

527

serviceAccount: {}

528

admintools:

529

enabled: true

530

# By default the admin tools connect to the internal-frontend when it is

531

# enabled, which grants admin access without an external Authorizer. Set this

532

# to true to connect through the external frontend instead (e.g. when the

533

# frontend has an Authorizer and you supply credentials via additionalEnv). If

534

# server TLS is enabled the chart mounts the matching certificate (internode

535

# for the internal-frontend, frontend for the external frontend) and sets the

536

# TEMPORAL_TLS_* env; this is skipped when a custom temporalAddress is set.

537

useExternalFrontend: false

538

image:

539

repository: cgr.dev/chainguard-private/temporal-admin-tools-fips

540

tag: 1.31.3@sha256:8513b8f0b5e3467c4b665710594987dfb8b6004be905abdeb9bb04e6704c4b06

541

pullPolicy: IfNotPresent

542

service:

543

type: ClusterIP

544

port: 22

545

annotations: {}

546

deploymentLabels: {}

547

deploymentAnnotations: {}

548

deploymentStrategy: {}

549

podLabels: {}

550

podAnnotations: {}

551

nodeSelector: {}

552

tolerations: []

553

affinity: {}

554

schedulerName: ""

555

runtimeClassName: ""

556

priorityClassName: ""

557

additionalVolumes: []

558

additionalVolumeMounts: []

559

additionalEnv: []

560

additionalEnvSecretName: ""

561

additionalEnvConfigMapName: ""

562

# temporalAddress: "localhost:7233"

563

# for sidecar containers, add containers here with restartPolicy: Always

564

additionalInitContainers: []

565

resources: {}

566

containerSecurityContext: {}

567

securityContext: {}

568

minReadySeconds: 0

569

podDisruptionBudget: {}

570

serviceAccount: {}

571

web:

572

# additionalInitContainers: []

573

enabled: true

574

# replicaCount: 1

575

image:

576

repository: cgr.dev/chainguard-private/temporal-ui-server-fips

577

tag: 2.54.1@sha256:fbc8c799eb6b40982434f6158aa47728755fd295f88583ed3f6b7142cefea013

578

pullPolicy: IfNotPresent

579

service:

580

# set type to NodePort if access to web needs access from outside the cluster

581

# for more info see https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types

582

type: ClusterIP

583

# The below clusterIP setting can be set to "None" to make the temporal-web service headless.

584

# Note that this requires the web.service.type to be the default ClusterIP value.

585

# clusterIP:

586

port: 8080

587

appProtocol: http

588

annotations: {}

589

# loadBalancerIP:

590

# Override the address the UI uses to connect to the Temporal frontend.

591

# Defaults to <fullname>-frontend.<namespace>.svc:<server.frontend.service.port>.

592

# Useful when running a proxy sidecar that intercepts gRPC traffic.

593

# temporalAddress: "localhost:7233"

594

readinessProbe:

595

initialDelaySeconds: 10

596

httpGet:

597

path: /healthz

598

port: http

599

ingress:

600

enabled: false

601

# className:

602

annotations: {}

603

# kubernetes.io/ingress.class: traefik

604

# ingress.kubernetes.io/ssl-redirect: "false"

605

# traefik.frontend.rule.type: PathPrefix

606

hosts:

607

- "/"

608

# - "domain.com/xyz"

609

# - "domain.com"

610

tls: []

611

# - secretName: chart-example-tls

612

# hosts:

613

# - chart-example.local

614

deploymentLabels: {}

615

deploymentAnnotations: {}

616

deploymentStrategy: {}

617

podAnnotations: {}

618

podLabels: {}

619

resources: {}

620

# We usually recommend not to specify default resources and to leave this as a conscious

621

# choice for the user. This also increases chances charts run on environments with little

622

# resources, such as Minikube. If you do want to specify resources, uncomment the following

623

# lines, adjust them as necessary, and remove the curly braces after 'resources:'.

624

# limits:

625

# cpu: 100m

626

# memory: 128Mi

627

# requests:

628

# cpu: 100m

629

# memory: 128Mi

630

nodeSelector: {}

631

tolerations: []

632

affinity: {}

633

additionalVolumes: []

634

additionalVolumeMounts: []

635

# Wire TLS for the connection from the Web UI to the frontend. Point at an

636

# existing kubernetes.io/tls secret; the chart mounts it and sets the

637

# TEMPORAL_TLS_* environment variables. The secret needs ca.crt to verify the

638

# frontend, plus tls.crt + tls.key when the frontend requires client

639

# certificates (server.tls.frontend.requireClientAuth: true).

640

tls:

641

enabled: false

642

secretName: ""

643

mountPath: /etc/temporal/tls

644

# DNS name expected in the frontend server certificate. Required when

645

# enableHostVerification is true.

646

serverName: ""

647

# Verify the frontend certificate against serverName.

648

enableHostVerification: false

649

# Adjust Web UI config with environment variables:

650

# https://docs.temporal.io/references/web-ui-environment-variables

651

additionalEnv: []

652

additionalEnvSecretName: ""

653

additionalEnvConfigMapName: ""

654

containerSecurityContext: {}

655

securityContext: {}

656

topologySpreadConstraints: []

657

schedulerName: ""

658

runtimeClassName: ""

659

priorityClassName: ""

660

minReadySeconds: 0

661

podDisruptionBudget: {}

662

serviceAccount: {}

663

schema:

664

# Use Helm hooks to ensure schema setup completes before server pods start.

665

# Set to false if using Flux, Rancher or Terraform.

666

useHelmHooks: true

667

backoffLimit: 100

668

activeDeadlineSeconds: null

669

ttlSecondsAfterFinished: 86400

670

jobAnnotations: {}

671

podAnnotations: {}

672

podLabels: {}

673

resources: {}

674

containerSecurityContext: {}

675

securityContext: {}

676

serviceAccount: {}

677

shims:

678

# Enable compatibility with Temporal 1.29 images. Set to true if using Temporal 1.29.

679

dockerize: false

680

# Enable compatibility with Temporal 1.29 images. Set to true if using Temporal 1.29.

681

elasticsearchTool: false

682

test:

683

podAnnotations: {}

684

podLabels: {}

685

resources: {}

686

nodeSelector: {}

687

tolerations: []

688

affinity: {}

689

serviceAccount: {}

690

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

temporal

The trusted source for open source

Product

Solutions

Customers

Resources

Company