feat: add support for Temporal Server v1.29, v1.30 and v1.31#987
Open
Azerothian wants to merge 1 commit into
Open
feat: add support for Temporal Server v1.29, v1.30 and v1.31#987Azerothian wants to merge 1 commit into
Azerothian wants to merge 1 commit into
Conversation
Adds operator support for Temporal Server v1.29, v1.30 and v1.31, extending the
supported version range to `>= 1.14.0 < 1.32.0` (default version 1.31.1, default
UI 2.49.1). All >= 1.30 behaviour is version-gated (version.V1_30_0 / V1_31_0);
clusters < 1.30 keep the previous dockerize/curl paths unchanged, so the operator
stays backward compatible across the whole supported range.
v1.29
- Version range/default bumps only. v1.29 is a dynamic-config-only release
(task-queue fairness, task-queue config API), already covered by the cluster
dynamicConfig field.
v1.30
- dockerize/auto-setup were removed from the temporalio/server image and config
templating moved into the server binary (embedded sprig engine). For clusters
>= 1.30 the operator now emits config templates with the `# enable-template`
header and sprig `{{ env "X" }}` placeholders (instead of dockerize
`{{ .Env.X }}`), sets TEMPORAL_SERVER_CONFIG_FILE_PATH, and selects the service
via the new TEMPORAL_SERVICES env var (legacy SERVICES kept for compatibility).
- curl and jq were removed from the temporalio/admin-tools image, which broke the
operator's Elasticsearch visibility setup scripts. For clusters >= 1.30 the
operator now drives ES visibility through the temporal-elasticsearch-tool
shipped in the image (setup-schema, create-index, update-schema), analogous to
temporal-sql-tool. Its embedded index template applies all built-in search
attributes automatically. The MTLS sidecar-shutdown step uses wget instead of
curl on >= 1.30.
- v1.30.0 has no published GitHub release upstream (silently skipped) and is now
rejected as a broken release; use v1.30.1+.
v1.31
- New sql.passwordCommand datastore field: resolves the datastore password by
running an external command (e.g. to generate a short-lived cloud IAM auth
token for AWS RDS / GCP Cloud SQL). Wired into both the rendered server config
and the persistence schema-setup jobs (temporal-sql-tool via a shell command
substitution). Mutually exclusive with passwordSecretRef and validated by the
webhook (rejected on clusters < 1.31 and when combined with a password secret).
Build / dependencies
- go directive bumped to 1.26.4 with the Dockerfile builder image updated to
match.
- go.temporal.io/server v1.31.1, go.temporal.io/api v1.62.8,
go.temporal.io/sdk v1.41.1, plus the associated Kubernetes dependency bumps.
Testing
- make test (unit + envtest) is green, including new unit tests that load the
generated 1.30 config through the real go.temporal.io/server config loader and
cover the passwordCommand and ES-tool script rendering.
- Validated end-to-end on a real RKE2 cluster (k8s v1.35): 1.29.7, 1.30.5 and
1.31.1 clusters each reach Ready=True with a working namespace-create +
workflow round-trip; the 1.30 sprig/entrypoint contract, passwordCommand auth
(including webhook rejection paths) and the temporal-elasticsearch-tool ES
visibility setup (index + v10-v13 built-in search attributes) were exercised
against real images.
Azerothian
marked this pull request as ready for review
July 9, 2026 13:02
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 |
| platforms: arm64 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 |
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Login to GitHub Container Registry | ||
| uses: docker/login-action@v3 |
|
|
||
| - name: Docker meta | ||
| id: meta | ||
| uses: docker/metadata-action@v5 |
| type=ref,event=tag | ||
|
|
||
| - name: Build and push operator docker image | ||
| uses: docker/build-push-action@v5 |
| check-latest: true | ||
|
|
||
| - name: Install Helm | ||
| uses: azure/setup-helm@v4 |
|
|
||
| - name: Login to GitHub Container Registry | ||
| run: | | ||
| echo "${{ secrets.GITHUB_TOKEN }}" | \ |
Azerothian
force-pushed
the
feat/temporal-1.31
branch
from
July 17, 2026 07:23
532f731 to
4fb3cb7
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds operator support for Temporal Server v1.29, v1.30 and v1.31. It was developed as a chained series (each version on top of the previous) and is presented here as a single PR spanning three minors — happy to split it into per-version PRs (1.29 → 1.30 → 1.31) if you'd prefer.
All
>= 1.30behaviour is version-gated (version.V1_30_0/V1_31_0); clusters< 1.30keep the previous dockerize/curl paths unchanged, so the operator stays backward compatible across>= 1.14.0 < 1.32.0.v1.29
Version range/default bumps only. v1.29 is a dynamic-config-only release (task-queue fairness & task-queue config API), already covered by the cluster
dynamicConfigfield.v1.30
Handles the breaking image changes:
dockerize/auto-setupwere removed fromtemporalio/serverand config templating moved into the server binary. For>= 1.30the operator emits the# enable-templateheader + sprig{{ env "X" }}placeholders, setsTEMPORAL_SERVER_CONFIG_FILE_PATH, and selects the service viaTEMPORAL_SERVICES(legacySERVICESkept for compatibility).curl/jqwere removed fromtemporalio/admin-tools, which broke ES visibility setup. The operator now drives ES visibility via thetemporal-elasticsearch-toolshipped in the image (setup-schema/create-index/update-schema); its embedded template applies all built-in search attributes automatically. The MTLS sidecar-shutdown step useswgetinstead ofcurl.v1.30.0(no upstream GitHub release) is rejected as a broken release.v1.31
New
sql.passwordCommanddatastore field (external command / cloud IAM auth token), wired into both the server config and the schema-setup jobs, webhook-validated and mutually exclusive withpasswordSecretRef.Build / deps
go.temporal.io/serverv1.31.1,go.temporal.io/apiv1.62.8,go.temporal.io/sdkv1.41.1, and associated Kubernetes dependency bumps.Testing
make test(unit + envtest) green, including new unit tests that load the generated 1.30 config through the realgo.temporal.io/serverconfig loader and cover thepasswordCommandand ES-tool script rendering.Ready=Truewith a working namespace-create + workflow round-trip; the 1.30 sprig/entrypoint contract,passwordCommandauth (incl. webhook rejection paths), and thetemporal-elasticsearch-toolES visibility setup (index + v10–v13 built-in search attributes) were each exercised against real images.Notes for reviewers
The go 1.26.4 toolchain requirement and dependency bumps are the widest-reaching parts; the ES visibility rewrite changes how ES-backed clusters bootstrap on
>= 1.30.