Temporal UI on AKS via Application Gateway (AGIC)

Exposes the Temporal Web UI through the Azure Application Gateway Ingress Controller (AGIC).

Prerequisites #

An AKS cluster with the AGIC add-on enabled (az aks enable-addons --addons ingress-appgw ...) or AGIC installed via Helm.
A DNS record pointing temporal.example.com at the Application Gateway public IP.
A working persistence backend — combine this with cluster-azure-postgres-flexible.

Apply #

kubectl apply -f temporalcluster.yaml

The ingressClassName: azure-application-gateway selects AGIC; the appgw.ingress.kubernetes.io/* annotations tune the Application Gateway backend. Add TLS via an appgw.ingress.kubernetes.io/appgw-ssl-certificate annotation or the UI ingress tlsSecretName field once you have a certificate provisioned.

Manifests #

temporalcluster.yaml #

# Temporal UI exposed on AKS via the Application Gateway Ingress Controller (AGIC).
# Persistence is shown inline; see cluster-azure-postgres-flexible for the
# Flexible Server setup details (databases, max_connections, TLS).
apiVersion: temporal.bmor10.com/v1alpha1
kind: TemporalCluster
metadata:
  name: azure-ui
spec:
  version: "1.31.1"
  numHistoryShards: 512
  ui:
    enabled: true
    ingress:
      enabled: true
      ingressClassName: azure-application-gateway
      host: temporal.example.com
      annotations:
        appgw.ingress.kubernetes.io/backend-protocol: "http"
        appgw.ingress.kubernetes.io/request-timeout: "300"
  persistence:
    defaultStore:
      sql:
        pluginName: postgres12
        host: REPLACE_ME.postgres.database.azure.com
        port: 5432
        database: temporal
        user: temporaladmin
        passwordSecretRef: { name: temporal-flexible-store, key: password }
        tls: { enabled: true }
    visibilityStore:
      sql:
        pluginName: postgres12
        host: REPLACE_ME.postgres.database.azure.com
        port: 5432
        database: temporal_visibility
        user: temporaladmin
        passwordSecretRef: { name: temporal-flexible-store, key: password }
        tls: { enabled: true }