Azure Database for PostgreSQL Flexible Server (password auth)

A TemporalCluster backed by Azure Database for PostgreSQL Flexible Server using password authentication over TLS. This is the simplest Azure persistence option and works with the operator today.

Prerequisites #

A Flexible Server instance reachable from your AKS cluster (public access with firewall rules, or private access / VNet integration).
Two databases created on the server before applying this manifest — the operator runs setup-schema but does not create databases:
```
CREATE DATABASE temporal;
CREATE DATABASE temporal_visibility;
```
max_connections raised on the server (Server parameters blade). Temporal opens several pools per pod; the small-SKU default can be exhausted. ~200 is a safe starting point.

Apply #

Edit temporalcluster.yaml to set the server FQDN, user, and password, then:

kubectl apply -f temporalcluster.yaml

TLS is required by Flexible Server; tls.enabled: true is set on both stores. Azure’s certificate chains to a public root, so no CA secret is needed.

Manifests #

temporalcluster.yaml #

# Azure Database for PostgreSQL Flexible Server with password auth over TLS.
# Pre-create the `temporal` and `temporal_visibility` databases on the server
# before applying (the operator only runs setup-schema, it does not CREATE DATABASE).
apiVersion: v1
kind: Secret
metadata:
  name: temporal-flexible-store
type: Opaque
stringData:
  # Replace with the Flexible Server admin (or app) password.
  password: "REPLACE_ME"
---
apiVersion: temporal.bmor10.com/v1alpha1
kind: TemporalCluster
metadata:
  name: azure
spec:
  version: "1.31.1"
  numHistoryShards: 512
  ui:
    enabled: true
  persistence:
    defaultStore:
      sql:
        pluginName: postgres12
        # Flexible Server endpoint, e.g. my-temporal.postgres.database.azure.com
        host: REPLACE_ME.postgres.database.azure.com
        port: 5432
        database: temporal
        user: temporaladmin
        passwordSecretRef: { name: temporal-flexible-store, key: password }
        # Flexible Server requires TLS.
        tls: { enabled: true }
    visibilityStore:
      sql:
        pluginName: postgres12
        host: REPLACE_ME.postgres.database.azure.com
        port: 5432
        database: temporal_visibility
        user: temporaladmin
        passwordSecretRef: { name: temporal-flexible-store, key: password }
        tls: { enabled: true }