API Reference #

Packages #

temporal.bmor10.com/v1alpha1

temporal.bmor10.com/v1alpha1 #

Conversion / hub-and-spoke notes:

v1alpha1 is currently the one and only API version, and is marked as the storage version (see the +kubebuilder:storageversion markers on the root types). When a v1beta1 is introduced, v1alpha1 will become the conversion “hub”: all spoke versions convert to and from it, and conversion webhooks will be wired in here (via the conversion.Convertible / conversion.Hub interfaces from sigs.k8s.io/controller-runtime). Keeping this groundwork explicit now ensures the storage version is unambiguous and that adding a new version later is a localized change.

Package v1alpha1 contains API Schema definitions for the temporal v1alpha1 API group.

ArchivalSpec #

ArchivalSpec is a passthrough for cluster-wide archival configuration.

Appears in:

TemporalClusterSpec

Field	Description	Default	Validation
`history` RawExtension			Optional: {}
`visibility` RawExtension			Optional: {}

AuthorizationSpec #

AuthorizationSpec configures the frontend authorizer, claim mapper, and JWT key provider used to validate inbound bearer tokens.

Appears in:

TemporalClusterSpec

Field	Description	Validation
`authorizer` string	Authorizer selects the Temporal authorizer plugin. If unset, it defaults to “default” (per-namespace RBAC) when JWT validation is configured. Set it to "" to select the no-op (allow-all) authorizer for authenticate-only mode.	Optional: {}
`claimMapper` string	ClaimMapper is the Temporal claim mapper. Defaults to “default” when JWT validation is configured.	Optional: {}
`permissionsClaimName` string	PermissionsClaimName maps to global.authorization.permissionsClaimName. Defaults to “roles” when Entra is set, otherwise “permissions”.	Optional: {}
`jwtKeyProvider` JWTKeyProviderSpec	JWTKeyProvider configures JWKS-based token signature validation.	Optional: {}
`entra` EntraAuthSpec	Entra derives the Entra JWKS keySourceURI from a tenant ID and applies sensible JWT defaults.	Optional: {}
`config` RawExtension	Config is a passthrough merged into the authorization block for any knob not modeled above.	Optional: {}

AzureWorkloadIdentitySpec #

AzureWorkloadIdentitySpec configures passwordless Microsoft Entra auth for a cluster’s SQL datastores via Azure Workload Identity. The operator expands it into a ServiceAccount, token sidecar/initContainers, and passwordCommand wiring in the cluster’s namespace.

Appears in:

PersistenceSpec

Field	Description	Validation
`clientId` string	ClientID is the Azure managed-identity / app-registration client ID used for the ServiceAccount’s azure.workload.identity/client-id annotation.
`scope` string	Scope is the Entra token scope requested for the database. Defaults to “https://ossrdbms-aad.database.windows.net/.default".	Optional: {}
`serviceAccountName` string	ServiceAccountName overrides the generated ServiceAccount name (default “-azure”).	Optional: {}
`image` string	Image overrides the azure-cli image used by the token sidecar / initContainers (default “mcr.microsoft.com/azure-cli:2.87.0”).	Optional: {}
`refreshInterval` Duration	RefreshInterval is how often the server-pod sidecar refreshes the token (default 30m).	Optional: {}

CalendarRange #

CalendarRange is an inclusive [Start,End] range with an optional Step.

Appears in:

StructuredCalendarSpec

Field	Default	Validation
`start` integer
`end` integer		Optional: {}
`step` integer	1	Optional: {}

CassandraDatastoreSpec #

CassandraDatastoreSpec configures a Cassandra datastore.

Appears in:

DatastoreSpec

Field	Default	Validation
`hosts` string array		MinItems: 1
`port` integer	9042	Maximum: 65535 Minimum: 1
`keyspace` string
`user` string		Optional: {}
`passwordSecretRef` SecretKeyReference		Optional: {}
`datacenter` string		Optional: {}
`replicationFactor` integer	1	Minimum: 1 Optional: {}
`tls` DatastoreTLSSpec		Optional: {}

CertificateAuthoritySpec #

CertificateAuthoritySpec configures a certificate authority.

Appears in:

MTLSSpec

Field	Description	Default	Validation
`secretName` string			Optional: {}
`duration` Duration			Optional: {}

ClusterConnectionPeer #

ClusterConnectionPeer identifies one cluster in a replication group. Exactly one of ClusterRef or FrontendAddress must be set.

Appears in:

TemporalClusterConnectionSpec

Field	Description	Default	Validation
`name` string	Name is the replication-group cluster name (== clusterMetadata.currentClusterName).
`clusterRef` ClusterReference	ClusterRef points at a local TemporalCluster CR. The operator resolves its frontend address and reuses its CA automatically.		Optional: {}
`frontendAddress` string	FrontendAddress is an external peer’s gRPC frontend address (host:port).		Optional: {}
`tlsSecretRef` SecretReference	TLSSecretRef supplies mTLS material for an external peer. Ignored for ClusterRef peers (the cluster CA is reused).		Optional: {}
`enableConnection` boolean	EnableConnection toggles replication traffic without removing the peer.	true	Optional: {}

ClusterMetadataSpec #

ClusterMetadataSpec configures multi-cluster replication.

Appears in:

TemporalClusterSpec

Field	Description	Default	Validation
`enableGlobalNamespace` boolean			Optional: {}
`failoverVersionIncrement` integer			Minimum: 1 Optional: {}
`currentClusterName` string			MinLength: 1 Optional: {}
`initialFailoverVersion` integer			Minimum: 1 Optional: {}
`masterClusterName` string			MinLength: 1 Optional: {}

ClusterReference #

ClusterReference points at a Temporal frontend in the same Kubernetes namespace: either a TemporalCluster (default) or a TemporalDevServer.

Appears in:

ClusterConnectionPeer
TemporalClusterClientSpec
TemporalNamespaceSpec
TemporalScheduleSpec
TemporalSearchAttributeSpec
TemporalWorkflowRunSpec

Field	Description	Default	Validation
`name` string	Name is the name of the referenced object.
`kind` string	Kind selects the referenced object type.	TemporalCluster	Enum: [TemporalCluster TemporalDevServer] Optional: {}

DatastoreSpec #

DatastoreSpec configures a single datastore. Exactly one backend should be set.

Appears in:

PersistenceSpec

Field	Description	Default	Validation
`sql` SQLDatastoreSpec			Optional: {}
`cassandra` CassandraDatastoreSpec			Optional: {}
`elasticsearch` ElasticsearchDatastoreSpec			Optional: {}
`schemaVersion` string	SchemaVersion is either “auto” (operator-managed migrations) or a pinned schema version string.	auto	Optional: {}

DatastoreTLSSpec #

DatastoreTLSSpec configures TLS for a datastore connection.

Appears in:

CassandraDatastoreSpec
ElasticsearchDatastoreSpec
SQLDatastoreSpec

Field	Default	Validation
`enabled` boolean	true
`caSecretRef` SecretKeyReference		Optional: {}
`certSecretRef` SecretKeyReference		Optional: {}
`keySecretRef` SecretKeyReference		Optional: {}
`enableHostVerification` boolean		Optional: {}
`serverName` string		Optional: {}

DevServerEndpoints #

DevServerEndpoints reports the dev server’s resolved endpoints.

Appears in:

TemporalDevServerStatus

Field	Description	Default	Validation
`frontend` string	Frontend is the gRPC frontend endpoint (host:7233).		Optional: {}
`ui` string	UI is the Web UI endpoint (host:8233).		Optional: {}

DevServerStorageSpec #

DevServerStorageSpec configures SQLite storage.

Appears in:

TemporalDevServerSpec

Field	Description	Default	Validation
`type` string	Type selects ephemeral (emptyDir, wiped on restart) or Persistent (PVC).	Ephemeral	Enum: [Ephemeral Persistent] Optional: {}
`size` Quantity	Size is the PVC size when Type=Persistent. Default “1Gi”.		Optional: {}
`storageClassName` string	StorageClassName is the PVC storage class when Type=Persistent.		Optional: {}

DevServerUISpec #

DevServerUISpec controls the bundled Web UI.

Appears in:

TemporalDevServerSpec

Field	Description	Default	Validation
`enabled` boolean	Enabled toggles the bundled Web UI. Default true.	true

DynamicConfigConstraints #

DynamicConfigConstraints scopes a dynamic config value.

Appears in:

DynamicConfigValue

Field	Description	Default	Validation
`namespace` string			Optional: {}
`taskQueueName` string			Optional: {}
`taskQueueType` string			Optional: {}

DynamicConfigSpec #

DynamicConfigSpec is a passthrough for Temporal’s dynamic configuration.

Appears in:

TemporalClusterSpec

Field	Description	Default	Validation
`values` object (keys:string, values:DynamicConfigValue)	Values maps a dynamic config key to one or more constrained values.		Optional: {}

DynamicConfigValue #

DynamicConfigValue is a single dynamic config value with optional constraints.

Appears in:

DynamicConfigSpec

Field	Description	Default	Validation
`value` JSON	Value is an arbitrary JSON value for the dynamic config key. It may be a scalar (bool, number, string), object, or array.		Schemaless: {}
`constraints` DynamicConfigConstraints			Optional: {}

ElasticsearchDatastoreSpec #

ElasticsearchDatastoreSpec configures an Elasticsearch visibility store.

Appears in:

DatastoreSpec

Field	Default	Validation
`url` string
`version` string	v8	Enum: [v7 v8]
`username` string		Optional: {}
`passwordSecretRef` SecretKeyReference		Optional: {}
`indices` object (keys:string, values:string)		Optional: {}
`tls` DatastoreTLSSpec		Optional: {}

EndpointsStatus #

EndpointsStatus reports resolved cluster endpoints.

Appears in:

TemporalClusterStatus

Field	Description	Default	Validation
`frontend` string			Optional: {}
`ui` string			Optional: {}
`metrics` string			Optional: {}

EntraAuthSpec #

EntraAuthSpec is a Microsoft Entra convenience for server JWT validation.

Appears in:

AuthorizationSpec

Field	Description	Default	Validation
`tenantID` string	TenantID is the Entra (Azure AD) tenant. Derives the JWKS keySourceURI https://login.microsoftonline.com/{tenantID}/discovery/v2.0/keys.		MinLength: 1

EntraUIAuthSpec #

EntraUIAuthSpec is a Microsoft Entra convenience for UI OIDC login.

Appears in:

UIAuthSpec

Field	Description	Default	Validation
`tenantID` string			MinLength: 1

FrontendMTLSSpec #

FrontendMTLSSpec configures the frontend certificate.

Appears in:

MTLSSpec

Field	Description	Default	Validation
`secretName` string			Optional: {}
`dnsNames` string array			Optional: {}

InternalFrontendSpec #

InternalFrontendSpec configures the optional internal-frontend service.

Appears in:

ServicesSpec

Field	Default	Validation
`enabled` boolean	false
`replicas` integer	1	Minimum: 1 Optional: {}
`resources` ResourceRequirements		Optional: {}

IntervalSpec #

IntervalSpec matches times of epoch + n*Every + Offset.

Appears in:

ScheduleSpec

Field	Description	Default	Validation
`every` Duration
`offset` Duration			Optional: {}

IssuerReference #

IssuerReference references a cert-manager Issuer or ClusterIssuer.

Appears in:

MTLSSpec

Field	Default	Validation
`name` string
`kind` string	Issuer	Enum: [Issuer ClusterIssuer] Optional: {}
`group` string	cert-manager.io	Optional: {}

JWTKeyProviderSpec #

JWTKeyProviderSpec configures JWKS-based JWT validation.

Appears in:

AuthorizationSpec

Field	Description	Default	Validation
`keySourceURIs` string array	KeySourceURIs are JWKS endpoints used to validate token signatures.		Optional: {}
`refreshInterval` Duration	RefreshInterval controls how often keys are refreshed, e.g. “1m”.		Optional: {}

MTLSSpec #

MTLSSpec configures mutual TLS for the cluster.

Appears in:

TemporalClusterSpec

Field	Description	Default	Validation
`provider` string	Provider selects the certificate provider.	cert-manager	Enum: [cert-manager]
`issuerRef` IssuerReference	IssuerRef references the cert-manager issuer used to mint certificates. Required when provider is cert-manager.		Optional: {}
`internodeCA` CertificateAuthoritySpec	InternodeCA configures the internode certificate authority.		Optional: {}
`frontend` FrontendMTLSSpec	Frontend configures the frontend certificate.		Optional: {}
`refreshInterval` Duration	RefreshInterval is the certificate refresh interval.	720h	Optional: {}
`renewBefore` Duration	RenewBefore is how long before expiry a certificate is renewed.	240h	Optional: {}

MetricsSpec #

MetricsSpec configures Prometheus integration.

Appears in:

TemporalClusterSpec

Field	Default	Validation
`enabled` boolean	true
`port` integer	9090	Maximum: 65535 Minimum: 1 Optional: {}
`serviceMonitor` ServiceMonitorSpec		Optional: {}

NamespaceReplicationStatus #

NamespaceReplicationStatus reports the observed replication state.

Appears in:

TemporalNamespaceStatus

Field	Description	Default	Validation
`isGlobal` boolean			Optional: {}
`activeCluster` string			Optional: {}
`clusters` string array			Optional: {}
`failoverInProgress` boolean			Optional: {}
`lastFailoverTime` Time			Optional: {}

PeerConnectionStatus #

PeerConnectionStatus reports the observed state of one peer.

Appears in:

TemporalClusterConnectionStatus

Field	Description	Validation
`name` string
`reachable` boolean	Reachable is true when the operator could connect to this peer’s frontend.	Optional: {}
`connected` boolean	Connected is true when this peer appears as an enabled remote cluster on the other reachable peers.	Optional: {}
`message` string		Optional: {}

PersistenceSpec #

PersistenceSpec configures the default and visibility datastores.

Appears in:

TemporalClusterSpec

Field	Description	Validation
`defaultStore` DatastoreSpec	DefaultStore holds workflow execution state. Exactly one of sql or cassandra must be set.
`visibilityStore` DatastoreSpec	VisibilityStore holds visibility records. One of sql, cassandra, or elasticsearch must be set.
`schemaJob` SchemaJobSpec	SchemaJob customizes the schema setup/update Jobs the operator runs.	Optional: {}
`azureWorkloadIdentity` AzureWorkloadIdentitySpec	AzureWorkloadIdentity, when set, makes this cluster authenticate to its SQL datastore(s) passwordlessly using Azure Workload Identity. The operator generates a ServiceAccount, token sidecar/initContainers, and the passwordCommand wiring in the cluster’s namespace; the operator itself holds no database credential. SQL stores only.	Optional: {}

PersistenceStatus #

PersistenceStatus reports datastore reachability and schema state.

Appears in:

TemporalClusterStatus

Field	Description	Validation
`schemaVersions` object (keys:string, values:string)	SchemaVersions maps a store name to its observed schema version.	Optional: {}
`history` SchemaUpgradeRecord array	History records schema upgrades applied by the operator.	Optional: {}
`reachable` boolean	Reachable indicates whether the datastores were reachable at last reconcile.	Optional: {}

PodTemplateOverride #

PodTemplateOverride carries metadata and a strategic-merge pod spec override.

Appears in:

SchemaJobSpec
ServiceOverrides
ServiceSpec

Field	Description	Validation
`labels` object (keys:string, values:string)		Optional: {}
`annotations` object (keys:string, values:string)		Optional: {}
`spec` RawExtension	Spec is a partial PodSpec (strategic-merge patch) merged onto the generated pod template. It is stored as an opaque object to keep the CRD schema small.	Optional: {}

RetryPolicySpec #

RetryPolicySpec is the retry policy for the started workflow.

Appears in:

StartWorkflowAction

Field	Description	Validation
`initialInterval` Duration		Optional: {}
`backoffCoefficient` string	BackoffCoefficient is a decimal string (e.g. “2.0”) parsed to float64.	Optional: {}
`maximumInterval` Duration		Optional: {}
`maximumAttempts` integer		Optional: {}
`nonRetryableErrorTypes` string array		Optional: {}

SQLDatastoreSpec #

SQLDatastoreSpec configures a SQL (Postgres/MySQL) datastore.

Appears in:

DatastoreSpec

Field	Description	Default	Validation
`pluginName` string	PluginName selects the SQL driver.	postgres12	Enum: [postgres12 postgres12_pgx mysql8]
`host` string
`port` integer		5432	Maximum: 65535 Minimum: 1
`database` string
`user` string
`passwordSecretRef` SecretKeyReference	PasswordSecretRef references a secret containing the password. Required for password authentication.		Optional: {}
`passwordCommandSecretRef` SecretKeyReference	PasswordCommandSecretRef references a secret holding a command that emits a short-lived credential (Temporal 1.31+ IAM auth).		Optional: {}
`connectAttributes` object (keys:string, values:string)			Optional: {}
`maxConns` integer			Minimum: 1 Optional: {}
`maxIdleConns` integer			Minimum: 1 Optional: {}
`maxConnLifetime` Duration			Optional: {}
`tls` DatastoreTLSSpec			Optional: {}

ScheduleActionSpec #

ScheduleActionSpec is the action taken when the schedule fires.

Appears in:

TemporalScheduleSpec

Field	Description	Default	Validation
`startWorkflow` StartWorkflowAction

SchedulePoliciesSpec #

SchedulePoliciesSpec tunes overlap/catchup behavior.

Appears in:

TemporalScheduleSpec

Field	Description	Default	Validation
`overlapPolicy` string			Enum: [Skip BufferOne BufferAll CancelOther TerminateOther AllowAll] Optional: {}
`catchupWindow` Duration			Optional: {}
`pauseOnFailure` boolean			Optional: {}
`keepOriginalWorkflowID` boolean			Optional: {}

ScheduleSpec #

ScheduleSpec is the set of times an action should occur at.

Appears in:

TemporalScheduleSpec

Field	Description	Validation
`calendars` string array	Calendars holds cron strings (5/6/7 field, or @daily etc).	Optional: {}
`intervals` IntervalSpec array	Intervals fire every Every (plus optional Offset/phase).	Optional: {}
`structuredCalendar` StructuredCalendarSpec array	StructuredCalendar gives field-level control without cron syntax.	Optional: {}
`excludeStructuredCalendar` StructuredCalendarSpec array	ExcludeStructuredCalendar subtracts matching times.	Optional: {}
`startTime` Time	StartTime bounds the schedule start (inclusive).	Optional: {}
`endTime` Time	EndTime bounds the schedule end (inclusive).	Optional: {}
`jitter` Duration	Jitter randomizes each action time by 0..Jitter.	Optional: {}
`timezoneName` string	TimezoneName interprets calendar specs (IANA name; defaults to UTC).	Optional: {}

ScheduleStateSpec #

ScheduleStateSpec controls pause and action-limit state.

Appears in:

TemporalScheduleSpec

Field	Description	Default	Validation
`paused` boolean			Optional: {}
`notes` string			Optional: {}
`limitedActions` boolean			Optional: {}
`remainingActions` integer			Optional: {}

SchemaJobSpec #

SchemaJobSpec customizes the schema management Jobs (setup-schema / update-schema) the operator runs against SQL and Cassandra datastores.

Appears in:

PersistenceSpec

Field	Description	Default	Validation
`podTemplate` PodTemplateOverride	PodTemplate overrides metadata and the pod spec of the schema Job pods. Use it to attach a ServiceAccount, pod labels (e.g. Azure Workload Identity), and a token initContainer so the Job can authenticate with a passwordCommand instead of a static password.		Optional: {}

SchemaUpgradeRecord #

SchemaUpgradeRecord records a single schema migration.

Appears in:

PersistenceStatus

Field	Description	Default	Validation
`store` string
`fromVersion` string
`toVersion` string
`time` Time

SecretKeyReference #

SecretKeyReference references a single key within a Secret in the same namespace.

Appears in:

CassandraDatastoreSpec
DatastoreTLSSpec
ElasticsearchDatastoreSpec
SQLDatastoreSpec
UIAuthSpec

Field	Description	Default	Validation
`name` string
`key` string		password	Optional: {}

SecretReference #

SecretReference points at a Secret in the same namespace holding TLS material for connecting to an external Temporal peer. Keys default to the conventional “ca.crt”, “tls.crt”, “tls.key” when the overrides are empty.

Appears in:

ClusterConnectionPeer

Field	Description	Validation
`name` string	Name is the Secret name.
`caKey` string	CAKey is the Secret key holding the CA bundle. Defaults to “ca.crt”.	Optional: {}
`certKey` string	CertKey is the Secret key holding the client certificate. Defaults to “tls.crt”.	Optional: {}
`keyKey` string	KeyKey is the Secret key holding the client private key. Defaults to “tls.key”.	Optional: {}

ServiceExposureSpec #

ServiceExposureSpec configures how a service is exposed.

Appears in:

ServiceSpec
TemporalDevServerSpec

Field	Description	Default	Validation
`type` ServiceType		ClusterIP	Enum: [ClusterIP NodePort LoadBalancer] Optional: {}
`annotations` object (keys:string, values:string)			Optional: {}

ServiceMonitorSpec #

ServiceMonitorSpec configures a Prometheus Operator ServiceMonitor.

Appears in:

MetricsSpec

Field	Default	Validation
`enabled` boolean	false
`interval` Duration		Optional: {}
`labels` object (keys:string, values:string)		Optional: {}

ServiceOverrides #

ServiceOverrides are shared defaults applied across services.

Appears in:

ServicesSpec

Field	Description	Default	Validation
`podTemplate` PodTemplateOverride			Optional: {}

ServiceSpec #

ServiceSpec configures a single Temporal service deployment.

Appears in:

ServicesSpec

Field	Default	Validation
`replicas` integer	1	Minimum: 1 Optional: {}
`resources` ResourceRequirements		Optional: {}
`podTemplate` PodTemplateOverride		Optional: {}
`service` ServiceExposureSpec		Optional: {}
`nodeSelector` object (keys:string, values:string)		Optional: {}
`tolerations` Toleration array		Optional: {}
`affinity` Affinity		Optional: {}
`topologySpreadConstraints` TopologySpreadConstraint array		Optional: {}

ServiceStatus #

ServiceStatus reports the readiness of a single service.

Appears in:

TemporalClusterStatus

Field	Description	Default	Validation
`ready` integer			Optional: {}
`desired` integer			Optional: {}
`version` string			Optional: {}

ServicesSpec #

ServicesSpec configures each Temporal service plus shared overrides.

Appears in:

TemporalClusterSpec

Field	Description	Validation
`frontend` ServiceSpec		Optional: {}
`history` ServiceSpec		Optional: {}
`matching` ServiceSpec		Optional: {}
`worker` ServiceSpec		Optional: {}
`internalFrontend` InternalFrontendSpec		Optional: {}
`overrides` ServiceOverrides	Overrides are applied to every service unless overridden per-service.	Optional: {}

StartWorkflowAction #

StartWorkflowAction starts a workflow when the schedule fires.

Appears in:

ScheduleActionSpec
TemporalWorkflowRunSpec

Field	Description	Validation
`workflowType` string
`taskQueue` string
`workflowID` string		Optional: {}
`args` RawExtension array	Args are JSON-serializable workflow inputs (one json/plain payload each).	Optional: {}
`workflowExecutionTimeout` Duration		Optional: {}
`workflowRunTimeout` Duration		Optional: {}
`workflowTaskTimeout` Duration		Optional: {}
`workflowIDReusePolicy` string		Enum: [AllowDuplicate AllowDuplicateFailedOnly RejectDuplicate TerminateIfRunning] Optional: {}
`retryPolicy` RetryPolicySpec		Optional: {}
`memo` object (keys:string, values:RawExtension)		Optional: {}
`searchAttributes` object (keys:string, values:RawExtension)		Optional: {}

StructuredCalendarSpec #

StructuredCalendarSpec describes calendar times as field ranges.

Appears in:

ScheduleSpec

Field	Description	Default	Validation
`second` CalendarRange array			Optional: {}
`minute` CalendarRange array			Optional: {}
`hour` CalendarRange array			Optional: {}
`dayOfMonth` CalendarRange array			Optional: {}
`month` CalendarRange array			Optional: {}
`year` CalendarRange array			Optional: {}
`dayOfWeek` CalendarRange array			Optional: {}
`comment` string			Optional: {}

TemporalCluster #

TemporalCluster is the Schema for the temporalclusters API.

Field	Description	Validation
`apiVersion` string	`temporal.bmor10.com/v1alpha1`
`kind` string	`TemporalCluster`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` TemporalClusterSpec	spec defines the desired state of TemporalCluster	Required: {}

TemporalClusterClient #

TemporalClusterClient is the Schema for the temporalclusterclients API.

Field	Description	Validation
`apiVersion` string	`temporal.bmor10.com/v1alpha1`
`kind` string	`TemporalClusterClient`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` TemporalClusterClientSpec	spec defines the desired state of TemporalClusterClient	Required: {}

TemporalClusterClientSpec #

TemporalClusterClientSpec defines the desired state of TemporalClusterClient.

Appears in:

TemporalClusterClient

Field	Description	Default	Validation
`clusterRef` ClusterReference	ClusterRef references the cluster to generate client credentials for. Client credentials are only available for mTLS-enabled TemporalClusters.
`secretName` string	SecretName is the name of the Secret to write generated client credentials into. Defaults to the resource name when empty.		Optional: {}

TemporalClusterConnection #

TemporalClusterConnection is the Schema for the temporalclusterconnections API.

Field	Description	Validation
`apiVersion` string	`temporal.bmor10.com/v1alpha1`
`kind` string	`TemporalClusterConnection`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` TemporalClusterConnectionSpec		Required: {}

TemporalClusterConnectionSpec #

TemporalClusterConnectionSpec defines a multi-cluster replication group and drives automatic remote-cluster connection registration between its peers.

Appears in:

TemporalClusterConnection

Field	Description	Default	Validation
`peers` ClusterConnectionPeer array	Peers participating in replication. At least two are required. Each peer’s Name must equal that cluster’s clusterMetadata.currentClusterName.		MinItems: 2

TemporalClusterSpec #

TemporalClusterSpec defines the desired state of TemporalCluster.

Appears in:

TemporalCluster

Field	Description	Default	Validation
`version` string	Version is the Temporal server version, e.g. “1.31.1”.		Pattern: `^\d+\.\d+\.\d+$`
`numHistoryShards` integer	NumHistoryShards is the number of history shards. IMMUTABLE after creation. Choose carefully: 512 small prod, 4096 large prod.	512	Maximum: 16384 Minimum: 1
`image` string	Image is the Temporal server image. Default: temporalio/server:.		Optional: {}
`imagePullSecrets` LocalObjectReference array	ImagePullSecrets references secrets for pulling the server image.		Optional: {}
`services` ServicesSpec	Services configures each Temporal service.		Optional: {}
`persistence` PersistenceSpec	Persistence configures the default and visibility datastores. Required.
`mtls` MTLSSpec	MTLS configures mutual TLS (cert-manager-driven by default).		Optional: {}
`dynamicConfig` DynamicConfigSpec	DynamicConfig is a passthrough for Temporal’s dynamic config.		Optional: {}
`ui` UISpec	UI configures temporal-ui as part of this cluster.		Optional: {}
`metrics` MetricsSpec	Metrics configures Prometheus integration.		Optional: {}
`archival` ArchivalSpec	Archival configures cluster-wide archival enablement.		Optional: {}
`authorization` AuthorizationSpec	Authorization configures the authorizer and claim mapper.		Optional: {}
`clusterMetadata` ClusterMetadataSpec	ClusterMetadata configures multi-cluster replication.		Optional: {}
`preventDeletion` boolean	PreventDeletion, when true, blocks deletion of the cluster via the validating webhook as a safety measure.		Optional: {}
`workflowRunPolicy` WorkflowRunPolicy	WorkflowRunPolicy gates operator-initiated TemporalWorkflowRun executions against this cluster. Absent means disabled (closed by default).		Optional: {}

TemporalDevServer #

TemporalDevServer is the Schema for the temporaldevservers API.

Field	Description	Validation
`apiVersion` string	`temporal.bmor10.com/v1alpha1`
`kind` string	`TemporalDevServer`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` TemporalDevServerSpec	spec defines the desired state of TemporalDevServer	Required: {}

TemporalDevServerSpec #

TemporalDevServerSpec defines the desired state of TemporalDevServer.

A TemporalDevServer runs a single-pod, disposable temporal server start-dev instance backed by SQLite. It is NOT for production use.

Appears in:

TemporalDevServer

Field	Description	Validation
`version` string	Version is the Temporal server version to run, e.g. “1.31.1”. The operator maps it to the matching temporalio/temporal CLI image via the supported version matrix. When empty, the latest supported server version is used. Use Image to pin a specific CLI image directly.	Optional: {}
`image` string	Image overrides the full image reference. Default temporalio/temporal:.	Optional: {}
`imagePullSecrets` LocalObjectReference array	ImagePullSecrets references secrets for pulling the image.	Optional: {}
`namespaces` string array	Namespaces are extra Temporal namespaces created at startup, in addition to the always-present “default” namespace. These are created once at boot with no drift management; use TemporalNamespace CRs for managed namespaces.	Optional: {}
`ui` DevServerUISpec	UI controls the bundled Temporal Web UI (port 8233).	Optional: {}
`storage` DevServerStorageSpec	Storage selects ephemeral (default) or PVC-backed SQLite storage.	Optional: {}
`service` ServiceExposureSpec	Service configures how the frontend/UI Service is exposed.	Optional: {}
`resources` ResourceRequirements	Resources sets the dev server container resource requirements.	Optional: {}
`nodeSelector` object (keys:string, values:string)	NodeSelector constrains the dev server pod to matching nodes.	Optional: {}
`tolerations` Toleration array	Tolerations applied to the dev server pod.	Optional: {}
`affinity` Affinity	Affinity applied to the dev server pod.	Optional: {}
`workflowRunPolicy` WorkflowRunPolicy	WorkflowRunPolicy gates operator-initiated TemporalWorkflowRun executions against this dev server. Absent means enabled with no allowlist.	Optional: {}

TemporalNamespace #

TemporalNamespace is the Schema for the temporalnamespaces API.

Field	Description	Validation
`apiVersion` string	`temporal.bmor10.com/v1alpha1`
`kind` string	`TemporalNamespace`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` TemporalNamespaceSpec	spec defines the desired state of TemporalNamespace	Required: {}

TemporalNamespaceSpec #

TemporalNamespaceSpec defines the desired state of TemporalNamespace.

Appears in:

TemporalNamespace

Field	Description	Default	Validation
`clusterRef` ClusterReference	ClusterRef references the TemporalCluster or TemporalDevServer that owns this namespace.
`retentionPeriod` Duration	RetentionPeriod is how long closed workflows are retained.	72h	Optional: {}
`description` string	Description is a human-friendly description of the namespace.		Optional: {}
`ownerEmail` string	OwnerEmail is the owner contact for the namespace.		Optional: {}
`allowDeletion` boolean	AllowDeletion permits the operator to delete the Temporal namespace when the CR is deleted. When false, the namespace is left in place.		Optional: {}
`driftDetection` string	DriftDetection controls whether the operator reconciles drift between the spec and the live namespace.	reconcile	Enum: [reconcile ignore] Optional: {}
`isGlobal` boolean	IsGlobal marks the namespace as global for multi-cluster replication.		Optional: {}
`clusters` string array	Clusters lists the cluster names this namespace is replicated to. Only meaningful when IsGlobal is true.		Optional: {}
`activeCluster` string	ActiveCluster is the authoritative cluster for this namespace. Changing it triggers an operator-executed failover. Only meaningful when IsGlobal.		Optional: {}

TemporalSchedule #

TemporalSchedule is the Schema for the temporalschedules API.

Field	Description	Validation
`apiVersion` string	`temporal.bmor10.com/v1alpha1`
`kind` string	`TemporalSchedule`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` TemporalScheduleSpec		Required: {}

TemporalScheduleSpec #

TemporalScheduleSpec defines the desired state of TemporalSchedule.

Appears in:

TemporalSchedule

Field	Description	Validation
`clusterRef` ClusterReference	ClusterRef references the TemporalCluster or TemporalDevServer that hosts this schedule.
`namespace` string	Namespace is the Temporal namespace the schedule lives in.
`scheduleID` string	ScheduleID is the Temporal schedule ID. Defaults to metadata.name. Immutable once set.	Optional: {}
`allowDeletion` boolean	AllowDeletion permits the operator to delete the Temporal schedule when the CR is deleted. When false, the schedule is left in place.	Optional: {}
`schedule` ScheduleSpec	Schedule describes when the action fires.
`action` ScheduleActionSpec	Action describes what to do when the schedule fires.
`policies` SchedulePoliciesSpec	Policies tunes overlap/catchup/pause-on-failure behavior.	Optional: {}
`state` ScheduleStateSpec	State controls pause and action-limit state.	Optional: {}

TemporalSearchAttribute #

TemporalSearchAttribute is the Schema for the temporalsearchattributes API.

Field	Description	Validation
`apiVersion` string	`temporal.bmor10.com/v1alpha1`
`kind` string	`TemporalSearchAttribute`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` TemporalSearchAttributeSpec	spec defines the desired state of TemporalSearchAttribute	Required: {}

TemporalSearchAttributeSpec #

TemporalSearchAttributeSpec defines the desired state of TemporalSearchAttribute.

Appears in:

TemporalSearchAttribute

Field	Description	Validation
`clusterRef` ClusterReference	ClusterRef references the TemporalCluster or TemporalDevServer this search attribute belongs to.
`namespace` string	Namespace is the Temporal namespace to register the attribute in.
`name` string	Name is the search attribute name.
`type` string	Type is the search attribute type. Immutable once created.	Enum: [Keyword Text Int Double Bool Datetime KeywordList]
`allowDeletion` boolean	AllowDeletion permits the operator to remove the search attribute from the namespace when the CR is deleted.	Optional: {}

TemporalWorkflowRun #

TemporalWorkflowRun is the Schema for the temporalworkflowruns API.

Field	Description	Validation
`apiVersion` string	`temporal.bmor10.com/v1alpha1`
`kind` string	`TemporalWorkflowRun`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` TemporalWorkflowRunSpec		Required: {}

TemporalWorkflowRunSpec #

TemporalWorkflowRunSpec defines the desired state of a one-off workflow run.

Appears in:

TemporalWorkflowRun

Field	Description	Default	Validation
`clusterRef` ClusterReference	ClusterRef references the TemporalCluster or TemporalDevServer that runs the workflow. Resolved in the same Kubernetes namespace as this CR.
`namespace` string	Namespace is the Temporal namespace to start the workflow in.
`workflow` StartWorkflowAction	Workflow describes the one-off workflow to start. Immutable after create.
`ttlSecondsAfterFinished` integer	TTLSecondsAfterFinished, when set, deletes this CR that many seconds after the workflow reaches a terminal state. Unset keeps the CR indefinitely.		Optional: {}
`cancellationPolicy` string	CancellationPolicy controls what happens to a still-running workflow when this CR is deleted.	Abandon	Enum: [Abandon Cancel Terminate] Optional: {}

UIAuthSpec #

UIAuthSpec configures temporal-ui OIDC authentication.

Appears in:

UISpec

Field	Description	Default	Validation
`enabled` boolean		false
`entra` EntraUIAuthSpec	Entra derives ProviderURL from a Microsoft Entra tenant ID.		Optional: {}
`providerURL` string	ProviderURL is the OIDC issuer URL (set directly or via Entra).		Optional: {}
`clientID` string			Optional: {}
`clientSecretRef` SecretKeyReference	ClientSecretRef references a Secret key holding the OIDC client secret.		Optional: {}
`scopes` string array	Scopes default to [“openid”, “profile”, “email”].		Optional: {}
`callbackURL` string			Optional: {}
`extraEnv` RawExtension	ExtraEnv is a passthrough of additional temporal-ui auth env vars (map of string to string).		Optional: {}

UICodecServerSpec #

UICodecServerSpec configures the temporal-ui codec server.

Appears in:

UISpec

Field	Description	Default	Validation
`endpoint` string
`passAccessToken` boolean			Optional: {}
`includeCredentials` boolean			Optional: {}

UIIngressSpec #

UIIngressSpec configures ingress for temporal-ui.

Appears in:

UISpec

Field	Default	Validation
`enabled` boolean	false
`ingressClassName` string		Optional: {}
`host` string		Optional: {}
`annotations` object (keys:string, values:string)		Optional: {}
`tlsSecretName` string		Optional: {}

UISpec #

UISpec configures temporal-ui.

Appears in:

TemporalClusterSpec

Field	Description	Default	Validation
`enabled` boolean		false
`version` string			Optional: {}
`replicas` integer		1	Minimum: 1 Optional: {}
`ingress` UIIngressSpec			Optional: {}
`auth` UIAuthSpec	Auth configures temporal-ui authentication (OIDC, e.g. Microsoft Entra).		Optional: {}
`codecServer` UICodecServerSpec			Optional: {}

UpgradeStatus #

UpgradeStatus reports the state of an in-progress version upgrade.

Appears in:

TemporalClusterStatus

Field	Description	Validation
`fromVersion` string		Optional: {}
`toVersion` string		Optional: {}
`phase` string		Optional: {}
`rollbackable` boolean	Rollbackable is true until schema migration begins, after which a rollback is no longer safe.	Optional: {}
`startedAt` Time		Optional: {}

WorkflowRunFailure #

WorkflowRunFailure carries failure detail for non-success terminal states.

Appears in:

TemporalWorkflowRunStatus

Field	Description	Default	Validation
`message` string			Optional: {}
`type` string			Optional: {}

WorkflowRunPolicy #

WorkflowRunPolicy is a per-target opt-in gate controlling operator-initiated workflow runs. It is declared on a TemporalCluster or TemporalDevServer by the cluster owner. Defaults differ per kind and are applied by the controller’s target resolver, not by kubebuilder defaults, so an absent policy is meaningful: disabled for TemporalCluster, enabled (no allowlist) for TemporalDevServer.

Appears in:

TemporalClusterSpec
TemporalDevServerSpec

Field	Description	Validation
`enabled` boolean	Enabled permits operator-initiated workflow runs against this target.	Optional: {}
`allowedNamespaces` string array	AllowedNamespaces optionally restricts which Temporal namespaces runs may target. Empty means any namespace is allowed.	Optional: {}
`allowedTaskQueues` string array	AllowedTaskQueues optionally restricts which task queues runs may use. Empty means any task queue is allowed.	Optional: {}