Temporal Workers Helm Migration Design

Date: 2026-01-04 Issue: #572 Status: Approved

Summary

Migrate the temporal-workers deployment from Kustomize manifests to a Helm chart published as an OCI artifact at oci://ghcr.io/fzymgc-house/charts/temporal-workers:1.1.1.

Decisions

Decision	Choice	Rationale
Workers to enable	Both (hello_world + terraform)	Full migration
Discord notifications	Disabled initially	Add channel_id later when ready
Vault policy	Separate temporal-worker-terraform role	Least privilege; hello_world doesn’t need Vault
ArgoCD structure	Multi-source (Helm + Kustomize)	Consistency with existing pattern; single Application manages dependencies
ExternalSecret	Remove	Workers fetch secrets directly from Vault at runtime
Vault secrets	User creates manually	Tokens handled outside GitOps

Changes

1. ArgoCD Application

File: argocd/cluster-app/templates/temporal-workers.yaml

Switch from Kustomize to multi-source Helm + Kustomize:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: temporal-workers
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  project: core-services
  sources:
    # Helm chart from OCI registry
    - repoURL: ghcr.io/fzymgc-house/charts
      chart: temporal-workers
      targetRevision: 1.1.1
      helm:
        valuesObject:
          global:
            vault:
              addr: https://vault.fzymgc.house
              role: temporal-worker-terraform
          workers:
            hello_world:
              enabled: true
            terraform:
              enabled: true
              config:
                hcp_terraform:
                  organization: fzymgc-house
                discord:
                  channel_id: ""  # TODO: Add Discord channel ID for notifications
    # Supporting resources (ServiceAccount, pull secret)
    - repoURL: https://github.com/fzymgc-house/selfhosted-cluster
      targetRevision: HEAD
      path: argocd/app-configs/temporal-workers
  destination:
    server: https://kubernetes.default.svc
    namespace: temporal
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

2. Vault Policy

File: tf/vault/policy-temporal.tf

Add new policy and Kubernetes auth role for terraform worker:

# Policy for terraform worker - scoped to specific paths
resource "vault_policy" "temporal_worker_terraform" {
  name = "temporal-worker-terraform"

  policy = <<-EOT
    # HCP Terraform token for drift detection workflows
    path "secret/data/fzymgc-house/cluster/temporal/hcp-terraform" {
      capabilities = ["read"]
    }

    # Discord bot token for notifications
    path "secret/data/fzymgc-house/cluster/temporal/discord" {
      capabilities = ["read"]
    }
  EOT
}

# Kubernetes auth role for terraform worker
resource "vault_kubernetes_auth_backend_role" "temporal_worker_terraform" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "temporal-worker-terraform"
  bound_service_account_names      = ["temporal-worker"]
  bound_service_account_namespaces = ["temporal"]
  audience                         = "https://kubernetes.default.svc.cluster.local"
  token_ttl                        = 3600
  token_policies                   = ["default", vault_policy.temporal_worker_terraform.name]
}

3. app-configs Cleanup

Directory: argocd/app-configs/temporal-workers/

• Keep: serviceaccount.yaml, ghcr-pull-secret.yaml
• Remove: secrets.yaml (ExternalSecret no longer needed)
• Update: kustomization.yaml to remove secrets.yaml reference

Post-Merge Steps

1. Create Vault secrets:

   vault kv put secret/fzymgc-house/cluster/temporal/hcp-terraform \
       token="<HCP_TERRAFORM_API_TOKEN>"
   
   vault kv put secret/fzymgc-house/cluster/temporal/discord \
       bot_token="<DISCORD_BOT_TOKEN>"

2. Verify deployment:

   • ArgoCD syncs Helm chart + supporting resources
   • Workers deploy to temporal namespace
   • terraform worker authenticates via temporal-worker-terraform role

3. Enable Discord notifications (later):

   • Update channel_id in ArgoCD Application values
   • Ensure discord secret exists

Out of Scope

• Removing old k8s/ directory from temporal-workers repo
• Defining terraform workspaces configuration