Following the REST API DB consolidation onto nico-pg-cluster (#3081/#3182), Temporal and Keycloak still run against the standalone postgres.postgres StatefulSet (rest-api/deploy/kustomize/base/postgres). To get to a single PG instance for the whole application stack, these need to move too.
Scope
- Temporal server (default + visibility stores) — currently
postgres.postgres.svc.cluster.local in temporal-helm/temporal/values.yaml
- Keycloak — DB currently provisioned in the same standalone StatefulSet
Why this needs a transition plan, not just a config flip
Both are stateful: Temporal holds workflow history, Keycloak holds realm/user data. Sites already deployed via setup.sh have live data in the standalone DB — switching the default host out from under them would orphan or lose it.
Proposed approach
- Add
temporal.enabled / keycloak.enabled gates on nico-pg-cluster in helm-prereqs/templates/postgresql.yaml, mirroring the existing rest.enabled / flow.enabled pattern
- Support both targets side by side: sites can keep pointing Temporal/Keycloak at the legacy
postgres.postgres DB via values override, or opt into nico-pg-cluster
- Document a migration path (dump/restore or equivalent) for sites moving existing Temporal/Keycloak data over, similar to how the REST DB cutover was handled
- Update
setup.sh comments/docs once done — they currently describe postgres.postgres as intentionally separate ("different service name... so Temporal and NICo values work without changes")
Following the REST API DB consolidation onto
nico-pg-cluster(#3081/#3182), Temporal and Keycloak still run against the standalonepostgres.postgresStatefulSet (rest-api/deploy/kustomize/base/postgres). To get to a single PG instance for the whole application stack, these need to move too.Scope
postgres.postgres.svc.cluster.localintemporal-helm/temporal/values.yamlWhy this needs a transition plan, not just a config flip
Both are stateful: Temporal holds workflow history, Keycloak holds realm/user data. Sites already deployed via
setup.shhave live data in the standalone DB — switching the default host out from under them would orphan or lose it.Proposed approach
temporal.enabled/keycloak.enabledgates onnico-pg-clusterinhelm-prereqs/templates/postgresql.yaml, mirroring the existingrest.enabled/flow.enabledpatternpostgres.postgresDB via values override, or opt intonico-pg-clustersetup.shcomments/docs once done — they currently describepostgres.postgresas intentionally separate ("different service name... so Temporal and NICo values work without changes")