k8s/messaging: add kafka kmsvc and temporal workflows

- Kafka 3-broker cluster (RF=3, min-ISR=2) - kmsvc SQS-like API on Kafka - Redis dedup (standalone, can extend to HA) - Temporal workflow orchestration (Cassandra backend)
2026-08-18 15:08:00 -07:00
parent a3f261f548
commit 69ad5c371c
38 changed files with 2072 additions and 0 deletions
@@ -0,0 +1,85 @@
+# k8s/temporal/temporal-values.yaml
+# Temporal — workflow engine for story-crater backend async task orchestration.
+# Chart: temporal/temporal from https://go.temporal.io/helm-charts
+#
+# Uses Cassandra for default store (workflow history/events)
+# Uses Elasticsearch for visibility store (namespace/workflow queries)
+# This is the chart's native, well-tested configuration.
+
+# ── Datastores configuration ────
+# Disable auto-deployed PostgreSQL (we use external ddb for other services)
+postgresql:
+  enabled: false
+
+# Enable Elasticsearch for visibility store (deployed to worker node, 2Gi/4Gi memory)
+elasticsearch:
+  enabled: true
+  scheme: http
+  host: temporal-elasticsearch
+  port: 9200
+  version: v7
+  logLevel: error
+  auth:
+    enabled: false
+  indices:
+    visibility: temporal_visibility_v1
+
+# Cassandra enabled for template validation; server.config overrides with actual hosts
+# Schema job template requires cassandra config to exist at top level
+cassandra:
+  enabled: true
+  replicas: 3
+  cluster:
+    seedSize: 1
+  port: 9042
+
+# ── Disable schema auto-setup (will initialize manually) ─────────
+jobs:
+  autoSetup:
+    enabled: false
+
+# ── Temporal server config (Cassandra + Elasticsearch persistence) ──────────────────────────────
+server:
+  replicaCount: 1
+  jobService:
+    enabled: false
+  config:
+    logLevel: "info"
+    persistence:
+      defaultStore: default
+      visibilityStore: visibility
+      numHistoryShards: 512
+      datastores:
+        default:
+          # Cassandra for workflow history and events
+          driver: cassandra
+          cassandra:
+            hosts: "temporal-cassandra"
+            port: 9042
+            keyspace: temporal
+            user: user
+            password: ""  # Cassandra auth disabled in deployment
+            replicationFactor: 3
+            consistency:
+              default:
+                consistency: local_quorum
+                serialConsistency: local_serial
+  service:
+    type: ClusterIP
+
+# ── Temporal Web UI ────────────────────────────────────────────────────────
+web:
+  replicaCount: 1
+  service:
+    type: ClusterIP
+
+# ── Ingress ────────────────────────────────────────────────────────
+# Note: ingress is disabled here. Instead, we route via oauth2-proxy.
+# The ingress is applied separately as k8s/temporal/temporal-ingress-oauth2.yaml
+# which terminates TLS and routes to oauth2-proxy service.
+ingress:
+  enabled: false
+
+# ── Monitoring ────────────────────────────────────────────────────────
+prometheus:
+  enabled: false