Skip to content

docs: clarify Temporal Cloud endpoint and auth method pairing #1709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cheelim1 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

docs: clarify Temporal Cloud endpoint and auth method pairing #1709

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2a220a7
docs: clarify Temporal Cloud endpoint and auth method pairing
cheelim1 Feb 27, 2026
08bf62e
Merge branch 'main' into docs/temporal-endpoint-auth-clarity
cheelim1 Mar 11, 2026
47530cc
Merge branch 'main' into docs/temporal-endpoint-auth-clarity
cheelim1 Apr 13, 2026
ff0a2df
Merge branch 'main' into docs/temporal-endpoint-auth-clarity
rickbrouwer Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 69 additions & 4 deletions content/docs/2.19/scalers/temporal.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ triggers:

**Parameter list:**

- `endpoint` - This parameter specifies the URL of the Temporal gRPC service. You need to provide the service address in the format `<hostname>:<port>`. (Required)
- `endpoint` - This parameter specifies the URL of the Temporal gRPC service. You need to provide the service address in the format `<hostname>:<port>`. **Temporal Cloud endpoints differ by authentication method:** API Key auth uses the regional endpoint `<region>.<provider>.api.temporal.io:7233` (e.g., `us-east-1.aws.api.temporal.io:7233`); mTLS auth uses the namespace endpoint `<namespace>.<account>.tmprl.cloud:7233` (e.g., `my-ns.a1b2c.tmprl.cloud:7233`).
- `endpointFromEnv` - Defines the endpoint, similar to the `endpoint` parameter, but the value is read from an environment variable. (Optional)
- `namespace` - The namespace of the temporal service. (Default:`default`, Optional)
- `activationTargetQueueSize` - This sets the target value for activating the scaler. More information about activation thresholds can be found [here](./../concepts/scaling-deployments.md#activating-and-scaling-thresholds). (Default: `0`, Optional)
Expand Down Expand Up @@ -63,7 +63,13 @@ Temporal supports `apiKey` and `mTLS` for authentication. You can use the follow
- `key` - Key for client authentication. (Optional)
- `keyPassword` - If set the keyPassword is used to decrypt the provided key. (Optional)

### Example
> **Temporal Cloud Authentication:**
> - **API Key**: Set `apiKey` and use the regional endpoint (`<region>.<provider>.api.temporal.io:7233`). The SDK handles TLS automatically — no certificates needed. For HA namespaces, use the namespace endpoint (`<namespace>.<account>.tmprl.cloud:7233`) instead.
> - **mTLS**: Set `cert`, `key`, (optionally `ca`) and use the namespace endpoint (`<namespace>.<account>.tmprl.cloud:7233`). Client certificates are required.

### Examples

#### API Key Authentication

```yaml
apiVersion: v1
Expand All @@ -73,7 +79,7 @@ metadata:
namespace: default
type: Opaque
data:
apiKey: TlJBSy0xMjM0NTY3ODkwMTIzNDU2Nwo= # base64 encoding of the new relic api key NRAK-12345678901234567
apiKey: TlJBSy0xMjM0NTY3ODkwMTIzNDU2Nwo= # base64 encoded API key
---
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
Expand Down Expand Up @@ -110,7 +116,66 @@ spec:
taskQueue: "workflow_with_single_noop_activity:test"
targetQueueSize: "2"
activationTargetQueueSize: "0"
endpoint: temporal-frontend.temporal.svc.cluster.local:7233
# Self-hosted: temporal-frontend.temporal.svc.cluster.local:7233
# Temporal Cloud (API key): <region>.<provider>.api.temporal.io:7233
endpoint: us-east-1.aws.api.temporal.io:7233
authenticationRef:
name: keda-trigger-auth-temporal
```

#### mTLS Authentication

```yaml
apiVersion: v1
kind: Secret
metadata:
name: temporal-mtls-secret
namespace: default
type: Opaque
data:
cert: <base64 encoded client certificate>
key: <base64 encoded client private key>
---
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
name: keda-trigger-auth-temporal-mtls
namespace: default
spec:
secretTargetRef:
- parameter: cert
name: temporal-mtls-secret
key: cert
- parameter: key
name: temporal-mtls-secret
key: key
---
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
name: workload-scaledobject
namespace: default
spec:
scaleTargetRef:
name: workload-scaledobject
pollingInterval: 5
cooldownPeriod: 10
minReplicaCount: 0
maxReplicaCount: 5
advanced:
horizontalPodAutoscalerConfig:
behavior:
scaleDown:
stabilizationWindowSeconds: 10
triggers:
- type: temporal
metadata:
namespace: my-ns
taskQueue: "workflow_with_single_noop_activity:test"
targetQueueSize: "2"
activationTargetQueueSize: "0"
# Temporal Cloud (mTLS): <namespace>.<account>.tmprl.cloud:7233
endpoint: my-ns.a1b2c.tmprl.cloud:7233
authenticationRef:
name: keda-trigger-auth-temporal-mtls
```
73 changes: 69 additions & 4 deletions content/docs/2.20/scalers/temporal.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ triggers:

**Parameter list:**

- `endpoint` - This parameter specifies the URL of the Temporal gRPC service. You need to provide the service address in the format `<hostname>:<port>`. (Required)
- `endpoint` - This parameter specifies the URL of the Temporal gRPC service. You need to provide the service address in the format `<hostname>:<port>`. **Temporal Cloud endpoints differ by authentication method:** API Key auth uses the regional endpoint `<region>.<provider>.api.temporal.io:7233` (e.g., `us-east-1.aws.api.temporal.io:7233`); mTLS auth uses the namespace endpoint `<namespace>.<account>.tmprl.cloud:7233` (e.g., `my-ns.a1b2c.tmprl.cloud:7233`).
- `endpointFromEnv` - Defines the endpoint, similar to the `endpoint` parameter, but the value is read from an environment variable. (Optional)
- `namespace` - The namespace of the temporal service. (Default:`default`, Optional)
- `activationTargetQueueSize` - This sets the target value for activating the scaler. More information about activation thresholds can be found [here](./../concepts/scaling-deployments.md#activating-and-scaling-thresholds). (Default: `0`, Optional)
Expand Down Expand Up @@ -63,7 +63,13 @@ Temporal supports `apiKey` and `mTLS` for authentication. You can use the follow
- `key` - Key for client authentication. (Optional)
- `keyPassword` - If set the keyPassword is used to decrypt the provided key. (Optional)

### Example
> **Temporal Cloud Authentication:**
> - **API Key**: Set `apiKey` and use the regional endpoint (`<region>.<provider>.api.temporal.io:7233`). The SDK handles TLS automatically — no certificates needed. For HA namespaces, use the namespace endpoint (`<namespace>.<account>.tmprl.cloud:7233`) instead.
> - **mTLS**: Set `cert`, `key`, (optionally `ca`) and use the namespace endpoint (`<namespace>.<account>.tmprl.cloud:7233`). Client certificates are required.

### Examples

#### API Key Authentication

```yaml
apiVersion: v1
Expand All @@ -73,7 +79,7 @@ metadata:
namespace: default
type: Opaque
data:
apiKey: TlJBSy0xMjM0NTY3ODkwMTIzNDU2Nwo= # base64 encoding of the new relic api key NRAK-12345678901234567
apiKey: TlJBSy0xMjM0NTY3ODkwMTIzNDU2Nwo= # base64 encoded API key
---
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
Expand Down Expand Up @@ -110,7 +116,66 @@ spec:
taskQueue: "workflow_with_single_noop_activity:test"
targetQueueSize: "2"
activationTargetQueueSize: "0"
endpoint: temporal-frontend.temporal.svc.cluster.local:7233
# Self-hosted: temporal-frontend.temporal.svc.cluster.local:7233
# Temporal Cloud (API key): <region>.<provider>.api.temporal.io:7233
endpoint: us-east-1.aws.api.temporal.io:7233
authenticationRef:
name: keda-trigger-auth-temporal
```

#### mTLS Authentication

```yaml
apiVersion: v1
kind: Secret
metadata:
name: temporal-mtls-secret
namespace: default
type: Opaque
data:
cert: <base64 encoded client certificate>
key: <base64 encoded client private key>
---
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
name: keda-trigger-auth-temporal-mtls
namespace: default
spec:
secretTargetRef:
- parameter: cert
name: temporal-mtls-secret
key: cert
- parameter: key
name: temporal-mtls-secret
key: key
---
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
name: workload-scaledobject
namespace: default
spec:
scaleTargetRef:
name: workload-scaledobject
pollingInterval: 5
cooldownPeriod: 10
minReplicaCount: 0
maxReplicaCount: 5
advanced:
horizontalPodAutoscalerConfig:
behavior:
scaleDown:
stabilizationWindowSeconds: 10
triggers:
- type: temporal
metadata:
namespace: my-ns
taskQueue: "workflow_with_single_noop_activity:test"
targetQueueSize: "2"
activationTargetQueueSize: "0"
# Temporal Cloud (mTLS): <namespace>.<account>.tmprl.cloud:7233
endpoint: my-ns.a1b2c.tmprl.cloud:7233
authenticationRef:
name: keda-trigger-auth-temporal-mtls
```
Loading