Add TLS configuration support for Elasticsearch visibility store

[adamovittorio]

Summary

The temporal-elasticsearch-tool binary supports a full set of TLS environment variables (ES_TLS, ES_TLS_CA_FILE, ES_TLS_CERT_FILE, ES_TLS_KEY_FILE, ES_TLS_SERVER_NAME, ES_TLS_DISABLE_HOST_VERIFICATION), but the chart's _admintools-env.yaml helper never sets them for the Elasticsearch driver. Both Cassandra and SQL drivers already have full TLS support in this helper.

This causes init containers (check-elasticsearch-index, setup-visibility-store) to fail with x509: certificate signed by unknown authority errors when connecting to Elasticsearch clusters with self-signed or custom CA certificates.

Changes

• _admintools-env.yaml: Added tls config block to the Elasticsearch section, following the same pattern as SQL:
  • tls.enabled → ES_TLS
  • tls.caFile → ES_TLS_CA_FILE
  • tls.certFile / tls.keyFile → ES_TLS_CERT_FILE / ES_TLS_KEY_FILE
  • tls.serverName → ES_TLS_SERVER_NAME
  • tls.enableHostVerification → ES_TLS_DISABLE_HOST_VERIFICATION (inverted, consistent with Cassandra/SQL)
• values.yaml: Added commented TLS example to the Elasticsearch configuration block
• values/values.elasticsearch.yaml: Added commented TLS example

Example usage

server:
  config:
    persistence:
      datastores:
        visibility:
          elasticsearch:
            version: v7
            url:
              scheme: https
              host: "elasticsearch:9200"
            tls:
              enabled: true
              enableHostVerification: false
              # caFile: /path/to/ca.crt
              # certFile: /path/to/client.crt
              # keyFile: /path/to/client.key
              # serverName: elasticsearch.internal

Related

• Env vars documented in tools/elasticsearch/README.md

Made with Cursor

[yux0]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

[yux0]

This changes make sense to me. Could you add some tests under charts/temporal/tests/admintools_deployment_test.yaml?

[adamovittorio]

@yux0 added the tests for server_job_test that uses the admintools-env helper.

[yux0]

@adamovittorio Stamped the changes. Thank you very much for the contribution!

[adamovittorio]

I'm unable to merge the changes, and a workflow is waiting for a maintainer's approval. Thank you @yux0 🙏