[Breaking change] Update TEMPORAL_ injected env vars to match those expected by SDKs (#130)

## Summary

This PR updates the environment variables injected by the worker
controller to match the standard names expected by Temporal SDKs,
improving compatibility and reducing configuration complexity for users.

Fixes #128

### Key Changes

**Environment Variable Updates:**
- `TEMPORAL_HOST_PORT` → `TEMPORAL_ADDRESS`
- `TEMPORAL_TLS_KEY_PATH` → `TEMPORAL_TLS_CLIENT_KEY_PATH`
- `TEMPORAL_TLS_CERT_PATH` → `TEMPORAL_TLS_CLIENT_CERT_PATH`
- `WORKER_BUILD_ID` → `TEMPORAL_WORKER_BUILD_ID`
- Added `TEMPORAL_TLS=true` when mTLS is enabled

**Example code changes:**
- Updated demo code to use `go.temporal.io/sdk/contrib/envconfig` for
configuration parsing

## Test Plan
- [x] Updated existing tests to use new environment variable names  
- [x] Added unit test for environment variable compatibility with
`go.temporal.io/sdk/contrib/envconfig`

## Migration Notes
This is a BREAKING CHANGE which updates the environment variables that
the controller injects into worker deployments. Existing workers will
need to read in the new environment variable names when they are next
updated by the controller.

---------

Co-authored-by: Copilot <[email protected]>

Author: jlegrone

README.md

@@ -51,11 +51,11 @@ significant references to Kubernetes Deployment resource, within this repository
 In order to be compatible with this controller, workers need to be configured using these standard environment
 variables:
 
-- `TEMPORAL_HOST_PORT`: The host and port of the Temporal server, e.g. `default.foo.tmprl.cloud:7233`
+- `TEMPORAL_ADDRESS`: The host and port of the Temporal server, e.g. `default.foo.tmprl.cloud:7233`
 - `TEMPORAL_NAMESPACE`: The Temporal namespace to connect to, e.g. `default`
 - `TEMPORAL_DEPLOYMENT_NAME`: The name of the worker deployment. This must be unique to the worker deployment and should not
   change between versions.
-- `WORKER_BUILD_ID`: The build ID of the worker. This should change with each new worker rollout.
+- `TEMPORAL_WORKER_BUILD_ID`: The build ID of the worker. This should change with each new worker rollout.
 
 Each of these will be automatically set by the controller, and must not be manually specified in the worker's pod template.
 

go.mod

@@ -15,6 +15,8 @@ require (
 	github.com/stretchr/testify v1.10.0
 	go.temporal.io/api v1.50.1
 	go.temporal.io/sdk v1.35.0
+	go.temporal.io/sdk/contrib/envconfig v0.1.0
+	go.temporal.io/server v1.28.1
 	k8s.io/api v0.33.2
 	k8s.io/apimachinery v0.33.2
 	k8s.io/client-go v0.33.2
@@ -32,6 +34,7 @@ require (
 	cloud.google.com/go/storage v1.51.0 // indirect
 	dario.cat/mergo v1.0.1 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
@@ -149,7 +152,6 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.34.0 // indirect
 	go.opentelemetry.io/otel/trace v1.34.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
-	go.temporal.io/server v1.28.1 // indirect
 	go.temporal.io/version v0.3.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/dig v1.18.0 // indirect

go.sum

@@ -4,5 +4,6 @@ toolchain go1.24.6
 
 use (
 	.
+	./internal/demo
 	./internal/tests
 )

go.work

@@ -8,10 +8,12 @@ require (
 	go.temporal.io/api v1.44.1
 	go.temporal.io/sdk v1.33.0
 	go.temporal.io/sdk/contrib/datadog v0.4.0
+	go.temporal.io/sdk/contrib/envconfig v0.1.0
 	go.temporal.io/sdk/contrib/tally v0.2.0
 )
 
 require (
+	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/DataDog/appsec-internal-go v1.9.0 // indirect
 	github.com/DataDog/datadog-agent/pkg/obfuscate v0.58.0 // indirect
 	github.com/DataDog/datadog-agent/pkg/proto v0.58.0 // indirect

go.work.sum

@@ -1,6 +1,8 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
+github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/DataDog/appsec-internal-go v1.9.0 h1:cGOneFsg0JTRzWl5U2+og5dbtyW3N8XaYwc5nXe39Vw=
 github.com/DataDog/appsec-internal-go v1.9.0/go.mod h1:wW0cRfWBo4C044jHGwYiyh5moQV2x0AhnwqMuiX7O/g=
 github.com/DataDog/datadog-agent/pkg/obfuscate v0.58.0 h1:nOrRNCHyriM/EjptMrttFOQhRSmvfagESdpyknb5VPg=
@@ -356,6 +358,8 @@ go.temporal.io/sdk v1.33.0 h1:T91UzeRdlHTiMGgpygsItOH9+VSkg+M/mG85PqNjdog=
 go.temporal.io/sdk v1.33.0/go.mod h1:WwCmJZLy7zabz3ar5NRAQEygsdP8tgR9sDjISSHuWZw=
 go.temporal.io/sdk/contrib/datadog v0.4.0 h1:f5Z7zs9VDazvLRu6CmXC83KcdNMDclgvZPEm2DiyCgs=
 go.temporal.io/sdk/contrib/datadog v0.4.0/go.mod h1:iYSXJPlJA5b/9Jo4hmquD7IaAa3776fB4KThp6vHik4=
+go.temporal.io/sdk/contrib/envconfig v0.1.0 h1:s+G/Ujph+Xl2jzLiiIm2T1vuijDkUL4Kse49dgDVGBE=
+go.temporal.io/sdk/contrib/envconfig v0.1.0/go.mod h1:FQEO3C56h9C7M6sDgSanB8HnBTmopw9qgVx4F1S6pJk=
 go.temporal.io/sdk/contrib/tally v0.2.0 h1:XnTJIQcjOv+WuCJ1u8Ve2nq+s2H4i/fys34MnWDRrOo=
 go.temporal.io/sdk/contrib/tally v0.2.0/go.mod h1:1kpSuCms/tHeJQDPuuKkaBsMqfHnIIRnCtUYlPNXxuE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=

internal/demo/go.mod

@@ -6,22 +6,22 @@ package util
 
 import (
 	"context"
-	"crypto/tls"
 	"os"
 
 	"github.com/uber-go/tally/v4/prometheus"
 	"go.temporal.io/api/workflowservice/v1"
 	"go.temporal.io/sdk/client"
 	"go.temporal.io/sdk/contrib/datadog/tracing"
+	"go.temporal.io/sdk/contrib/envconfig"
 	sdktally "go.temporal.io/sdk/contrib/tally"
 	"go.temporal.io/sdk/interceptor"
 )
 
 func NewClient(buildID string) (c client.Client, stopFunc func()) {
-	return newClient(temporalHostPort, temporalNamespace, buildID, tlsKeyFilePath, tlsCertFilePath)
+	return newClient(buildID)
 }
 
-func newClient(hostPort, namespace, buildID, tlsKeyFile, tlsCertFile string) (c client.Client, stopFunc func()) {
+func newClient(buildID string) (c client.Client, stopFunc func()) {
 	l, stopFunc := configureObservability(buildID)
 
 	promScope, err := newPrometheusScope(l, prometheus.Configuration{
@@ -33,29 +33,22 @@ func newClient(hostPort, namespace, buildID, tlsKeyFile, tlsCertFile string) (c
 		panic(err)
 	}
 
-	cert, err := tls.LoadX509KeyPair(tlsCertFile, tlsKeyFile)
+	// Load client options from environment variables using envconfig
+	opts, err := envconfig.LoadDefaultClientOptions()
 	if err != nil {
 		panic(err)
 	}
 
-	opts := client.Options{
-		Identity:  os.Getenv("HOSTNAME"),
-		HostPort:  hostPort,
-		Namespace: namespace,
-		Logger:    l,
-		Interceptors: []interceptor.ClientInterceptor{
-			tracing.NewTracingInterceptor(tracing.TracerOptions{
-				DisableSignalTracing: false,
-				DisableQueryTracing:  false,
-			}),
-		},
-		MetricsHandler: sdktally.NewMetricsHandler(promScope),
-		ConnectionOptions: client.ConnectionOptions{
-			TLS: &tls.Config{
-				Certificates: []tls.Certificate{cert},
-			},
-		},
+	// Override with our custom settings
+	opts.Identity = os.Getenv("HOSTNAME")
+	opts.Logger = l
+	opts.Interceptors = []interceptor.ClientInterceptor{
+		tracing.NewTracingInterceptor(tracing.TracerOptions{
+			DisableSignalTracing: false,
+			DisableQueryTracing:  false,
+		}),
 	}
+	opts.MetricsHandler = sdktally.NewMetricsHandler(promScope)
 
 	l.Debug("Client configured", "identity", opts.Identity, "hostPort", opts.HostPort, "namespace", opts.Namespace)
 
@@ -69,7 +62,7 @@ func newClient(hostPort, namespace, buildID, tlsKeyFile, tlsCertFile string) (c
 	}
 
 	if _, err := c.ListWorkflow(context.Background(), &workflowservice.ListWorkflowExecutionsRequest{
-		Namespace: namespace,
+		Namespace: opts.Namespace,
 	}); err != nil {
 		panic(err)
 	}

internal/demo/go.sum

@@ -10,11 +10,8 @@ import (
 )
 
 var (
-	temporalHostPort  = mustGetEnv("TEMPORAL_HOST_PORT")
-	temporalNamespace = mustGetEnv("TEMPORAL_NAMESPACE")
+	// temporalTaskQueue is still needed for worker creation as it's not part of client config
 	temporalTaskQueue = mustGetEnv("TEMPORAL_TASK_QUEUE")
-	tlsKeyFilePath    = mustGetEnv("TEMPORAL_TLS_KEY_PATH")
-	tlsCertFilePath   = mustGetEnv("TEMPORAL_TLS_CERT_PATH")
 )
 
 func mustGetEnv(key string) string {

internal/demo/util/client.go

@@ -32,12 +32,15 @@ func NewVersionedWorker(opts worker.Options) (w worker.Worker, stopFunc func())
 	}()
 
 	opts.DeploymentOptions = worker.DeploymentOptions{
-		UseVersioning:             true,
-		Version:                   mustGetEnv("TEMPORAL_DEPLOYMENT_NAME") + VersionIDSeparator + mustGetEnv("WORKER_BUILD_ID"),
+		UseVersioning: true,
+		Version: worker.WorkerDeploymentVersion{
+			DeploymentName: mustGetEnv("TEMPORAL_DEPLOYMENT_NAME"),
+			BuildId:        mustGetEnv("TEMPORAL_WORKER_BUILD_ID"),
+		},
 		DefaultVersioningBehavior: workflow.VersioningBehaviorPinned,
 	}
 
-	c, stopClient := NewClient(mustGetEnv("WORKER_BUILD_ID"))
+	c, stopClient := NewClient(mustGetEnv("TEMPORAL_WORKER_BUILD_ID"))
 
 	w = worker.New(c, temporalTaskQueue, opts)