Temporal Web UI (temporal-ui)

Web interface to inspect and operate the Temporal workflows of the Navin Control Plane: namespaces, workflows, task queues, schedules. Stateless, it reads the Temporal frontend over gRPC.

Generated from catalog/services/temporal-ui.yaml: do not edit by hand.

Summary

Version	2.57.0
Use	install and configure
Layer	infrastructure (shown apart)
Category	Data platforms
Installation methods	binary, podman
External connection	no
Sandbox only	no

Licence

SPDX identifier	MIT
Licence policy	core licence (MIT or Apache-2.0)
Licence exception	-
Platform component	temporal-ui

Packages and artifacts

A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.

Kind	Package	Version	Licence	Details
container image	docker.io/temporalio/ui	2.57.0	MIT	image key ui, used by ui, digest sha256:d944f959d0923c35cd991a17a0edbe087770eff843724b181933e0cfdd563ab2
binary archive	ui-server_2.57.0_linux_amd64.tar.gz	2.57.0	MIT	https://github.com/temporalio/ui-server/releases/download/v2.57.0/ui-server_2.57.0_linux_amd64.tar.gz, x86_64, checksum sha256

Images are pinned by tag in the descriptor, and by digest when the descriptor declares one (the offline bundle then refuses a pulled image that does not carry it); the digest is recorded in the mirror of the Manager when the offline bundle is imported, and every pull or load is checked against it.

Supported systems and architectures

Method	Operating systems	Architectures
binary	RHEL family (dnf), Debian family (apt), Arch Linux (pacman)	x86_64 (architecture of the artifacts of the descriptor)
podman	RHEL family (dnf), Debian family (apt), Arch Linux (pacman)	x86_64, aarch64 (not restricted by the descriptor)

Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.

Prerequisites

Host

• at least 256 MB of memory (blocking, memory).

Network and ports

Component	Port name	Port	Opened in the host firewall
ui	web	8233/tcp	yes

Services and connections needed

• temporal: temporal.

Details and resolution: see Dependencies.

Installation methods and modes

Method	Default	What the method uses
binary	yes	the binary archives of the descriptor, unpacked under the service directory
podman	-	the container images of the descriptor, run by Podman under systemd

Components

Component	Kind	Installation methods	Ports
Web interface server (ui)	master	binary, podman	8233/tcp

Single instance (single) (default)

One interface server, enough for most installations.

What the mode deploys:

Component	Placement
ui	min 1, max 1

Replicated (replicated)

Several stateless servers behind the load balancer (HAProxy); set the public URL to the load balancer.

What the mode deploys:

Component	Placement
ui	min 2, recommended 2

Install this service

The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.

1. Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.

2. Choose the service. On the Service step, select Temporal Web UI. The card shows the licence MIT and the dependencies the installation needs. Pick the Method among binary, podman (default binary).

3. Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode: single (default), replicated. Each mode deploys the components listed in Installation methods and modes.

4. Bind the dependencies. On the Bindings step, choose for each dependency (temporal) Install with the platform or Use an existing connection; an optional dependency can stay on No binding.

5. Configure. On the Configure step, review the parameters (see Configuration parameters). Passwords left empty with a generated default are generated and sealed by the Manager.

6. Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.

7. Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services.

High availability

Cluster	replicas (replication)
High availability	external (external)
Failover	load balancer (load-balancer)
Replication	none (none)
Quorum	none (none)
Discovery	none (none)
Entry point	load balancer (load-balancer)
Official documentation	https://docs.temporal.io/references/web-ui-configuration

Prerequisites

Prerequisite	Must be highly available	Modes	Description
temporal	yes	modes of level ha or cluster	Temporal Server reachable in gRPC, itself highly available.

Topology per mode

Modes	Highest catalog level	Distribution	Quorum component	Fault domains	Description
single	standalone (standalone)	single (single)	-	1	One instance, no fault tolerance.
replicated	ha (ha)	active-active (active-active)	-	2	Several stateless servers behind HAProxy; the public URL points to the load balancer.

Configuration parameters

Network

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
Web port (port)	port	8233	-	no	no	yes	Port of the web interface and of its /healthz endpoint.
TLS (tls_enabled)	bool	false	-	no	no	yes	Serve the interface over TLS with a certificate issued by the manager CA.
Public URL (public_url)	url	(empty)	-	no	no	no	Address operators use, for example the load balancer in front of a replicated interface. Empty: the address of the host.
Additional origins (cors_origins)	list	[]	-	no	no	no	Other origins allowed to call the interface (the public URL is always allowed). (advanced)

Display

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
Default namespace (default_namespace)	string	default	^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$	no	no	no	Namespace opened first by the interface.
Read only (read_only)	bool	false	-	no	no	no	Hide every write action (terminate, cancel, signal, reset, start): operators can only inspect.
Environment banner (banner_text)	string	(empty)	^[A-Za-z0-9 ._-]{1,60}$	no	no	no	Text of a permanent banner, for example PRODUCTION (letters, digits, spaces, dots, hyphens). Empty: no banner.
Banner color (banner_color)	enum	warning	neutral, info, warning, success, danger, error, accent	no	no	no	Color preset of the environment banner.

Single sign on

Parameter	Type	Default	Allowed values	Required	Secret	Restart	Description
OIDC sign in (oidc_enabled)	bool	false	-	no	no	no	Require an OpenID Connect sign in (Keycloak of the platform or the identity provider of the bank).
Provider URL (oidc_provider_url)	url	(empty)	-	no	no	no	Issuer URL of the OIDC provider, for example https://sso.bank.internal/realms/navin.
Client identifier (oidc_client_id)	string	(empty)	-	no	no	no	Client registered for the interface at the OIDC provider.
Client secret (oidc_client_secret)	password	-	-	no	yes	no	Secret of the OIDC client (stored sealed, written only to a file readable by the service).

Dependencies

For each active dependency the Manager takes the first of: the binding chosen in the wizard; a service of the same installation that provides it; a service already installed in the cluster; the only connection of the expected type. Otherwise an optional dependency stays unbound, and a required one is added to the installation in its default mode (the column below names the catalog service added).

Binding	Provided by	Connection type	Endpoint	Optional	When nothing is bound	Description
temporal	temporal	-	frontend	no	temporal is added to the installation	Temporal frontend (gRPC) that the web interface reads and operates.

Endpoints

Endpoint	Scheme	Component	Port	Path	TLS parameter	Binding parameters	Binding secrets	Provisioning command
web	http	ui	8233 (port)	-	tls_enabled	-	-	-

Health checks

Liveness (per instance)

Component	Check	Details
ui	HTTP {{ ('https://' ~ host.fqdn) if config.tls_enabled else ('http://' ~ (host.ip or '127.0.0.1')) }}:{{ config.port }}/healthz	Expected 200; 30 retries; interval 2 s; timeout 3 s

Readiness (service check)

Check	Details
HTTP {{ ('https://' ~ host.fqdn) if config.tls_enabled else ('http://' ~ (host.ip or '127.0.0.1')) }}:{{ config.port }}/healthz	Expected 200; Expected OK; 5 retries; interval 2 s; timeout 5 s

Preflight checks

Check	Type	Meaning	Severity	Components
memory	memory_mb {"min": 256}	at least 256 MB of memory	blocking	every component
web_port_free	port_free {"param": "port"}	port 8233 free on the host	blocking	every component

Uninstall

Paths removed when the data is purged: {{ paths.log }}.

Quick links

• Temporal Web UI: {{ (config.public_url or ((('https' if config.tls_enabled else 'http')) ~ '://' ~ host.fqdn ~ ':' ~ config.port)).rstrip('/') ~ '/' }}

Upstream documentation

• Homepage: https://docs.temporal.io/web-ui
• Source: https://github.com/temporalio/ui-server
• High availability: https://docs.temporal.io/references/web-ui-configuration