Add event recording and status conditions for worker deployments

.gitignore

@@ -8,6 +8,7 @@ skaffold.env
 certs
 
 .DS_Store
+cover.out
 
 .claude
-.config 
+config

api/v1alpha1/worker_types.go

@@ -86,6 +86,49 @@ type TemporalWorkerDeploymentSpec struct {
 	WorkerOptions WorkerOptions `json:"workerOptions"`
 }
 
+// Condition type constants for TemporalWorkerDeployment.
+const (
+	// ConditionTemporalConnectionHealthy indicates whether the referenced TemporalConnection
+	// resource exists and is properly configured.
+	ConditionTemporalConnectionHealthy = "TemporalConnectionHealthy"
+
+	// ConditionRolloutComplete indicates whether the target version has been successfully
+	// registered as the current version, completing the rollout.
+	ConditionRolloutComplete = "RolloutComplete"
+)
+
+// Condition reason constants for TemporalWorkerDeployment.
+//
+// These strings appear in status.conditions[].reason and are part of the CRD's
+// status API. Operators, monitoring rules, and scripts may depend on them.
+// They should be treated as stable within an API version and renamed only with
+// a corresponding version bump.
+const (
+	// ReasonTemporalConnectionNotFound is set on ConditionTemporalConnectionHealthy
+	// when the referenced TemporalConnection resource cannot be found.
+	ReasonTemporalConnectionNotFound = "TemporalConnectionNotFound"
+
+	// ReasonAuthSecretInvalid is set on ConditionTemporalConnectionHealthy when
+	// the auth secret referenced by the TemporalConnection cannot be resolved.
+	ReasonAuthSecretInvalid = "AuthSecretInvalid"
+
+	// ReasonTemporalClientCreationFailed is set on ConditionTemporalConnectionHealthy
+	// when a Temporal SDK client cannot be created for the connection.
+	ReasonTemporalClientCreationFailed = "TemporalClientCreationFailed"
+
+	// ReasonTemporalStateFetchFailed is set on ConditionTemporalConnectionHealthy
+	// when the controller cannot query the current worker deployment state from Temporal.
+	ReasonTemporalStateFetchFailed = "TemporalStateFetchFailed"
+
+	// ReasonTemporalConnectionHealthy is set on ConditionTemporalConnectionHealthy
+	// when the connection is reachable and the auth secret is resolved.
+	ReasonTemporalConnectionHealthy = "TemporalConnectionHealthy"
+
+	// ReasonRolloutComplete is set on ConditionRolloutComplete when the target
+	// version has been successfully registered as the current version.
+	ReasonRolloutComplete = "RolloutComplete"
+)
+
 // VersionStatus indicates the status of a version.
 // +enum
 type VersionStatus string
@@ -155,8 +198,9 @@ type TemporalWorkerDeploymentStatus struct {
 	// +kubebuilder:validation:Minimum=0
 	VersionCount int32 `json:"versionCount,omitempty"`
 
-	// TODO(jlegrone): Add additional status fields following Kubernetes API conventions
-	// https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
+	// Conditions represent the latest available observations of the TemporalWorkerDeployment's current state.
+	// +optional
+	Conditions []metav1.Condition `json:"conditions,omitempty"`
 }
 
 // WorkflowExecutionStatus describes the current state of a workflow.

cmd/main.go

@@ -91,6 +91,7 @@ func main() {
 			}))),
 			mgr.GetClient(),
 		),
+		Recorder: mgr.GetEventRecorderFor("temporal-worker-controller"),
 		MaxDeploymentVersionsIneligibleForDeletion: controller.GetControllerMaxDeploymentVersionsIneligibleForDeletion(),
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "TemporalWorkerDeployment")

helm/temporal-worker-controller/crds/temporal.io_temporalworkerdeployments.yaml

@@ -3950,13 +3950,13 @@ spec:
                     required:
                     - name
                     type: object
+                  temporalNamespace:
+                    minLength: 1
+                    type: string
                   unsafeCustomBuildID:
                     maxLength: 63
                     pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?$
                     type: string
-                  temporalNamespace:
-                    minLength: 1
-                    type: string
                 required:
                 - connectionRef
                 - temporalNamespace
@@ -3969,6 +3969,42 @@ spec:
             type: object
           status:
             properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      format: date-time
+                      type: string
+                    message:
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
               currentVersion:
                 properties:
                   buildID:

internal/controller/clientpool/clientpool.go

@@ -154,7 +154,8 @@ func (cp *ClientPool) fetchClientUsingMTLSSecret(secret corev1.Secret, opts NewC
 	}
 
 	if _, err := c.CheckHealth(context.Background(), &sdkclient.CheckHealthRequest{}); err != nil {
-		panic(err)
+		c.Close()
+		return nil, fmt.Errorf("temporal server health check failed: %w", err)
 	}
 
 	cp.mux.Lock()