From 9535bad9bce70101f869e6f0dac7699185907afe Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 14:34:33 +1000 Subject: [PATCH] Enable hot_standby_feedback on the authentik postgres cluster (#473) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Authentik serves multi-second API reads from the CNPG hot standbys. Those reads outlive `max_standby_streaming_delay`, so recovery cancels them with `canceling statement due to conflict with recovery`, which authentik surfaces as HTTP 500 — enough to break a terraform apply mid-run. - set `hot_standby_feedback` on so replicas report their oldest xmin to the primary and long reads stop being cancelled - SIGHUP reload only, no restart or switchover - retained-dead-tuple cost is negligible on a ~155MB database Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/473 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/authentik/cnpg_cluster.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/apps/base/authentik/cnpg_cluster.yaml b/apps/base/authentik/cnpg_cluster.yaml index a7490f7..c1dd6f9 100644 --- a/apps/base/authentik/cnpg_cluster.yaml +++ b/apps/base/authentik/cnpg_cluster.yaml @@ -66,6 +66,10 @@ spec: dynamic_shared_memory_type: posix effective_cache_size: 256MB full_page_writes: "on" + # Replicas report their oldest xmin to the primary, so multi-second reads on + # a hot standby stop exhausting max_standby_streaming_delay and being + # cancelled. Retained-dead-tuple cost is negligible on a ~155MB database. + hot_standby_feedback: "on" log_destination: csvlog log_directory: /controller/log log_filename: postgres