From c83a886e7474829fe10de4ef3c1a946f25e535d3 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 14:48:45 +1000 Subject: [PATCH] Enable pg_stat_statements on the authentik postgres cluster (#475) The cluster preloads no statement-statistics library, so there is no per-query cost attribution in postgres and slow query paths have to be inferred from application-side metrics instead of read straight out of the database. - preload `pg_stat_statements` - set `pg_stat_statements.max` and `.track`, which is what makes CNPG manage the extension and create it in every database Requires a postgres restart. Stacked on `benvin/authentik-cnpg-resources`. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/475 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/authentik/cnpg_cluster.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/apps/base/authentik/cnpg_cluster.yaml b/apps/base/authentik/cnpg_cluster.yaml index 5dd813d..67ea13b 100644 --- a/apps/base/authentik/cnpg_cluster.yaml +++ b/apps/base/authentik/cnpg_cluster.yaml @@ -81,6 +81,11 @@ spec: max_parallel_workers: "16" max_replication_slots: "16" max_worker_processes: "16" + # A pg_stat_statements.* parameter is what makes CNPG treat the extension as + # managed and run CREATE EXTENSION in every database; preloading alone does + # not create it. + pg_stat_statements.max: "10000" + pg_stat_statements.track: top shared_buffers: 512MB shared_memory_type: mmap ssl_max_protocol_version: TLSv1.3 @@ -90,6 +95,9 @@ spec: wal_log_hints: "on" wal_receiver_timeout: 5s wal_sender_timeout: 5s + # CNPG merges this with the libraries it manages itself. + shared_preload_libraries: + - pg_stat_statements syncReplicaElectionConstraint: enabled: false primaryUpdateMethod: restart