From e6f2cbc363da43f454474277c06c2983d446035c Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 28 Jul 2026 18:16:31 +1000 Subject: [PATCH] authentik: raise CNPG postgres memory to stop replica OOMKills (#300) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Authentik's intermittent API 500s (which failed two terraform-authentik CI runs today) were traced to its CNPG postgres replicas being OOMKilled: 512Mi limits leave no headroom over shared_buffers 128MB + max_connections 200, both OOM events matched the 500 bursts to the second, and the session-pinned RO pooler turns each replica death into a batch of severed read connections. The primary is at 84% of its limit and is next. - raise the authentik CNPG memory limit from 512Mi to 1Gi and request from 256Mi to 512Mi Follow-up candidates (not in this PR): RO pooler poolMode session→transaction to shrink the blast radius of a replica loss; revisit max_connections/shared_buffers sizing. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/300 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/authentik/cnpg_cluster.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apps/base/authentik/cnpg_cluster.yaml b/apps/base/authentik/cnpg_cluster.yaml index 350c55a..a7490f7 100644 --- a/apps/base/authentik/cnpg_cluster.yaml +++ b/apps/base/authentik/cnpg_cluster.yaml @@ -106,10 +106,12 @@ spec: resources: limits: cpu: 500m - memory: 512Mi + # 512Mi OOMKilled replicas under load (shared_buffers 128MB + + # max_connections 200 leave no headroom) — see incident 2026-07-28. + memory: 1Gi requests: cpu: 50m - memory: 256Mi + memory: 512Mi smartShutdownTimeout: 180 startDelay: 3600 stopDelay: 1800