unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Raise authentik postgres CPU, memory and buffer sizing #474

Merged
benvin merged 2 commits from benvin/authentik-cnpg-resources into main 2026-09-19 14:35:17 +10:00
Conversation 0 Commits 2 Files Changed 1
+13 -6
unkin-agent commented 2026-09-19 13:57:17 +10:00
Member
Copy Link
Copy Source

The 500m CPU limit is a 50ms CFS quota per 100ms period, so the postgres pods are throttled on every burst even at ~0.01 cores average and each query pays that latency. 128MB of shared_buffers and a 256MB cache estimate also under-serve the planner on the joins authentik issues on its hot read paths.

  • raise resources to requests 500m/1Gi, limits 2/2Gi
  • raise shared_buffers to 512MB and effective_cache_size to 1536MB
  • hold the post-incident memory headroom multiple over shared_buffers

Rolling restart with switchover. Stacked on benvin/authentik-hot-standby-feedback.

The 500m CPU limit is a 50ms CFS quota per 100ms period, so the postgres pods are throttled on every burst even at ~0.01 cores average and each query pays that latency. 128MB of `shared_buffers` and a 256MB cache estimate also under-serve the planner on the joins authentik issues on its hot read paths. - raise resources to requests `500m`/`1Gi`, limits `2`/`2Gi` - raise `shared_buffers` to 512MB and `effective_cache_size` to 1536MB - hold the post-incident memory headroom multiple over `shared_buffers` Rolling restart with switchover. Stacked on `benvin/authentik-hot-standby-feedback`.
benvin changed target branch from benvin/authentik-hot-standby-feedback to main 2026-09-19 14:34:35 +10:00
benvin added 2 commits 2026-09-19 14:34:35 +10:00
Enable hot_standby_feedback on the authentik postgres cluster
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
7d186a9b36 
Slow authentik reads served by a hot standby exhaust
max_standby_streaming_delay and are cancelled with "conflict with
recovery", surfacing as HTTP 500s.

- set hot_standby_feedback on (SIGHUP reload, no restart)
Raise authentik postgres CPU, memory and buffer sizing
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
e4856d24a4 
The 500m CPU limit is a 50ms CFS quota per 100ms period, so the pods
throttle on every burst even at idle and each query pays the latency.
128MB shared_buffers and a 256MB cache estimate also under-serve the
planner on the polymorphic joins authentik issues.

- raise resources to requests 500m/1Gi, limits 2/2Gi
- raise shared_buffers to 512MB and effective_cache_size to 1536MB
- keep the post-incident memory headroom multiple over shared_buffers
benvin merged commit 9a7200636c into main 2026-09-19 14:35:17 +10:00
benvin deleted branch benvin/authentik-cnpg-resources 2026-09-19 14:35:18 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#474
Delete Branch "benvin/authentik-cnpg-resources"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?