The 500m CPU limit is a 50ms CFS quota per 100ms period, so the pods
throttle on every burst even at idle and each query pays the latency.
128MB shared_buffers and a 256MB cache estimate also under-serve the
planner on the polymorphic joins authentik issues.
- raise resources to requests 500m/1Gi, limits 2/2Gi
- raise shared_buffers to 512MB and effective_cache_size to 1536MB
- keep the post-incident memory headroom multiple over shared_buffers
Slow authentik reads served by a hot standby exhaust
max_standby_streaming_delay and are cancelled with "conflict with
recovery", surfacing as HTTP 500s.
- set hot_standby_feedback on (SIGHUP reload, no restart)
unkin-agent