From 9b45cfd542bd57475d2050861a1743c997cb04ce Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Tue, 18 Aug 2026 19:01:01 -0500 Subject: [PATCH] Widen VPS Authentik server liveness/readiness probes Confirmed live: CrashLoopBackOff (Bad Gateway from the ingress) caused by the default 40s-runway liveness probe tripping on a transient DB connection blip. The worker constantly retries a scheduled-task query needing a write lock against the read-only CNPG replica (expected, harmless - 'cannot execute SELECT FOR UPDATE in a read-only transaction') which appears to add enough connection pressure that a brief hiccup trips the server's stricter default probe. --- .../vps-standby/authentik/values.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/infrastructure/vps-standby/authentik/values.yaml b/infrastructure/vps-standby/authentik/values.yaml index 25e5cff..14e8a99 100644 --- a/infrastructure/vps-standby/authentik/values.yaml +++ b/infrastructure/vps-standby/authentik/values.yaml @@ -60,6 +60,23 @@ global: server: replicas: 1 + # Default failureThreshold: 3 (40s runway) is too strict running against + # a read-only CNPG replica - the worker constantly retries a scheduled- + # task query that needs a write lock (harmless, expected, logged as + # 'cannot execute SELECT FOR UPDATE in a read-only transaction'), and + # any transient DB hiccup during that trips the server's health check + # and gets it killed (confirmed live: CrashLoopBackOff, 'connection + # refused' during a brief blip). Widened so brief hiccups don't kill it. + livenessProbe: + failureThreshold: 10 + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + failureThreshold: 10 + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 containerSecurityContext: runAsNonRoot: true allowPrivilegeEscalation: false