mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby Husky
9b45cfd542
Confirmed live: CrashLoopBackOff (Bad Gateway from the ingress) caused by the default 40s-runway liveness probe tripping on a transient DB connection blip. The worker constantly retries a scheduled-task query needing a write lock against the read-only CNPG replica (expected, harmless - 'cannot execute SELECT FOR UPDATE in a read-only transaction') which appears to add enough connection pressure that a brief hiccup trips the server's stricter default probe.
119 lines
3.7 KiB
YAML
119 lines
3.7 KiB
YAML
# Authentik warm standby on the VPS - Phase 2. The CNPG replica cluster
|
|
# (manifests/cnpg-cluster.yaml) continuously replays WAL from home in the
|
|
# background. The app itself DOES run continuously (replicas: 1, reachable
|
|
# at auth.vps.huskypup.net - see manifests/ingress.yaml) so the replicated
|
|
# data is browsable/verifiable at all times, even though the underlying DB
|
|
# is a read-only CNPG replica - writes (new logins, session creation) will
|
|
# error until a deliberate manual promotion. Promotion runbook: flip the
|
|
# CNPG cluster's spec.replica.enabled to false (see cnpg-cluster.yaml).
|
|
#
|
|
# The `authentik:` block below (secret_key/postgresql "env://" indirection)
|
|
# is copied VERBATIM from infrastructure/authentik/values.yaml on purpose -
|
|
# the authentik chart deterministically renders its own generated Secret
|
|
# from these literal values.yaml strings (not randomly), so keeping this
|
|
# block byte-identical between home and VPS means both clusters
|
|
# independently arrive at the same AUTHENTIK_SECRET_KEY without needing to
|
|
# manually copy it - required for promotion to work, since that key
|
|
# decrypts things (stored provider secrets, cert private keys) that live
|
|
# encrypted in the DB being replicated.
|
|
authentik:
|
|
secret_key: env://AUTHENTIK_SECRET_KEY
|
|
postgresql:
|
|
host: env://AUTHENTIK_POSTGRESQL__HOST
|
|
port: 5432
|
|
name: env://AUTHENTIK_POSTGRESQL__NAME
|
|
user: env://AUTHENTIK_POSTGRESQL__USER
|
|
password: env://AUTHENTIK_POSTGRESQL__PASSWORD
|
|
|
|
global:
|
|
envFrom:
|
|
- secretRef:
|
|
name: authentik
|
|
- secretRef:
|
|
name: pg-authentik-app
|
|
prefix: AUTHENTIK_POSTGRESQL__
|
|
env:
|
|
- name: AUTHENTIK_URL
|
|
value: "https://auth.vps.huskypup.net"
|
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: host
|
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: dbname
|
|
- name: AUTHENTIK_POSTGRESQL__USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: username
|
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: password
|
|
- name: AUTHENTIK_POSTGRESQL__PORT
|
|
value: "5432"
|
|
|
|
server:
|
|
replicas: 1
|
|
# Default failureThreshold: 3 (40s runway) is too strict running against
|
|
# a read-only CNPG replica - the worker constantly retries a scheduled-
|
|
# task query that needs a write lock (harmless, expected, logged as
|
|
# 'cannot execute SELECT FOR UPDATE in a read-only transaction'), and
|
|
# any transient DB hiccup during that trips the server's health check
|
|
# and gets it killed (confirmed live: CrashLoopBackOff, 'connection
|
|
# refused' during a brief blip). Widened so brief hiccups don't kill it.
|
|
livenessProbe:
|
|
failureThreshold: 10
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
failureThreshold: 10
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
containerSecurityContext:
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
metrics:
|
|
enabled: false
|
|
|
|
worker:
|
|
replicas: 1
|
|
containerSecurityContext:
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
metrics:
|
|
enabled: false
|
|
|
|
# Disable bundled Postgres - using the CNPG replica cluster instead
|
|
postgresql:
|
|
enabled: false
|