8a5a53a832
- linkwarden: add Reloader match annotation to DB secret so pods auto-restart on Vault credential rotation (was causing 100% 5xx) - authentik: increase memory limits (server 1Gi→1.5Gi, worker 896Mi→1Gi) to prevent OOM kills - prometheus: drop 113k high-cardinality series to reduce HDD write rate from ~8.8 to ~6.0 MB/s (31% reduction): - drop all traefik/apiserver/etcd histogram bucket metrics - drop goflow2_flow_process_nf_templates_total (9.3k series) - drop container_tasks_state and container_memory_failures_total - rewrite HighServiceLatency alert to use avg latency (_sum/_count) - update cluster_health dashboard to match - raise KubeletRuntimeOperationsLatency threshold from 30s to 60s
73 lines
1.6 KiB
YAML
73 lines
1.6 KiB
YAML
authentik:
|
|
log_level: warning
|
|
# log_level: trace
|
|
secret_key: "${secret_key}"
|
|
# This sends anonymous usage-data, stack traces on errors and
|
|
# performance data to authentik.error-reporting.a7k.io, and is fully opt-in
|
|
error_reporting:
|
|
enabled: true
|
|
postgresql:
|
|
# host: postgresql.dbaas
|
|
host: pgbouncer.authentik
|
|
port: 6432
|
|
user: authentik
|
|
password: ${postgres_password}
|
|
redis:
|
|
host: ${redis_host}
|
|
|
|
server:
|
|
replicas: 2
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 0
|
|
maxUnavailable: 1
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 1.5Gi
|
|
limits:
|
|
memory: 1.5Gi
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: server
|
|
ingress:
|
|
enabled: false
|
|
# hosts:
|
|
# - authentik.viktorbarzin.me
|
|
podAnnotations:
|
|
diun.enable: true
|
|
diun.include_tags: "^202[0-9].[0-9]+.*$" # no need to annotate the worker as it uses the same image
|
|
pdb:
|
|
enabled: true
|
|
minAvailable: 1
|
|
global:
|
|
addPrometheusAnnotations: true
|
|
|
|
worker:
|
|
replicas: 2
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 0
|
|
maxUnavailable: 1
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 1Gi
|
|
limits:
|
|
memory: 1Gi
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: worker
|
|
pdb:
|
|
enabled: true
|
|
maxUnavailable: 1
|