fix: give Authentik operator 256Mi memory headroom #82

Merged

morten-olsen merged 1 commit from fix/fe2472f2-authentik-memory into main

2026-10-30 08:37:24 +01:00

morten-olsen commented

2026-10-30 08:21:58 +01:00

Owner

Summary

Repeated OOM kills interrupt Authentik reconciliation. Add an installation-specific memory limit override, as requested by Morten for HOMEIT-490:

- memory limit: 128Mi
+ memory limit: 256Mi

The published operator chart stays at 0.3.0; its image, CPU limit and 64Mi memory request remain as deployed. This is a mitigation; memory growth and bounded reconciliation remain under investigation.

Evidence

Before: the live operator pod has six restarts; latest termination was OOMKilled (exit 137) at 2026-10-30T06:31:21Z. Seven-day Prometheus working-set maximum 127.64Mi, RSS maximum 117.22Mi; current working set about 107.5Mi. The resource audit recommends 256Mi. Node usage about 40Gi of 96Gi.
After, rendered: core chart emits the Authentik Application override; rendering published authentik-operator 0.3.0 with that override produces a 256Mi limit, 64Mi request and unchanged image. Core Helm lint/render checks and server dry-runs of both Application and Deployment pass.
All 15 clients, 21 groups, five proxy providers and one server currently report ready. Full workload/backlog peak and sustained operation under the new limit remain unverified pending rollout.

Merge danger

Door: two-way. Reverting removes the override and restores the OOM-prone 128Mi limit.

Blast radius: app. One operator rolls; its bound increases by 128Mi on the single node. No Authentik server, access policy or credential change.

Rollback and verification

Roll back: revert this commit through GitOps.
Verify after rollout: green pipeline, clean Forgejo mirror, core Application at the merged revision, Authentik Application values, actual Deployment limit/image digest, one ready replica, restarts and memory through startup/reconciliation and continued observation.
Reviewers: no security trigger or requested Designer sign-off. Owner reviewed the diff.
Base pointer/documentation PR follows this PR. Before merge, obtain Morten's release approval: the existing Release Charts mirror workflow republishes the Helm repository on any charts/** change, including the existing homelab-core 0.1.11 package. No operator release or new tag is involved.

## Summary Repeated OOM kills interrupt Authentik reconciliation. Add an installation-specific memory limit override, as requested by Morten for HOMEIT-490: ```diff - memory limit: 128Mi + memory limit: 256Mi ``` The published operator chart stays at 0.3.0; its image, CPU limit and 64Mi memory request remain as deployed. This is a mitigation; memory growth and bounded reconciliation remain under investigation. ## Evidence - **Before:** the live operator pod has six restarts; latest termination was OOMKilled (exit 137) at 2026-10-30T06:31:21Z. Seven-day Prometheus working-set maximum 127.64Mi, RSS maximum 117.22Mi; current working set about 107.5Mi. The resource audit recommends 256Mi. Node usage about 40Gi of 96Gi. - **After, rendered:** core chart emits the Authentik Application override; rendering published authentik-operator 0.3.0 with that override produces a 256Mi limit, 64Mi request and unchanged image. Core Helm lint/render checks and server dry-runs of both Application and Deployment pass. - All 15 clients, 21 groups, five proxy providers and one server currently report ready. Full workload/backlog peak and sustained operation under the new limit remain unverified pending rollout. ## Merge danger **Door:** two-way. Reverting removes the override and restores the OOM-prone 128Mi limit. **Blast radius:** app. One operator rolls; its bound increases by 128Mi on the single node. No Authentik server, access policy or credential change. ## Rollback and verification - **Roll back:** revert this commit through GitOps. - **Verify after rollout:** green pipeline, clean Forgejo mirror, core Application at the merged revision, Authentik Application values, actual Deployment limit/image digest, one ready replica, restarts and memory through startup/reconciliation and continued observation. - **Reviewers:** no security trigger or requested Designer sign-off. Owner reviewed the diff. - Base pointer/documentation PR follows this PR. Before merge, obtain Morten's release approval: the existing `Release Charts` mirror workflow republishes the Helm repository on any `charts/**` change, including the existing homelab-core 0.1.11 package. No operator release or new tag is involved.

morten-olsen added 1 commit

2026-10-30 08:21:58 +01:00