homelab/core
Watch
2
0
Fork
You've already forked core
 0
Code Issues 1 Pull requests 6 Projects Releases 56 Packages Wiki Activity

WIP: fix: deploy Authentik operator transport leak correction #83

Draft
morten-olsen wants to merge 1 commit from fix/fe2472f2-authentik-0.3.1 into main
pull from: fix/fe2472f2-authentik-0.3.1
merge into: homelab:main
Conversation 0 Commits 1 Files changed 1 +1 -1
morten-olsen commented 2026-10-30 08:48:28 +01:00
Owner

Summary

Adopt Authentik operator 0.3.1, which reuses a bounded HTTP pool instead of leaking a fresh transport on every client reconciliation. HOMEIT-490 reproduced 100 retained idle connections after 100 clients with 0.3.0. The existing 256Mi memory mitigation stays in place while the corrected image is measured.

- operator chart/image: 0.3.0
+ operator chart/image: 0.3.1

Depends on operator PR #13 and separately approved v0.3.1 publication. Do not merge until the exact source commit's image and Helm chart have been published and checked.

Evidence

  • Before: repeated roughly hourly OOMs at 128Mi. Approved core PR #82 raised the limit to 256Mi, with zero new-pod restarts so far but continued working-set growth (26.76Mi at 07:39Z → 35.64Mi at 07:44Z).
  • Source fix: connection reuse regression fails on the original implementation and passes with the shared pool for success/HTTP503 and per-client credential isolation. TLS modes remain isolated; full API suite under race detection and local complete quality checks pass.
  • After, prepared: core Helm lint/render checks and server dry-run of the Authentik Application pass. Actual published 0.3.1 chart/image checks and rollout are pending release approval/publication. All 42 existing CRs currently report ready under 0.3.0.

Merge danger

Door: two-way for deployment. Reverting this pin restores 0.3.0 with the 256Mi limit. Published operator artifacts remain.

Blast radius: app. Rolls one operator; server image, CR specs, access policies, permissions, credentials and resource settings stay as deployed.

Rollback and verification

  • Roll back: revert this version pin through GitOps, keeping the 256Mi mitigation.
  • Verify after rollout: green CI, clean mirror, expected core revision and operator chart, actual image digest/replica/resources, all client/group/proxy/server reconciliation paths from startup/backlog, working-set/RSS and restarts beyond the old hourly OOM cycle. Live failure injection and sustained bounded behavior remain unverified until measured.
  • Reviewers: owner review; no widening of trust, exposure, execution or privileges. No requested Designer sign-off.
  • Core's existing mirror workflow republishes homelab-core 0.1.11 and unchanged companion packages on merge. Include that publication and the operator rollout in Morten's new release approval.
## Summary Adopt Authentik operator 0.3.1, which reuses a bounded HTTP pool instead of leaking a fresh transport on every client reconciliation. HOMEIT-490 reproduced 100 retained idle connections after 100 clients with 0.3.0. The existing 256Mi memory mitigation stays in place while the corrected image is measured. ```diff - operator chart/image: 0.3.0 + operator chart/image: 0.3.1 ``` Depends on [operator PR #13](https://code.olsen.cloud/homelab/authentik-operator/pulls/13) and separately approved v0.3.1 publication. Do not merge until the exact source commit's image and Helm chart have been published and checked. ## Evidence - **Before:** repeated roughly hourly OOMs at 128Mi. Approved core PR #82 raised the limit to 256Mi, with zero new-pod restarts so far but continued working-set growth (26.76Mi at 07:39Z → 35.64Mi at 07:44Z). - **Source fix:** connection reuse regression fails on the original implementation and passes with the shared pool for success/HTTP503 and per-client credential isolation. TLS modes remain isolated; full API suite under race detection and local complete quality checks pass. - **After, prepared:** core Helm lint/render checks and server dry-run of the Authentik Application pass. Actual published 0.3.1 chart/image checks and rollout are pending release approval/publication. All 42 existing CRs currently report ready under 0.3.0. ## Merge danger **Door:** two-way for deployment. Reverting this pin restores 0.3.0 with the 256Mi limit. Published operator artifacts remain. **Blast radius:** app. Rolls one operator; server image, CR specs, access policies, permissions, credentials and resource settings stay as deployed. ## Rollback and verification - **Roll back:** revert this version pin through GitOps, keeping the 256Mi mitigation. - **Verify after rollout:** green CI, clean mirror, expected core revision and operator chart, actual image digest/replica/resources, all client/group/proxy/server reconciliation paths from startup/backlog, working-set/RSS and restarts beyond the old hourly OOM cycle. Live failure injection and sustained bounded behavior remain unverified until measured. - **Reviewers:** owner review; no widening of trust, exposure, execution or privileges. No requested Designer sign-off. - Core's existing mirror workflow republishes homelab-core 0.1.11 and unchanged companion packages on merge. Include that publication and the operator rollout in Morten's new release approval.
fix: deploy Authentik operator transport leak correction
All checks were successful
ci/woodpecker/push/charts Pipeline was successful
Details
ci/woodpecker/pr/charts Pipeline was successful
Details
efc93db2b7
All checks were successful
ci/woodpecker/push/charts Pipeline was successful
Details
ci/woodpecker/pr/charts Pipeline was successful
Details
This pull request has changes conflicting with the target branch.
  • charts/core/values.yaml
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin 'fix/fe2472f2-authentik-0.3.1:fix/fe2472f2-authentik-0.3.1'
git switch 'fix/fe2472f2-authentik-0.3.1'

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch 'main'
git merge --no-ff 'fix/fe2472f2-authentik-0.3.1'
git switch 'fix/fe2472f2-authentik-0.3.1'
git rebase 'main'
git switch 'main'
git merge --ff-only 'fix/fe2472f2-authentik-0.3.1'
git switch 'fix/fe2472f2-authentik-0.3.1'
git rebase 'main'
git switch 'main'
git merge --no-ff 'fix/fe2472f2-authentik-0.3.1'
git switch 'main'
git merge --squash 'fix/fe2472f2-authentik-0.3.1'
git switch 'main'
git merge --ff-only 'fix/fe2472f2-authentik-0.3.1'
git switch 'main'
git merge 'fix/fe2472f2-authentik-0.3.1'
git push origin 'main'
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
homelab/core!83
No description provided.