fix: [alert] KubeHpaMaxedOut (authentik) (#761 )

Merge pull request 'fix(crowdsec): unpack the bouncer on the host, not on the controller' (#758 ) from crowdsec-bouncer-unpack-on-host into master
Reviewed-on: k.renner/homelab#758
2026-09-02 13:45:55 +00:00 · 2026-09-02 11:52:46 +00:00 · 2026-09-02 13:46:23 +02:00 · 2026-09-02 11:41:19 +00:00
2 changed files with 31 additions and 10 deletions
@@ -43,25 +43,35 @@
  become: false
  run_once: true

+# Only the download had to move to the controller — the extraction stays on
+# the host. The ci-ansible image ships a tar that ansible rejects ("detected as
+# tar type None. GNU tar required"), while both host distributions have GNU
+# tar. Shipping the archive rather than the unpacked binary also keeps the
+# artefact that the checksum was verified against intact all the way to the
+# host.
+- name: Copy the bouncer archive to the host
+  ansible.builtin.copy:
+    src: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
+    dest: /opt/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
+    mode: "0644"
+
 # Only the binary. The tarball also carries install.sh / upgrade.sh /
 # uninstall.sh, which manage systemd and config themselves — that is this
 # role's job, and letting them run would leave two owners for the same files.
- name: Unpack the bouncer binary on the controller
+- name: Unpack the bouncer binary
  ansible.builtin.unarchive:
-    src: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
-    dest: /tmp
+    src: /opt/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}.tgz
+    dest: /opt
    remote_src: true
    include:
      - crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer
-    creates: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer
-  delegate_to: localhost
-  become: false
-  run_once: true
+    creates: /opt/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer

 - name: Install the bouncer binary
  ansible.builtin.copy:
-    src: /tmp/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer
+    src: /opt/crowdsec-firewall-bouncer-{{ crowdsec_bouncer_version }}/crowdsec-firewall-bouncer
    dest: /usr/local/bin/crowdsec-firewall-bouncer
+    remote_src: true
    mode: "0755"
  notify: Restart crowdsec firewall bouncer

@@ -120,7 +120,14 @@ spec:
    server:
      resources:
        requests:
-          cpu: 200m
+          # 500m, not 200m: the HPA below targets 70% of *this* request, so at
+          # 200m the scale-up threshold sat at 140m — below the pod's own
+          # ordinary peak. Measured over 7d, a warm server pod p99s at ~108m
+          # and peaks at ~190m, and a freshly-started one burns ~300m booting
+          # Django. That made the HPA oscillate 2<->3<->4 all day and pin at
+          # maxReplicas (KubeHpaMaxedOut, issue #761). At 500m the threshold
+          # is 350m/pod, above the boot burst, so only real load scales out.
+          cpu: 500m
          memory: 1Gi
        limits:
          memory: 2Gi
@@ -154,7 +161,11 @@ spec:
    worker:
      resources:
        requests:
-          cpu: 200m
+          # Same reasoning as server above, and the worker is burstier still:
+          # over 7d its per-pod p99 reaches ~336m and peaks hit ~630m while
+          # running blueprint applies and scheduled tasks. 200m understated
+          # that badly enough that routine task batches read as saturation.
+          cpu: 500m
          memory: 1Gi
        limits:
          memory: 2Gi
Author	SHA1	Message	Date
issue-fix-bot	e0a00f6b05	fix: [alert] KubeHpaMaxedOut (authentik) (#761 ) ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details	2026-09-02 13:45:55 +00:00
k.renner	116d124e2d	Merge pull request 'fix(crowdsec): unpack the bouncer on the host, not on the controller' (#758 ) from crowdsec-bouncer-unpack-on-host into master ci/woodpecker/push/deploy-netbird-proxy Pipeline was successful Details ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#758	2026-09-02 11:52:46 +00:00
claude-botandClaude Opus 5	cf1237bf33	fix(crowdsec): unpack the bouncer on the host, not on the controller ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details The download moved to the controller in the previous fix and now works. The extraction that followed it does not: Failed to find handler for "/tmp/crowdsec-firewall-bouncer-v0.0.36.tgz". Command "/bin/tar" detected as tar type None. GNU tar required. The ci-ansible image ships a tar that ansible's unarchive rejects. Both host distributions have GNU tar, and only the download ever needed to move — the v6-only problem was reaching github.com, not opening a tarball. So the controller now ships the archive rather than the unpacked binary, and the host extracts it. That also keeps the artefact the checksum was verified against intact all the way to its destination, instead of verifying an archive and then copying something extracted from it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-02 13:46:23 +02:00
k.renner	4742b26047	Merge pull request 'feat(llama-embed): switch to bge-m3, activating the Paperless AI config' (#757 ) from embed-bgem3 into master ci/woodpecker/cron/issue-fix Pipeline was successful Details ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#757	2026-09-02 11:41:19 +00:00