authentik: cap ak-pg smartShutdownTimeout to 10s #16

2026-06-13T13:40:36Z

k.renner commented

2026-06-13 13:40:36 +00:00

Bounds ak-pg failover downtime from ~2.7min to ~10-15s. Old primary is dropped from -rw on demotion but the new primary only promotes after the old is fully down; default smart shutdown waits 180s for Authentik's persistent conns to drain, leaving -rw backendless. Caps that wait at 10s. ak-pg first (staged); pprl-pg/im-pg to follow after validation.

k.renner added 1 commit 2026-06-13 13:40:36 +00:00

authentik: cap ak-pg smartShutdownTimeout to 10s 9d7533bc8a

ak-pg failover/switchover caused ~2.7min of app downtime. Root cause: on
demotion CNPG immediately drops the old primary from the -rw service
(role->unhealthy), but only promotes the replacement after the old primary is
fully down. The default smart shutdown waits smartShutdownTimeout=180s for
client connections to drain; Authentik's persistent connections never do, so
-rw stays backendless (clients get "No route to host") for the full window.
Postgres promotion itself is ~3s.

Capping smartShutdownTimeout at 10s bounds the backendless window to ~10-15s
(fast shutdown + promotion). Applied to ak-pg first per staged-rollout; pprl-pg
and im-pg to follow after validation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 8494f7f36d into master

2026-06-13 13:42:02 +00:00

k.renner referenced this issue from a commit

2026-06-13 13:42:03 +00:00

Merge pull request 'authentik: cap ak-pg smartShutdownTimeout to 10s' (#16) from fix/ak-pg-smart-shutdown-timeout into master

k.renner referenced this issue from a commit

2026-06-15 08:38:06 +00:00

cnpg: cap stopDelay (+smartShutdownTimeout) to bound failover wedge

alert-monitor-bot referenced this pull request

2026-10-12 02:29:12 +00:00

[alert] KubeJobFailed (renovate) #1267

Sign in to join this conversation.