From 9d7533bc8a997d03c98144d4242c048f28daa0ca Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Sat, 13 Jun 2026 15:39:51 +0200 Subject: [PATCH] authentik: cap ak-pg smartShutdownTimeout to 10s ak-pg failover/switchover caused ~2.7min of app downtime. Root cause: on demotion CNPG immediately drops the old primary from the -rw service (role->unhealthy), but only promotes the replacement after the old primary is fully down. The default smart shutdown waits smartShutdownTimeout=180s for client connections to drain; Authentik's persistent connections never do, so -rw stays backendless (clients get "No route to host") for the full window. Postgres promotion itself is ~3s. Capping smartShutdownTimeout at 10s bounds the backendless window to ~10-15s (fast shutdown + promotion). Applied to ak-pg first per staged-rollout; pprl-pg and im-pg to follow after validation. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/seed/authentik/cluster.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kubernetes/seed/authentik/cluster.yaml b/kubernetes/seed/authentik/cluster.yaml index d957a840..fd0bc143 100644 --- a/kubernetes/seed/authentik/cluster.yaml +++ b/kubernetes/seed/authentik/cluster.yaml @@ -5,6 +5,13 @@ metadata: namespace: authentik spec: instances: 2 + # Cap graceful-drain on demotion: on failover/switchover the old primary is + # removed from the -rw service immediately, but the new primary is only + # promoted once the old one is down. The default smart-shutdown waits 180s + # for client connections to drain (Authentik holds persistent conns), leaving + # -rw backendless that whole time. Capping at 10s bounds failover downtime to + # ~10-15s (fast shutdown + promotion). + smartShutdownTimeout: 10 imageName: ghcr.io/cloudnative-pg/postgresql:16 enableSuperuserAccess: true storage: -- 2.54.0