From 1361c9bd130e1718f545b7c2a5299ec29ef86ce6 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 21 Jul 2026 22:31:48 -0700
Subject: [PATCH] =?UTF-8?q?fix(authentik):=20widen=20server=20probe=20time?=
 =?UTF-8?q?outs=20(3s->15s)=20=E2=80=94=20slow-but-200=20health=20checks?=
 =?UTF-8?q?=20under=20DB=20contention=20triggered=20a=20liveness=20kill=20?=
 =?UTF-8?q?loop,=20dropping=20the=20pod=20from=20Service=20endpoints=20and?=
 =?UTF-8?q?=20breaking=20OAuth=20provisioning?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/security/iam/authentik-values.yaml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/k8s/security/iam/authentik-values.yaml b/k8s/security/iam/authentik-values.yaml
index 9e34a96..6fa792b 100644
--- a/k8s/security/iam/authentik-values.yaml
+++ b/k8s/security/iam/authentik-values.yaml
@@ -127,6 +127,22 @@ server:
   podAnnotations:
     configmap.reloader.stakater.com/reload: "homelab-ca"
     homelab.io/restart-at: "2026-06-21T13-40"
+  # The /-/health/{live,ready}/ endpoints do a DB round-trip; under transient
+  # CNPG contention they respond in 5-6s while still returning 200. The chart's
+  # default 3s liveness timeout then flags a working backend as dead and kubelet
+  # kills it in a restart loop — the pod never stays Ready, gets dropped from the
+  # authentik-server Service endpoints, and the OAuth-provisioning PostSync hook
+  # fails with "Host is unreachable". Widen the timeouts so slow-but-healthy
+  # checks aren't treated as failures. (Only these fields are overridden; the
+  # chart deep-merges the rest of each probe, incl. the httpGet path.)
+  livenessProbe:
+    timeoutSeconds: 15
+    failureThreshold: 6
+  readinessProbe:
+    timeoutSeconds: 15
+    failureThreshold: 6
+  startupProbe:
+    timeoutSeconds: 15
   # Every OIDC login (Grafana, Argo CD, MinIO, Forgejo) depends on this server —
   # its request latency/error rate explains SSO-driven slowness on those services.
   metrics: