From 3e7238f71cf2e2bc8f9ab2a7b9f76ad77c0aaaa6 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 21 Jul 2026 11:08:23 -0700
Subject: [PATCH] =?UTF-8?q?fix(prometheus):=20scrapeTimeout=20must=20be=20?=
 =?UTF-8?q?<=3D=20scrapeInterval=20=E2=80=94=20authentik/nginx=20SMs=20(60?=
 =?UTF-8?q?s>30s)=20+=20global=20(60s>30s)=20blocked=20operator=20config?=
 =?UTF-8?q?=20gen,=20no=20Prometheus=20STS=20created?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/bootstrap/ingress/nginx-values.yaml        | 2 +-
 k8s/platform/monitoring/prometheus-values.yaml | 7 ++++---
 k8s/security/iam/authentik-values.yaml         | 4 ++--
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/k8s/bootstrap/ingress/nginx-values.yaml b/k8s/bootstrap/ingress/nginx-values.yaml
index 7901322..8872083 100644
--- a/k8s/bootstrap/ingress/nginx-values.yaml
+++ b/k8s/bootstrap/ingress/nginx-values.yaml
@@ -75,4 +75,4 @@ controller:
       enabled: true
       namespace: ingress-nginx
       interval: 30s
-      scrapeTimeout: 60s
+      scrapeTimeout: 30s
diff --git a/k8s/platform/monitoring/prometheus-values.yaml b/k8s/platform/monitoring/prometheus-values.yaml
index 6e2923e..47a819d 100644
--- a/k8s/platform/monitoring/prometheus-values.yaml
+++ b/k8s/platform/monitoring/prometheus-values.yaml
@@ -29,9 +29,10 @@ prometheus:
     retention: 15d
     retentionSize: "18GB"
 
-    # Scrape timeout: increased to 60s to tolerate 5+ second network latency spikes
-    # Default: 10s — too aggressive for latency-prone clusters
-    scrapeInterval: 30s
+    # scrapeTimeout MUST be <= scrapeInterval or the operator refuses to generate
+    # the Prometheus config ("scrapeTimeout greater than scrapeInterval") and no
+    # STS is created. Use a larger interval to keep the 60s timeout headroom.
+    scrapeInterval: 60s
     scrapeTimeout: 60s
     evaluationInterval: 30s
 
diff --git a/k8s/security/iam/authentik-values.yaml b/k8s/security/iam/authentik-values.yaml
index 392af6b..9e34a96 100644
--- a/k8s/security/iam/authentik-values.yaml
+++ b/k8s/security/iam/authentik-values.yaml
@@ -133,7 +133,7 @@ server:
     enabled: true
     serviceMonitor:
       enabled: true
-      scrapeTimeout: 60s
+      scrapeTimeout: 30s
 
 # ── Authentik worker ──────────────────────────────────────────────────────────
 # Runs background tasks: email delivery, LDAP sync, flow policy evaluation,
@@ -169,7 +169,7 @@ worker:
     enabled: true
     serviceMonitor:
       enabled: true
-      scrapeTimeout: 60s
+      scrapeTimeout: 30s
 
 # ── PostgreSQL (external: CloudNativePG cluster in ddb namespace) ─────────────
 # Authentik connects to the centralized ddb-cluster (1 primary + 2 replicas with pgvector).