fix(prometheus): scrapeTimeout must be <= scrapeInterval — authentik/nginx SMs (60s>30s) + global (60s>30s) blocked operator config gen, no Prometheus STS created

k8s/bootstrap/ingress/nginx-values.yaml

@@ -75,4 +75,4 @@ controller:
       enabled: true
       namespace: ingress-nginx
       interval: 30s
-      scrapeTimeout: 60s
+      scrapeTimeout: 30s

k8s/platform/monitoring/prometheus-values.yaml

@@ -29,9 +29,10 @@ prometheus:
     retention: 15d
     retentionSize: "18GB"
 
-    # Scrape timeout: increased to 60s to tolerate 5+ second network latency spikes
-    # Default: 10s — too aggressive for latency-prone clusters
-    scrapeInterval: 30s
+    # scrapeTimeout MUST be <= scrapeInterval or the operator refuses to generate
+    # the Prometheus config ("scrapeTimeout greater than scrapeInterval") and no
+    # STS is created. Use a larger interval to keep the 60s timeout headroom.
+    scrapeInterval: 60s
     scrapeTimeout: 60s
     evaluationInterval: 30s
 

k8s/security/iam/authentik-values.yaml

@@ -133,7 +133,7 @@ server:
     enabled: true
     serviceMonitor:
       enabled: true
-      scrapeTimeout: 60s
+      scrapeTimeout: 30s
 
 # ── Authentik worker ──────────────────────────────────────────────────────────
 # Runs background tasks: email delivery, LDAP sync, flow policy evaluation,
@@ -169,7 +169,7 @@ worker:
     enabled: true
     serviceMonitor:
       enabled: true
-      scrapeTimeout: 60s
+      scrapeTimeout: 30s
 
 # ── PostgreSQL (external: CloudNativePG cluster in ddb namespace) ─────────────
 # Authentik connects to the centralized ddb-cluster (1 primary + 2 replicas with pgvector).