Repository navigation
fix(temporal): bump role connectionLimit 50 → 200 - #134
Conversation
…obes Three changes on top of the auto-generated values from mctl_deploy_service onboard: - dbSecret: pulls DB_USER/DB_PASSWORD from Vault teams/labs/kuptsi-app/database (provisioned earlier via mctl_provision_database) into a Secret consumed by envFrom. DATABASE_URL env composes the full DSN at startup so alembic + Temporal worker share the same shared-pg target. - probes: kuptsi FastAPI exposes /health (src/app.py); base-service defaults aim at /healthz + /readyz which never become Ready. Aimed liveness + readiness at /health to match the app surface. - extraContainers: Temporal worker as a sibling container on the same image. Single build, identical env (DB + Temporal address + user-managed Telegram/Logfire/Yandex secrets added via Backstage), only the entrypoint differs — `python -m src.temporal.worker`. Liveness probe is exec kill -0 since the worker has no HTTP. envFrom on the user-managed secret is `optional: true` so the pod starts before Backstage UI is used to add Telegram/Logfire/Yandex.
Schema setup hook crashed on 'too many connections for role temporal' once all four server pods (frontend/history/matching/worker) came online — each holds maxConns 20 (default) + 10 (visibility), so steady-state usage already grazes 120 and admintools schema-setup runs need a few extras on top. 200 gives comfortable headroom while keeping a hard ceiling against runaway leaks.
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1b175ed7d3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # asyncpg DSN built from $(DB_USER)/$(DB_PASSWORD) injected by dbSecret below. | ||
| # The pydantic settings field name is `database_url` and the lifespan | ||
| # alembic step + Temporal worker both depend on it. | ||
| DATABASE_URL: "postgresql+asyncpg://$(DB_USER):$(DB_PASSWORD)@shared-pg-rw.platform-db.svc.cluster.local:5432/labs-kuptsi-app" |
There was a problem hiding this comment.
DATABASE_URL is now built from $(DB_USER)/$(DB_PASSWORD), but this values file still does not set envFrom for the main container. In base-service/templates/deployment.yaml, envFrom is rendered only from .Values.envFrom; setting dbSecret alone only creates the ExternalSecret and does not inject those vars into the app pod. With no DB_USER/DB_PASSWORD present, Kubernetes leaves unresolved references as literal strings, so the app/worker will attempt to connect with an invalid DSN and fail DB startup paths.
Useful? React with 👍 / 👎.
Schema setup hook fails with 'too many connections for role temporal'. 4 server pods × ~30 connections each saturate the original 50-conn ceiling. 200 leaves headroom.