fix: [alert] KubeDeploymentReplicasMismatch (paperless) (#897 )

2026-09-21 10:45:06 +00:00
1 changed files with 26 additions and 1 deletions
@@ -27,6 +27,24 @@ data:
  PAPERLESS_ALLOWED_HOSTS: "*"
  PAPERLESS_TIME_ZONE: "Europe/Berlin"
  PAPERLESS_OCR_LANGUAGE: "deu+eng"
+  # OCR concurrency, and it is a memory setting rather than a speed one.
+  #
+  # ocrmypdf sizes its worker pool from os.cpu_count(), which reports the
+  # HOST's CPU count and does not observe cgroup limits. k8s-1 has 20 cores,
+  # so an unset THREADS_PER_WORKER meant "Starting processing with 20 workers
+  # concurrently" against a 2Gi limit: 20 pages rasterised at once, over the
+  # limit ~4s later, exitCode 137 / OOMKilled. One multi-page scan therefore
+  # crash-looped the whole Deployment: the container died ~37s into each
+  # start, so the pod sat in CrashLoopBackOff and the web UI was unavailable
+  # too, not just consumption. Adding resources.limits.cpu does NOT fix this
+  # — os.cpu_count() ignores CPU quota.
+  #
+  # Peak memory scales with the PRODUCT TASK_WORKERS * THREADS_PER_WORKER, so
+  # both are pinned; leaving either to an upstream default leaves the bound
+  # undefined. TASK_WORKERS "1" is the value this version already resolved to
+  # (celery logged `concurrency: 1 (prefork)`) — explicit, not a change.
+  PAPERLESS_TASK_WORKERS: "1"
+  PAPERLESS_THREADS_PER_WORKER: "4"
  PAPERLESS_CONSUMER_RECURSIVE: "true"
  PAPERLESS_CONSUMER_DELETE_DUPLICATES: "true"
  PAPERLESS_CONSUMER_ENABLE_BARCODES: "true"
@@ -273,7 +291,14 @@ spec:
              cpu: 200m
              memory: 512Mi
            limits:
-              memory: 2Gi
+              # 4Gi, raised from 2Gi: margin behind the OCR concurrency cap in
+              # paperless-config, not a fix on its own. Bounding the worker
+              # pool is what removes the cliff; this just stops a single
+              # unusually large scan from sitting right at the edge of it.
+              # No CPU limit on purpose — the container's boot can run a
+              # checksum backfill and a full index rebuild, and throttling
+              # that risks losing the startupProbe budget below.
+              memory: 4Gi
          securityContext:
            runAsNonRoot: false
            allowPrivilegeEscalation: true