- Shipped
- August 27, 2026 at 4:01 AM UTC
- Author
- Kamo
- Commit
- 5302470
Traefik sat at ~485Mi against a 512Mi limit (95%). The cgroup recorded 47836 memory.max hits with oom_kill 0 — never OOM-killed, because enough of the footprint is reclaimable page cache, but every allocation past the ceiling forced synchronous direct reclaim that stalled the process. Those stalls blew the liveness probe's default 1s timeout three times in a row, so the kubelet SIGKILLed the only ingress pod in the cluster (exit 137). Seven restarts, the last two 25 minutes apart. Each restart is a cluster-wide TLS outage: nearly every kamo router matches on HostRegexp() rather than Host(), so no router carries a certificate binding and TLS resolves purely by SNI against the `default` TLSStore. That store has no defaultCertificate, so for the ~11s a restart takes to load it Traefik answers every handshake on every org with its built-in self-signed cert — ERR_CERT_AUTHORITY_INVALID platform-wide.