From 67633464bdcf420a7f3f9405476da3e646e7fae8 Mon Sep 17 00:00:00 2001
From: Doug Robertsonu <drobertson123@gmail.com>
Date: Sat, 13 Jun 2026 13:42:54 -0400
Subject: [PATCH] fix(local): cap keycloak jvm heap and raise nats helm wait
 timeout

Keycloak was OOMKilled in a crashloop during its build phase: with no
heap settings the Quarkus default MaxRAMPercentage=70% plus non-heap RSS
(metaspace, GC, buffers) exceeded the container limit. Constrain the heap
via JAVA_OPTS_KC_HEAP so it fits, and bump the limit to 1.5Gi for
headroom. Keycloak now reaches Ready in ~30s.

The nats-event-bus Helm release uses wait: true, but skaffold relied on
Helm's default 5m --wait timeout. The mTLS NATS cluster can take longer
to become ready on slower/loaded machines, producing
"context deadline exceeded" even though the release ultimately deploys.
Raise the upgrade --timeout to 15m on all three cluster configs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 local/infra/keycloak/keycloak.yaml | 11 +++++++++--
 local/nats/skaffold.releases.yaml  | 12 ++++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/local/infra/keycloak/keycloak.yaml b/local/infra/keycloak/keycloak.yaml
index 2956a99..441f1eb 100644
--- a/local/infra/keycloak/keycloak.yaml
+++ b/local/infra/keycloak/keycloak.yaml
@@ -18,10 +18,10 @@ spec:
   resources:
     requests:
       cpu: "100m"
-      memory: "550Mi"
+      memory: "1Gi"
     limits:
       cpu: "1000m"
-      memory: "550Mi"
+      memory: "1536Mi"
   unsupported:
     podTemplate:
       spec:
@@ -35,6 +35,13 @@ spec:
               - "--verbose"
               - "start"
               - "--import-realm"
+            env:
+              # Constrain the JVM heap so heap + non-heap RSS fits inside the
+              # container memory limit. Without this, Quarkus defaults to
+              # MaxRAMPercentage=70%, and heap + metaspace/GC/buffers exceed the
+              # limit and the pod is OOMKilled during the build phase.
+              - name: JAVA_OPTS_KC_HEAP
+                value: "-Xms256m -Xmx768m"
             volumeMounts:
               - name: realm-import
                 mountPath: /opt/keycloak/data/import
diff --git a/local/nats/skaffold.releases.yaml b/local/nats/skaffold.releases.yaml
index 344fa97..c594a47 100644
--- a/local/nats/skaffold.releases.yaml
+++ b/local/nats/skaffold.releases.yaml
@@ -32,6 +32,10 @@ deploy:
   tolerateFailuresUntilDeadline: true
   helm:
     flags:
+      # Helm's default --wait timeout is 5m; the mTLS NATS cluster can take
+      # longer to become ready on slower/loaded machines, so give it headroom.
+      upgrade:
+        - --timeout=15m
       depBuild:
         - --repository-config=local/helm/repositories.yaml
     releases:
@@ -61,6 +65,10 @@ deploy:
   tolerateFailuresUntilDeadline: true
   helm:
     flags:
+      # Helm's default --wait timeout is 5m; the mTLS NATS cluster can take
+      # longer to become ready on slower/loaded machines, so give it headroom.
+      upgrade:
+        - --timeout=15m
       depBuild:
         - --repository-config=local/helm/repositories.yaml
     releases:
@@ -91,6 +99,10 @@ deploy:
   tolerateFailuresUntilDeadline: true
   helm:
     flags:
+      # Helm's default --wait timeout is 5m; the mTLS NATS cluster can take
+      # longer to become ready on slower/loaded machines, so give it headroom.
+      upgrade:
+        - --timeout=15m
       depBuild:
         - --repository-config=local/helm/repositories.yaml
     releases: