Authelia/LLDAP auth slow (2s LDAP bind, 5s cold DNS) #43

New issue

Open

opened 2026-08-02 12:50:52 +00:00 by lab · 0 comments

lab commented

2026-08-02 12:50:52 +00:00

Owner

Symptoms

Findings (partial, investigation paused)

Client side (workstation -> services)

curl DNS lookup ~2ms, TLS ~28ms, total 30-50ms for auth + git. Fast.
getent hosts ~4-5ms, same with trailing dot.
Both auth + git resolve to 85.156.79.45 (home IP, no Cloudflare proxy).

In-cluster

LLDAP: every login shows one ~2s LDAP bind (rest of the request sub-5ms). [quote truncated - need full log line]
Forgejo pod -> auth: 5.0s cold-cache DNS stall when CoreDNS cache is cold; instant once warm.

Root cause hypothesis

Node resolv.conf is nameserver 127.0.0.53 + search lan (systemd-resolved). Pods use CoreDNS; the lan search suffix causes upstream expansion (e.g. auth.yukselcloud.com.lan.) -> upstream timeouts 5-10s when cache cold. LLDAP 2s bind is a separate, second latency source.

TODO

Get full lldap log line (kubectl -n auth logs deploy/lldap)
Check lldap resource limits
Confirm fix options: k3s --resolv-conf with real upstreams, or coredns-custom lan NXDOMAIN override

## Symptoms Login at auth.yukselcloud.com feels slow (multi-second). ## Findings (partial, investigation paused) ### Client side (workstation -> services) - curl DNS lookup ~2ms, TLS ~28ms, total 30-50ms for auth + git. **Fast.** - getent hosts ~4-5ms, same with trailing dot. - Both auth + git resolve to 85.156.79.45 (home IP, no Cloudflare proxy). ### In-cluster - **LLDAP: every login shows one ~2s LDAP bind** (rest of the request sub-5ms). [quote truncated - need full log line] - Forgejo pod -> auth: **5.0s cold-cache DNS stall** when CoreDNS cache is cold; instant once warm. ### Root cause hypothesis Node resolv.conf is `nameserver 127.0.0.53` + `search lan` (systemd-resolved). Pods use CoreDNS; the `lan` search suffix causes upstream expansion (e.g. `auth.yukselcloud.com.lan.`) -> upstream timeouts 5-10s when cache cold. LLDAP 2s bind is a separate, second latency source. ## TODO - [ ] Get full lldap log line (kubectl -n auth logs deploy/lldap) - [ ] Check lldap resource limits - [ ] Confirm fix options: k3s --resolv-conf with real upstreams, or coredns-custom lan NXDOMAIN override