helm(neo): scale-ready defaults for postgres + api

charts/netapp-neo/templates/postgres-statefulset.yaml

@@ -18,10 +18,26 @@ spec:
       labels:
         {{- include "netapp-neo.selectorLabels" (dict "context" . "component" "postgres") | nindent 8 }}
     spec:
+      {{- with .Values.postgresql.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.postgresql.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: postgres
           image: "{{ .Values.postgresql.image.repository }}:{{ .Values.postgresql.image.tag }}"
           imagePullPolicy: {{ .Values.postgresql.image.pullPolicy }}
+          {{- with .Values.postgresql.extraArgs }}
+          args:
+            - postgres
+            {{- range . }}
+            - "-c"
+            - {{ . | quote }}
+            {{- end }}
+          {{- end }}
           ports:
             - name: postgres
               containerPort: 5432

charts/netapp-neo/values.yaml

@@ -27,7 +27,17 @@ api:
     className:
     annotations: {}
     tls: []
-  resources: {}
+  # Defaults sized for medium deployments (≤ 100 M files / ≤ 100 shares).
+  # For multi-billion-file deployments, override limits.memory to 8Gi+ and
+  # see the PERFORMANCE_TUNING_GUIDE — cross-share endpoints can build large
+  # responses in memory.
+  resources:
+    requests:
+      cpu: "500m"
+      memory: "1Gi"
+    limits:
+      cpu: "2"
+      memory: "4Gi"
   env:
     # JWT
     JWT_SECRET_KEY: ""
@@ -188,5 +198,17 @@ postgresql:
     size: 8Gi
     annotations: {}
   resources: {}
+  # Pin postgres to a specific node when its PVC is on local-path / hostpath
+  # storage. Leave empty to let the scheduler decide.
+  nodeSelector: {}
+  tolerations: []
+  # Postgres command-line tuning passed via -c. Defaults set the safety net
+  # against share-creation-blocking-on-readers (see EVIDENCE F10):
+  #   idle_in_transaction_session_timeout=60s caps how long a transaction can
+  #   sit idle while still holding locks; auto-aborts and releases its locks
+  #   after the timeout. Without it a stuck client can block partition creates
+  #   for any new share indefinitely.
+  extraArgs:
+    - "idle_in_transaction_session_timeout=60s"
   # When postgresql.enabled is false, set this to your external DB URL
   externalDatabaseUrl: ""