EthDevOps · elasticroentgen · Jul 3, 2026 · Jul 3, 2026
diff --git a/charts/mattermost-sync/README.md b/charts/mattermost-sync/README.md
@@ -1,6 +1,6 @@
 # mattermost-sync
 
-![Version: 1.0.9](https://img.shields.io/badge/Version-1.0.9-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.0.0](https://img.shields.io/badge/AppVersion-v1.0.0-informational?style=flat-square)
+![Version: 1.0.10](https://img.shields.io/badge/Version-1.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.0.0](https://img.shields.io/badge/AppVersion-v1.0.0-informational?style=flat-square)
 
 Sync groups and users from Google Workspace to Mattermost
 
@@ -19,6 +19,8 @@ Sync groups and users from Google Workspace to Mattermost
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | affinity | object | `{}` |  |
+| cronjob.args[0] | string | `"sync_groups_to_mattermost.py"` |  |
+| cronjob.command[0] | string | `"python"` |  |
 | cronjob.concurrencyPolicy | string | `"Forbid"` |  |
 | cronjob.enabled | bool | `true` |  |
 | cronjob.failedJobsHistoryLimit | int | `1` |  |

diff --git a/charts/safe-infrastructure/Chart.yaml b/charts/safe-infrastructure/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: safe-infrastructure
 description: A Helm chart for Safe Infrastructure services
 type: application
-version: 0.1.20
+version: 0.1.21
 appVersion: "1.0.0"
 maintainers:
   - name: Safe Team

diff --git a/charts/safe-infrastructure/README.md b/charts/safe-infrastructure/README.md
@@ -1,6 +1,6 @@
 # safe-infrastructure
 
-![Version: 0.1.20](https://img.shields.io/badge/Version-0.1.20-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 0.1.21](https://img.shields.io/badge/Version-0.1.21-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
 
 A Helm chart for Safe Infrastructure services
 
@@ -40,6 +40,7 @@ A Helm chart for Safe Infrastructure services
 | cfg.image | string | `"safeglobal/safe-config-service"` |  |
 | cfg.pullPolicy | string | `"Always"` |  |
 | cfg.replicas | int | `1` |  |
+| cfg.webConcurrency | int | `4` |  |
 | cgw.env.emailApiApplicationCode | string | `""` |  |
 | cgw.env.emailApiFromEmail | string | `"changeme@example.com"` |  |
 | cgw.env.emailApiKey | string | `""` |  |

diff --git a/charts/safe-infrastructure/templates/cfg-deployment.yaml b/charts/safe-infrastructure/templates/cfg-deployment.yaml
@@ -42,6 +42,10 @@ spec:
         env:
         - name: CSRF_COOKIE_NAME
           value: "csrf_cfg"
+        # Without this the config-service gunicorn defaults to
+        # cpu_count() * 2 workers, sized by the node, not the pod.
+        - name: WEB_CONCURRENCY
+          value: {{ .Values.cfg.webConcurrency | quote }}
         - name: PYTHONDONTWRITEBYTECODE
           value: {{ .Values.cfg.env.pythonDontWriteBytecode | quote }}
         - name: SECRET_KEY
@@ -135,7 +139,7 @@ spec:
           periodSeconds: {{ .Values.healthCheck.periodSeconds }}
           timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml .Values.resources | nindent 10 }}
+          {{- toYaml (default .Values.resources .Values.cfg.resources) | nindent 10 }}
       - name: nginx-staticfiles
         image: "{{ .Values.staticNginx.image.repository }}:{{ .Values.staticNginx.image.tag }}"
         imagePullPolicy: {{ .Values.staticNginx.image.pullPolicy }}

diff --git a/charts/safe-infrastructure/templates/cgw-deployment.yaml b/charts/safe-infrastructure/templates/cgw-deployment.yaml
@@ -131,4 +131,4 @@ spec:
           periodSeconds: {{ .Values.healthCheck.periodSeconds }}
           timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml .Values.resources | nindent 10 }}
+          {{- toYaml (default .Values.resources .Values.cgw.resources) | nindent 10 }}
diff --git a/charts/safe-infrastructure/templates/databases.yaml b/charts/safe-infrastructure/templates/databases.yaml
@@ -65,7 +65,7 @@ spec:
           periodSeconds: {{ $.Values.healthCheck.periodSeconds }}
           timeoutSeconds: {{ $.Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml $.Values.resources | nindent 10 }}
+          {{- toYaml (default $.Values.resources $.Values.databases.resources) | nindent 10 }}
       volumes:
       - name: postgres-data
         {{- if $.Values.persistence.enabled }}

diff --git a/charts/safe-infrastructure/templates/events-deployment.yaml b/charts/safe-infrastructure/templates/events-deployment.yaml
@@ -83,4 +83,4 @@ spec:
           periodSeconds: {{ .Values.healthCheck.periodSeconds }}
           timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml .Values.resources | nindent 10 }}
+          {{- toYaml (default .Values.resources .Values.events.resources) | nindent 10 }}
diff --git a/charts/safe-infrastructure/templates/nginx-deployment.yaml b/charts/safe-infrastructure/templates/nginx-deployment.yaml
@@ -51,7 +51,7 @@ spec:
           periodSeconds: 30
           timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml .Values.resources | nindent 10 }}
+          {{- toYaml (default .Values.resources .Values.nginx.resources) | nindent 10 }}
       volumes:
       - name: nginx-config
         configMap:

diff --git a/charts/safe-infrastructure/templates/rabbitmq.yaml b/charts/safe-infrastructure/templates/rabbitmq.yaml
@@ -49,5 +49,5 @@ spec:
           timeoutSeconds: {{ $.Values.healthCheck.timeoutSeconds }}
           failureThreshold: {{ $.Values.healthCheck.failureThreshold }}
         resources:
-          {{- toYaml $.Values.resources | nindent 10 }}
+          {{- toYaml (default $.Values.resources $.Values.rabbitmq.resources) | nindent 10 }}
 {{- end }}
diff --git a/charts/safe-infrastructure/templates/redis.yaml b/charts/safe-infrastructure/templates/redis.yaml
@@ -45,5 +45,5 @@ spec:
           periodSeconds: {{ $.Values.healthCheck.periodSeconds }}
           timeoutSeconds: {{ $.Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml $.Values.resources | nindent 10 }}
+          {{- toYaml (default $.Values.resources $.Values.redis.resources) | nindent 10 }}
 {{- end }}
diff --git a/charts/safe-infrastructure/templates/txs-deployment.yaml b/charts/safe-infrastructure/templates/txs-deployment.yaml
@@ -110,7 +110,7 @@ spec:
           periodSeconds: {{ .Values.healthCheck.periodSeconds }}
           timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml .Values.resources | nindent 10 }}
+          {{- toYaml (default .Values.resources .Values.txs.resources) | nindent 10 }}
       - name: nginx-staticfiles
         image: "{{ .Values.staticNginx.image.repository }}:{{ .Values.staticNginx.image.tag }}"
         imagePullPolicy: {{ .Values.staticNginx.image.pullPolicy }}
@@ -228,7 +228,7 @@ spec:
           periodSeconds: {{ $.Values.healthCheck.periodSeconds }}
           timeoutSeconds: {{ $.Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml $.Values.resources | nindent 10 }}
+          {{- toYaml (default $.Values.resources $.Values.txs.resources) | nindent 10 }}
 ---
 {{- end }}
 apiVersion: apps/v1
@@ -327,7 +327,7 @@ spec:
           periodSeconds: {{ .Values.healthCheck.periodSeconds | mul 2 }}
           timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml .Values.resources | nindent 10 }}
+          {{- toYaml (default .Values.resources .Values.txs.resources) | nindent 10 }}
 ---
 apiVersion: v1
 kind: ConfigMap

diff --git a/charts/safe-infrastructure/templates/ui-deployment.yaml b/charts/safe-infrastructure/templates/ui-deployment.yaml
@@ -74,4 +74,4 @@ spec:
           periodSeconds: {{ .Values.healthCheck.periodSeconds }}
           timeoutSeconds: {{ .Values.healthCheck.timeoutSeconds }}
         resources:
-          {{- toYaml .Values.resources | nindent 10 }}
+          {{- toYaml (default .Values.resources .Values.ui.resources) | nindent 10 }}
diff --git a/charts/safe-infrastructure/values.yaml b/charts/safe-infrastructure/values.yaml
@@ -77,6 +77,10 @@ cfg:
   replicas: 1
   image: safeglobal/safe-config-service
   pullPolicy: Always
+  # Number of gunicorn workers for cfg-web. The image defaults to
+  # cpu_count() * 2, which on a large node spawns dozens of workers
+  # (~144Mi each) and can exhaust the pod memory limit.
+  webConcurrency: 4
   env:
     pythonDontWriteBytecode: "true"
     debug: "true"
@@ -189,6 +193,9 @@ persistence:
   size: 10Gi
 
 # Default resources applied to every workload container.
+# Each component can override these with its own `resources` block:
+# nginx, databases, redis, rabbitmq, txs, cfg, cgw, events, ui
+# (e.g. `redis: { resources: { requests: ..., limits: ... } }`).
 resources:
   requests:
     cpu: 100m