basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/pangolin/pangolin-controller-config.yaml

15 lines
582 B
YAML
Raw Normal View History

feat(pangolin): Add Kubernetes controller manifests Create complete manifest set for Pangolin controller deployment: - RBAC with ServiceAccount, ClusterRole, and ClusterRoleBinding - ConfigMap with controller configuration (endpoint, namespace, leader election) - Deployment with resource limits, health probes, and security context - Service for metrics endpoint on port 8080 Controller will manage Traefik CRDs (IngressRoute, Middleware, TraefikService) and sync configuration from Pangolin API. Relates to DEV-397 Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-08-01 15:40:30 +00:00
apiVersion: v1
kind: ConfigMap
metadata:
name: pangolin-controller-config
namespace: pangolin
data:
fix(pangolin): Reconnect controller to fresh Postgres Pangolin, route via internal API port 3001 DEV-452. After the SQLite -> Postgres migration in DEV-451 the pangolin initial setup was redone, so the controller's stale bearer token was invalid. That was only half the problem: /api/v1/traefik-config is served exclusively by Pangolin's internal API (port 3001), not the external dashboard API (port 3000). Pointing a Bearer request at port 3000 always returned 401 because that path lives on the session-auth router. This has been the underlying cause of the controller's CrashLoopBackOff, not just the stale key. Changes: - pangolin-controller-api-key-sealed.yaml: reseal new bearer token (kubeseal against sealed-secrets-controller in kube-system, includes the Bearer prefix expected by the controller). - pangolin-controller-config.yaml: CONFIG_ENDPOINT now targets http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config. - pangolin-deployment.yaml: Service now exposes port 3001 as the "internal" port so in-cluster clients (kube-controller) can reach it. Ingress still only routes / and /api to ports 3002/3000; port 3001 is not published to the internet. - pangolin-controller-deployment.yaml: replicas back to 1, dropped the temporary "scaled to 0" comment block. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-08-08 11:35:02 +00:00
# The Traefik dynamic config endpoint lives on Pangolin's internal API port (3001),
# not the external dashboard API (3000). The external port serves the session-authenticated
# dashboard router which returns 401 for Bearer requests to /api/v1/traefik-config.
CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config"
fix(pangolin): Update controller configuration for deployment - Use specific image version 0.1.0-alpha.1 instead of :latest - Fix API endpoint port from 3001 to 3000 (correct Pangolin service port) - Add CONFIG_ALLOW_INSECURE_HTTP for internal cluster HTTP communication - Fix security context with numeric UIDs (65532) to avoid runAsNonRoot error - Add required RBAC permissions for CRD and IngressClass discovery Controller now successfully starts and acquires leader lease. Next step: Configure API authentication (CONFIG_AUTH_HEADER) for controller to access Pangolin API endpoint. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-08-01 15:51:11 +00:00
CONFIG_ALLOW_INSECURE_HTTP: "true"
feat(pangolin): Add Kubernetes controller manifests Create complete manifest set for Pangolin controller deployment: - RBAC with ServiceAccount, ClusterRole, and ClusterRoleBinding - ConfigMap with controller configuration (endpoint, namespace, leader election) - Deployment with resource limits, health probes, and security context - Service for metrics endpoint on port 8080 Controller will manage Traefik CRDs (IngressRoute, Middleware, TraefikService) and sync configuration from Pangolin API. Relates to DEV-397 Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-08-01 15:40:30 +00:00
TARGET_NAMESPACE: "pangolin"
ENABLE_LEADER_ELECTION: "true"
LOG_LEVEL: "info"
Reference in a new issue Copy permalink