From 22823ba5996c2b619b5e282ae1440be2c52c3392 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 2 Aug 2026 10:09:46 +0000 Subject: [PATCH] Fix pangolin-kube-controller authentication and endpoint Update controller configuration to fix 401 authentication errors: - Add CONFIG_AUTH_HEADER with Bearer token for Pangolin API access - Correct CONFIG_ENDPOINT port from 3000 to 3002 (matches Pangolin service) - Remove duplicate controller manifests from controller/ subdirectory The existing controller deployment was failing with 401 errors because it lacked authentication credentials. This change adds the API key provided in DEV-437 and corrects the internal service endpoint. Related: DEV-437 Co-Authored-By: Paperclip --- .../controller/controller-deployment.yaml | 103 ------------------ apps/pangolin/controller/controller-rbac.yaml | 59 ---------- .../controller/controller-service.yaml | 20 ---- .../controller/controller-serviceaccount.yaml | 11 -- apps/pangolin/pangolin-controller-config.yaml | 3 +- 5 files changed, 2 insertions(+), 194 deletions(-) delete mode 100644 apps/pangolin/controller/controller-deployment.yaml delete mode 100644 apps/pangolin/controller/controller-rbac.yaml delete mode 100644 apps/pangolin/controller/controller-service.yaml delete mode 100644 apps/pangolin/controller/controller-serviceaccount.yaml diff --git a/apps/pangolin/controller/controller-deployment.yaml b/apps/pangolin/controller/controller-deployment.yaml deleted file mode 100644 index de629c9..0000000 --- a/apps/pangolin/controller/controller-deployment.yaml +++ /dev/null @@ -1,103 +0,0 @@ ---- -# Pangolin Kube Controller Deployment -apiVersion: apps/v1 -kind: Deployment -metadata: - name: pangolin-kube-controller - namespace: pangolin - labels: - app.kubernetes.io/name: pangolin-kube-controller - app.kubernetes.io/component: controller - app.kubernetes.io/part-of: pangolin -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: pangolin-kube-controller - template: - metadata: - labels: - app.kubernetes.io/name: pangolin-kube-controller - app.kubernetes.io/component: controller - app.kubernetes.io/part-of: pangolin - spec: - serviceAccountName: pangolin-kube-controller - securityContext: - runAsNonRoot: true - runAsUser: 65532 - fsGroup: 65532 - seccompProfile: - type: RuntimeDefault - containers: - - name: controller - image: ghcr.io/fosrl/pangolin-kube-controller:0.1.0-alpha.1 - imagePullPolicy: IfNotPresent - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 65532 - capabilities: - drop: - - ALL - env: - # Pangolin API Configuration - - name: CONFIG_ENDPOINT - value: "https://pangolin.basicstack.de/api/v1/traefik-config" - - name: CONFIG_AUTH_HEADER - value: "Bearer 5qid06u9j325kpk.ywd3bpsx34dtxyczgatyxuoxkzwhie7d72k6v4hw" - - # Target namespace for Traefik resources - - name: TARGET_NAMESPACE - value: "pangolin" - - # Metrics server configuration - - name: METRICS_ADDR - value: ":9090" - - # Polling interval - - name: POLL_INTERVAL - value: "15s" - - # Leader election (disabled for single replica) - - name: ENABLE_LEADER_ELECTION - value: "false" - - # Traefik ingress class - - name: INGRESS_CLASS - value: "traefik" - - # Logging configuration - - name: LOG_TRAEFIK_CONFIG - value: "false" - - name: CONFIG_LOG_PREVIEW - value: "false" - - name: FETCH_LOG_INTERVAL - value: "5m" - ports: - - name: metrics - containerPort: 9090 - protocol: TCP - livenessProbe: - httpGet: - path: /livez - port: 9090 - initialDelaySeconds: 15 - periodSeconds: 20 - timeoutSeconds: 5 - failureThreshold: 3 - readinessProbe: - httpGet: - path: /readyz - port: 9090 - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 - resources: - requests: - memory: "64Mi" - cpu: "50m" - limits: - memory: "256Mi" - cpu: "200m" diff --git a/apps/pangolin/controller/controller-rbac.yaml b/apps/pangolin/controller/controller-rbac.yaml deleted file mode 100644 index 33794f2..0000000 --- a/apps/pangolin/controller/controller-rbac.yaml +++ /dev/null @@ -1,59 +0,0 @@ ---- -# ClusterRole for pangolin-kube-controller -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: pangolin-kube-controller - labels: - app.kubernetes.io/name: pangolin-kube-controller - app.kubernetes.io/component: controller - app.kubernetes.io/part-of: pangolin -rules: - # Traefik CRDs - full access to manage IngressRoutes, Middlewares, and TraefikServices - - apiGroups: ["traefik.io"] - resources: - - ingressroutes - - ingressroutetcps - - ingressrouteudps - - middlewares - - middlewaretcps - - traefikservices - - serverstransports - - serverstransporttcps - - tlsoptions - - tlsstores - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] - - # IngressClass - read-only for validation - - apiGroups: ["networking.k8s.io"] - resources: ["ingressclasses"] - verbs: ["get", "list", "watch"] - - # Leader election - requires lease access - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "watch", "create", "update", "patch"] - - # Events - for operational notifications - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch", "get", "list"] - ---- -# ClusterRoleBinding for pangolin-kube-controller -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: pangolin-kube-controller - labels: - app.kubernetes.io/name: pangolin-kube-controller - app.kubernetes.io/component: controller - app.kubernetes.io/part-of: pangolin -subjects: - - kind: ServiceAccount - name: pangolin-kube-controller - namespace: pangolin -roleRef: - kind: ClusterRole - name: pangolin-kube-controller - apiGroup: rbac.authorization.k8s.io diff --git a/apps/pangolin/controller/controller-service.yaml b/apps/pangolin/controller/controller-service.yaml deleted file mode 100644 index 63e9d7b..0000000 --- a/apps/pangolin/controller/controller-service.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -# Service for pangolin-kube-controller metrics -apiVersion: v1 -kind: Service -metadata: - name: pangolin-kube-controller - namespace: pangolin - labels: - app.kubernetes.io/name: pangolin-kube-controller - app.kubernetes.io/component: controller - app.kubernetes.io/part-of: pangolin -spec: - type: ClusterIP - selector: - app.kubernetes.io/name: pangolin-kube-controller - ports: - - name: metrics - port: 9090 - targetPort: 9090 - protocol: TCP diff --git a/apps/pangolin/controller/controller-serviceaccount.yaml b/apps/pangolin/controller/controller-serviceaccount.yaml deleted file mode 100644 index 22ff23e..0000000 --- a/apps/pangolin/controller/controller-serviceaccount.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -# ServiceAccount for pangolin-kube-controller -apiVersion: v1 -kind: ServiceAccount -metadata: - name: pangolin-kube-controller - namespace: pangolin - labels: - app.kubernetes.io/name: pangolin-kube-controller - app.kubernetes.io/component: controller - app.kubernetes.io/part-of: pangolin diff --git a/apps/pangolin/pangolin-controller-config.yaml b/apps/pangolin/pangolin-controller-config.yaml index 4304194..8499719 100644 --- a/apps/pangolin/pangolin-controller-config.yaml +++ b/apps/pangolin/pangolin-controller-config.yaml @@ -4,7 +4,8 @@ metadata: name: pangolin-controller-config namespace: pangolin data: - CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3000/api/v1/traefik-config" + CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3002/api/v1/traefik-config" + CONFIG_AUTH_HEADER: "Bearer 5qid06u9j325kpk.ywd3bpsx34dtxyczgatyxuoxkzwhie7d72k6v4hw" CONFIG_ALLOW_INSECURE_HTTP: "true" TARGET_NAMESPACE: "pangolin" ENABLE_LEADER_ELECTION: "true"