Fix pangolin-kube-controller authentication and endpoint

Update controller configuration to fix 401 authentication errors:
- Add CONFIG_AUTH_HEADER with Bearer token for Pangolin API access
- Correct CONFIG_ENDPOINT port from 3000 to 3002 (matches Pangolin service)
- Remove duplicate controller manifests from controller/ subdirectory

The existing controller deployment was failing with 401 errors because
it lacked authentication credentials. This change adds the API key
provided in DEV-437 and corrects the internal service endpoint.

Related: DEV-437

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/pangolin/controller/controller-deployment.yaml

@@ -1,103 +0,0 @@
----
-# Pangolin Kube Controller Deployment
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pangolin-kube-controller
-  namespace: pangolin
-  labels:
-    app.kubernetes.io/name: pangolin-kube-controller
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/part-of: pangolin
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: pangolin-kube-controller
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: pangolin-kube-controller
-        app.kubernetes.io/component: controller
-        app.kubernetes.io/part-of: pangolin
-    spec:
-      serviceAccountName: pangolin-kube-controller
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        fsGroup: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-      - name: controller
-        image: ghcr.io/fosrl/pangolin-kube-controller:0.1.0-alpha.1
-        imagePullPolicy: IfNotPresent
-        securityContext:
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 65532
-          capabilities:
-            drop:
-              - ALL
-        env:
-          # Pangolin API Configuration
-          - name: CONFIG_ENDPOINT
-            value: "https://pangolin.basicstack.de/api/v1/traefik-config"
-          - name: CONFIG_AUTH_HEADER
-            value: "Bearer 5qid06u9j325kpk.ywd3bpsx34dtxyczgatyxuoxkzwhie7d72k6v4hw"
-
-          # Target namespace for Traefik resources
-          - name: TARGET_NAMESPACE
-            value: "pangolin"
-
-          # Metrics server configuration
-          - name: METRICS_ADDR
-            value: ":9090"
-
-          # Polling interval
-          - name: POLL_INTERVAL
-            value: "15s"
-
-          # Leader election (disabled for single replica)
-          - name: ENABLE_LEADER_ELECTION
-            value: "false"
-
-          # Traefik ingress class
-          - name: INGRESS_CLASS
-            value: "traefik"
-
-          # Logging configuration
-          - name: LOG_TRAEFIK_CONFIG
-            value: "false"
-          - name: CONFIG_LOG_PREVIEW
-            value: "false"
-          - name: FETCH_LOG_INTERVAL
-            value: "5m"
-        ports:
-        - name: metrics
-          containerPort: 9090
-          protocol: TCP
-        livenessProbe:
-          httpGet:
-            path: /livez
-            port: 9090
-          initialDelaySeconds: 15
-          periodSeconds: 20
-          timeoutSeconds: 5
-          failureThreshold: 3
-        readinessProbe:
-          httpGet:
-            path: /readyz
-            port: 9090
-          initialDelaySeconds: 10
-          periodSeconds: 10
-          timeoutSeconds: 5
-          failureThreshold: 3
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "50m"
-          limits:
-            memory: "256Mi"
-            cpu: "200m"

apps/pangolin/controller/controller-rbac.yaml

@@ -1,59 +0,0 @@
----
-# ClusterRole for pangolin-kube-controller
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: pangolin-kube-controller
-  labels:
-    app.kubernetes.io/name: pangolin-kube-controller
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/part-of: pangolin
-rules:
-  # Traefik CRDs - full access to manage IngressRoutes, Middlewares, and TraefikServices
-  - apiGroups: ["traefik.io"]
-    resources:
-      - ingressroutes
-      - ingressroutetcps
-      - ingressrouteudps
-      - middlewares
-      - middlewaretcps
-      - traefikservices
-      - serverstransports
-      - serverstransporttcps
-      - tlsoptions
-      - tlsstores
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-
-  # IngressClass - read-only for validation
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingressclasses"]
-    verbs: ["get", "list", "watch"]
-
-  # Leader election - requires lease access
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["get", "list", "watch", "create", "update", "patch"]
-
-  # Events - for operational notifications
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch", "get", "list"]
-
----
-# ClusterRoleBinding for pangolin-kube-controller
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: pangolin-kube-controller
-  labels:
-    app.kubernetes.io/name: pangolin-kube-controller
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/part-of: pangolin
-subjects:
-  - kind: ServiceAccount
-    name: pangolin-kube-controller
-    namespace: pangolin
-roleRef:
-  kind: ClusterRole
-  name: pangolin-kube-controller
-  apiGroup: rbac.authorization.k8s.io

apps/pangolin/controller/controller-service.yaml

@@ -1,20 +0,0 @@
----
-# Service for pangolin-kube-controller metrics
-apiVersion: v1
-kind: Service
-metadata:
-  name: pangolin-kube-controller
-  namespace: pangolin
-  labels:
-    app.kubernetes.io/name: pangolin-kube-controller
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/part-of: pangolin
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: pangolin-kube-controller
-  ports:
-  - name: metrics
-    port: 9090
-    targetPort: 9090
-    protocol: TCP

apps/pangolin/controller/controller-serviceaccount.yaml

@@ -1,11 +0,0 @@
----
-# ServiceAccount for pangolin-kube-controller
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: pangolin-kube-controller
-  namespace: pangolin
-  labels:
-    app.kubernetes.io/name: pangolin-kube-controller
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/part-of: pangolin

apps/pangolin/pangolin-controller-config.yaml

@@ -4,7 +4,8 @@ metadata:
   name: pangolin-controller-config
   namespace: pangolin
 data:
-  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3000/api/v1/traefik-config"
+  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3002/api/v1/traefik-config"
+  CONFIG_AUTH_HEADER: "Bearer 5qid06u9j325kpk.ywd3bpsx34dtxyczgatyxuoxkzwhie7d72k6v4hw"
   CONFIG_ALLOW_INSECURE_HTTP: "true"
   TARGET_NAMESPACE: "pangolin"
   ENABLE_LEADER_ELECTION: "true"