diff --git a/apps/pangolin/kube-controller/configmap.yaml b/apps/pangolin/kube-controller/configmap.yaml
index e934f1c..4304194 100644
--- a/apps/pangolin/kube-controller/configmap.yaml
+++ b/apps/pangolin/kube-controller/configmap.yaml
@@ -4,7 +4,8 @@ metadata:
   name: pangolin-controller-config
   namespace: pangolin
 data:
-  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config"
+  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3000/api/v1/traefik-config"
+  CONFIG_ALLOW_INSECURE_HTTP: "true"
   TARGET_NAMESPACE: "pangolin"
   ENABLE_LEADER_ELECTION: "true"
   LOG_LEVEL: "info"
diff --git a/apps/pangolin/kube-controller/deployment.yaml b/apps/pangolin/kube-controller/deployment.yaml
index 43d97f4..64d8229 100644
--- a/apps/pangolin/kube-controller/deployment.yaml
+++ b/apps/pangolin/kube-controller/deployment.yaml
@@ -21,8 +21,8 @@ spec:
       serviceAccountName: pangolin-controller
       containers:
         - name: controller
-          image: fosrl/pangolin-kube-controller:latest
-          imagePullPolicy: Always
+          image: fosrl/pangolin-kube-controller:0.1.0-alpha.1
+          imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:
                 name: pangolin-controller-config
@@ -61,5 +61,8 @@ spec:
                 - ALL
       securityContext:
         runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
         seccompProfile:
           type: RuntimeDefault
diff --git a/apps/pangolin/kube-controller/rbac.yaml b/apps/pangolin/kube-controller/rbac.yaml
index 6fdb3e8..029331b 100644
--- a/apps/pangolin/kube-controller/rbac.yaml
+++ b/apps/pangolin/kube-controller/rbac.yaml
@@ -9,6 +9,22 @@ kind: ClusterRole
 metadata:
   name: pangolin-controller
 rules:
+  # CRD discovery
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+  # IngressClass discovery
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingressclasses
+    verbs:
+      - get
+      - list
   # Traefik CRDs - full CRUD
   - apiGroups:
       - traefik.containo.us