From fd6581d2630f86e168041f09de797a012c6e5daf Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sat, 1 Aug 2026 15:51:11 +0000
Subject: [PATCH] fix(pangolin): Update controller configuration for deployment

- Use specific image version 0.1.0-alpha.1 instead of :latest
- Fix API endpoint port from 3001 to 3000 (correct Pangolin service port)
- Add CONFIG_ALLOW_INSECURE_HTTP for internal cluster HTTP communication
- Fix security context with numeric UIDs (65532) to avoid runAsNonRoot error
- Add required RBAC permissions for CRD and IngressClass discovery

Controller now successfully starts and acquires leader lease.
Next step: Configure API authentication (CONFIG_AUTH_HEADER) for
controller to access Pangolin API endpoint.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/pangolin/kube-controller/configmap.yaml  |  3 ++-
 apps/pangolin/kube-controller/deployment.yaml |  7 +++++--
 apps/pangolin/kube-controller/rbac.yaml       | 16 ++++++++++++++++
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/apps/pangolin/kube-controller/configmap.yaml b/apps/pangolin/kube-controller/configmap.yaml
index e934f1c..4304194 100644
--- a/apps/pangolin/kube-controller/configmap.yaml
+++ b/apps/pangolin/kube-controller/configmap.yaml
@@ -4,7 +4,8 @@ metadata:
   name: pangolin-controller-config
   namespace: pangolin
 data:
-  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config"
+  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3000/api/v1/traefik-config"
+  CONFIG_ALLOW_INSECURE_HTTP: "true"
   TARGET_NAMESPACE: "pangolin"
   ENABLE_LEADER_ELECTION: "true"
   LOG_LEVEL: "info"
diff --git a/apps/pangolin/kube-controller/deployment.yaml b/apps/pangolin/kube-controller/deployment.yaml
index 43d97f4..64d8229 100644
--- a/apps/pangolin/kube-controller/deployment.yaml
+++ b/apps/pangolin/kube-controller/deployment.yaml
@@ -21,8 +21,8 @@ spec:
       serviceAccountName: pangolin-controller
       containers:
         - name: controller
-          image: fosrl/pangolin-kube-controller:latest
-          imagePullPolicy: Always
+          image: fosrl/pangolin-kube-controller:0.1.0-alpha.1
+          imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:
                 name: pangolin-controller-config
@@ -61,5 +61,8 @@ spec:
                 - ALL
       securityContext:
         runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
         seccompProfile:
           type: RuntimeDefault
diff --git a/apps/pangolin/kube-controller/rbac.yaml b/apps/pangolin/kube-controller/rbac.yaml
index 6fdb3e8..029331b 100644
--- a/apps/pangolin/kube-controller/rbac.yaml
+++ b/apps/pangolin/kube-controller/rbac.yaml
@@ -9,6 +9,22 @@ kind: ClusterRole
 metadata:
   name: pangolin-controller
 rules:
+  # CRD discovery
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+  # IngressClass discovery
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingressclasses
+    verbs:
+      - get
+      - list
   # Traefik CRDs - full CRUD
   - apiGroups:
       - traefik.containo.us