fix(pangolin): Update controller configuration for deployment

- Use specific image version 0.1.0-alpha.1 instead of :latest
- Fix API endpoint port from 3001 to 3000 (correct Pangolin service port)
- Add CONFIG_ALLOW_INSECURE_HTTP for internal cluster HTTP communication
- Fix security context with numeric UIDs (65532) to avoid runAsNonRoot error
- Add required RBAC permissions for CRD and IngressClass discovery

Controller now successfully starts and acquires leader lease.
Next step: Configure API authentication (CONFIG_AUTH_HEADER) for
controller to access Pangolin API endpoint.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/pangolin/kube-controller/configmap.yaml

@@ -4,7 +4,8 @@ metadata:
   name: pangolin-controller-config
   namespace: pangolin
 data:
-  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config"
+  CONFIG_ENDPOINT: "http://pangolin.pangolin.svc.cluster.local:3000/api/v1/traefik-config"
+  CONFIG_ALLOW_INSECURE_HTTP: "true"
   TARGET_NAMESPACE: "pangolin"
   ENABLE_LEADER_ELECTION: "true"
   LOG_LEVEL: "info"

apps/pangolin/kube-controller/deployment.yaml

@@ -21,8 +21,8 @@ spec:
       serviceAccountName: pangolin-controller
       containers:
         - name: controller
-          image: fosrl/pangolin-kube-controller:latest
+          image: fosrl/pangolin-kube-controller:0.1.0-alpha.1
-          imagePullPolicy: Always
+          imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:
                 name: pangolin-controller-config
@@ -61,5 +61,8 @@ spec:
                 - ALL
       securityContext:
         runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
         seccompProfile:
           type: RuntimeDefault

apps/pangolin/kube-controller/rbac.yaml

@@ -9,6 +9,22 @@ kind: ClusterRole
 metadata:
   name: pangolin-controller
 rules:
+  # CRD discovery
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+  # IngressClass discovery
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingressclasses
+    verbs:
+      - get
+      - list
   # Traefik CRDs - full CRUD
   - apiGroups:
       - traefik.containo.us