DEV-452. After the SQLite -> Postgres migration in DEV-451 the pangolin
initial setup was redone, so the controller's stale bearer token was
invalid. That was only half the problem: /api/v1/traefik-config is
served exclusively by Pangolin's internal API (port 3001), not the
external dashboard API (port 3000). Pointing a Bearer request at port
3000 always returned 401 because that path lives on the session-auth
router. This has been the underlying cause of the controller's
CrashLoopBackOff, not just the stale key.
Changes:
- pangolin-controller-api-key-sealed.yaml: reseal new bearer token
(kubeseal against sealed-secrets-controller in kube-system, includes
the Bearer prefix expected by the controller).
- pangolin-controller-config.yaml: CONFIG_ENDPOINT now targets
http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config.
- pangolin-deployment.yaml: Service now exposes port 3001 as the
"internal" port so in-cluster clients (kube-controller) can reach it.
Ingress still only routes / and /api to ports 3002/3000; port 3001
is not published to the internet.
- pangolin-controller-deployment.yaml: replicas back to 1, dropped the
temporary "scaled to 0" comment block.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Update sealed API key (abw3ud1ipko7ock...) in controller secret
- Remove insecure plaintext API key from ConfigMap
- Controller now uses only the sealed secret for authentication
No changes to main Pangolin deployment or database configuration.
Safe to deploy - no risk of database reinitialization.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Update CONFIG_ENDPOINT to use port 3000 (API) instead of port 3002 (Web UI)
to resolve empty Traefik configuration issue.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Update controller configuration to fix 401 authentication errors:
- Add CONFIG_AUTH_HEADER with Bearer token for Pangolin API access
- Correct CONFIG_ENDPOINT port from 3000 to 3002 (matches Pangolin service)
- Remove duplicate controller manifests from controller/ subdirectory
The existing controller deployment was failing with 401 errors because
it lacked authentication credentials. This change adds the API key
provided in DEV-437 and corrects the internal service endpoint.
Related: DEV-437
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Move Kubernetes controller manifests from kube-controller/ subdirectory
to the apps/pangolin/ root directory so Argo CD will sync them.
Files renamed with pangolin-controller- prefix:
- configmap.yaml -> pangolin-controller-config.yaml
- deployment.yaml -> pangolin-controller-deployment.yaml
- rbac.yaml -> pangolin-controller-rbac.yaml
- service.yaml -> pangolin-controller-service.yaml
Argo CD was not recursing into the subdirectory, so controller resources
were not being synced. Moving to root directory resolves this.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-08-01 15:52:49 +00:00
Renamed from apps/pangolin/kube-controller/configmap.yaml (Browse further)
