DEV-452. After the SQLite -> Postgres migration in DEV-451 the pangolin
initial setup was redone, so the controller's stale bearer token was
invalid. That was only half the problem: /api/v1/traefik-config is
served exclusively by Pangolin's internal API (port 3001), not the
external dashboard API (port 3000). Pointing a Bearer request at port
3000 always returned 401 because that path lives on the session-auth
router. This has been the underlying cause of the controller's
CrashLoopBackOff, not just the stale key.
Changes:
- pangolin-controller-api-key-sealed.yaml: reseal new bearer token
(kubeseal against sealed-secrets-controller in kube-system, includes
the Bearer prefix expected by the controller).
- pangolin-controller-config.yaml: CONFIG_ENDPOINT now targets
http://pangolin.pangolin.svc.cluster.local:3001/api/v1/traefik-config.
- pangolin-deployment.yaml: Service now exposes port 3001 as the
"internal" port so in-cluster clients (kube-controller) can reach it.
Ingress still only routes / and /api to ports 3002/3000; port 3001
is not published to the internet.
- pangolin-controller-deployment.yaml: replicas back to 1, dropped the
temporary "scaled to 0" comment block.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The previous sealed secret was missing the "Bearer " prefix in the
auth-header value. The controller uses CONFIG_AUTH_HEADER directly
as the Authorization header, so it needs the complete value.
Sealed value now contains: Bearer abw3ud1ipko7ock.2al7fqzhbmfsqp3bm4byvynyx6jnqe733icjdprd
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The previous sealed secret was created with an incorrect API key.
Re-sealed with the correct API key: abw3ud1ipko7ock.2al7fqzhbmfsqp3bm4byvynyx6jnqe733icjdprd
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Sealed the correct auth header value from the controller config into the
sealed secret. This ensures the controller can authenticate properly with
the Pangolin API.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Update sealed API key (abw3ud1ipko7ock...) in controller secret
- Remove insecure plaintext API key from ConfigMap
- Controller now uses only the sealed secret for authentication
No changes to main Pangolin deployment or database configuration.
Safe to deploy - no risk of database reinitialization.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Adds pangolin-controller-api-key sealed secret with Bearer token
for authenticating to Pangolin API. This enables the controller
to fetch Traefik configuration from Pangolin service.
Resolves: DEV-441
Co-Authored-By: Paperclip <noreply@paperclip.ing>
