d5618fb6c8
Add pangolin-kube-controller deployment to enable Pangolin-based access policies for Kubernetes ingress resources. Controller configuration: - Image: ghcr.io/fosrl/pangolin-kube-controller:0.1.0-alpha.1 - API endpoint: https://pangolin.basicstack.de/api/v1/traefik-config - Target namespace: pangolin - Polling interval: 15s - Leader election: disabled (single replica) Includes: - ServiceAccount for controller pod - ClusterRole with required RBAC permissions for Traefik CRDs - Deployment with proper security context and resource limits - Service for metrics endpoint (:9090) Related: DEV-437 Co-Authored-By: Paperclip <noreply@paperclip.ing>
59 lines
1.7 KiB
YAML
59 lines
1.7 KiB
YAML
---
|
|
# ClusterRole for pangolin-kube-controller
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: pangolin-kube-controller
|
|
labels:
|
|
app.kubernetes.io/name: pangolin-kube-controller
|
|
app.kubernetes.io/component: controller
|
|
app.kubernetes.io/part-of: pangolin
|
|
rules:
|
|
# Traefik CRDs - full access to manage IngressRoutes, Middlewares, and TraefikServices
|
|
- apiGroups: ["traefik.io"]
|
|
resources:
|
|
- ingressroutes
|
|
- ingressroutetcps
|
|
- ingressrouteudps
|
|
- middlewares
|
|
- middlewaretcps
|
|
- traefikservices
|
|
- serverstransports
|
|
- serverstransporttcps
|
|
- tlsoptions
|
|
- tlsstores
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
|
|
# IngressClass - read-only for validation
|
|
- apiGroups: ["networking.k8s.io"]
|
|
resources: ["ingressclasses"]
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Leader election - requires lease access
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
|
|
|
# Events - for operational notifications
|
|
- apiGroups: [""]
|
|
resources: ["events"]
|
|
verbs: ["create", "patch", "get", "list"]
|
|
|
|
---
|
|
# ClusterRoleBinding for pangolin-kube-controller
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: pangolin-kube-controller
|
|
labels:
|
|
app.kubernetes.io/name: pangolin-kube-controller
|
|
app.kubernetes.io/component: controller
|
|
app.kubernetes.io/part-of: pangolin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: pangolin-kube-controller
|
|
namespace: pangolin
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: pangolin-kube-controller
|
|
apiGroup: rbac.authorization.k8s.io
|