devnet-8: let the chart create the agent faucet's basic-auth secret - #69
Merged
Conversation
The faucet-agents ingress has asked for basic auth since it was deployed, but the secret it referenced was never created — that step was manual and got missed here, so the ingress has been returning 503 for the whole host ever since, unauthenticated requests included. devnet-7 works because someone created the secret there by hand. powfaucet 1.2.0 takes the htpasswd line as a value and creates the secret itself (ethpandaops/ethereum-helm-charts#493), and the ansible template passes the srv credential straight from vault (ethpandaops/ansible-collection-general#579), so regenerating is enough. The secret keeps the name the annotation used, so nothing else moves. Also pin the display name the generated values have been carrying by hand since 3502cc6 and 035e55b, so the next regeneration stops reverting it.
There was a problem hiding this comment.
Regenerates faucet and faucet-agents against the released ansible collection and powfaucet chart 1.2.0, so the chart now creates the powfaucet-agents-basic-auth secret (and its ingress annotations) that was previously a missed manual step — fixing the 503 on the agents faucet hosted behind the panda proxy. Verified byte-identical charts/lockfiles, exact rendered output matching the description, an auth secret whose name and {PLAIN} htpasswd format are compatible with the existing nginx-ingress setup, and an added display-name var that keeps regeneration idempotent. No issues found.
Reviewed 10 changed file(s) @ 8bf0bacc — no blocking issues found.
"Two weeks is the universal estimate."
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
faucet-agents.glamsterdam-devnet-8.ethpandaops.iohas been returning503since the network was deployed — with and without credentials. The ingress asks for basic auth, but thepowfaucet-agents-basic-authsecret it references was never created; that step was manual and got missed here. devnet-7 answers401because someone created it there by hand.A missing auth secret does not make the ingress fall through to the upstream, it makes the controller 503 the whole host, so there was nothing in the response pointing at the cause.
evm.faucetthrough the panda proxy fails on devnet-8 with that 503 body.Change
Regenerated
faucetandfaucet-agentsagainst the released collection: powfaucet 1.2.0 takes the htpasswd line as a value and creates the secret itself, so the ansible template passes the srv credential from vault and the annotations are gone.ingress.basicAuthAlso pins
gen_kubernetes_config_network_display_name: Plataberget, which the generated values have been carrying by hand since 3502cc6 and 035e55b (the second one titled "post-regen", after a regeneration ate the first). With the variable set, this regeneration leaves every title alone.Rendered result
The secret keeps the name the old annotation used, so this adopts rather than duplicates. The browser
faucetrenders no secret and its values are untouched — only its chart pin moves.After sync the host should answer
401instead of503, andevm.faucetshould behave like it already does on devnet-7.