Skip to content

devnet-8: let the chart create the agent faucet's basic-auth secret - #69

Merged
qu0b merged 1 commit into
masterfrom
qu0b/faucet-agents-basic-auth
Aug 21, 2026
Merged

devnet-8: let the chart create the agent faucet's basic-auth secret#69
qu0b merged 1 commit into
masterfrom
qu0b/faucet-agents-basic-auth

Conversation

@qu0b

@qu0b qu0b commented Aug 21, 2026

Copy link
Copy Markdown
Member

Problem

faucet-agents.glamsterdam-devnet-8.ethpandaops.io has been returning 503 since the network was deployed — with and without credentials. The ingress asks for basic auth, but the powfaucet-agents-basic-auth secret it references was never created; that step was manual and got missed here. devnet-7 answers 401 because someone created it there by hand.

A missing auth secret does not make the ingress fall through to the upstream, it makes the controller 503 the whole host, so there was nothing in the response pointing at the cause. evm.faucet through the panda proxy fails on devnet-8 with that 503 body.

Change

Regenerated faucet and faucet-agents against the released collection: powfaucet 1.2.0 takes the htpasswd line as a value and creates the secret itself, so the ansible template passes the srv credential from vault and the annotations are gone.

Also pins gen_kubernetes_config_network_display_name: Plataberget, which the generated values have been carrying by hand since 3502cc6 and 035e55b (the second one titled "post-regen", after a regeneration ate the first). With the variable set, this regeneration leaves every title alone.

Rendered result

$ helm template faucet-agents ./faucet-agents
kind: Secret
metadata:
  name: powfaucet-agents-basic-auth
---
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-secret: powfaucet-agents-basic-auth
    nginx.ingress.kubernetes.io/auth-type: basic

The secret keeps the name the old annotation used, so this adopts rather than duplicates. The browser faucet renders no secret and its values are untouched — only its chart pin moves.

After sync the host should answer 401 instead of 503, and evm.faucet should behave like it already does on devnet-7.

The faucet-agents ingress has asked for basic auth since it was deployed,
but the secret it referenced was never created — that step was manual and
got missed here, so the ingress has been returning 503 for the whole host
ever since, unauthenticated requests included. devnet-7 works because
someone created the secret there by hand.

powfaucet 1.2.0 takes the htpasswd line as a value and creates the secret
itself (ethpandaops/ethereum-helm-charts#493), and the ansible template
passes the srv credential straight from vault
(ethpandaops/ansible-collection-general#579), so regenerating is enough.
The secret keeps the name the annotation used, so nothing else moves.

Also pin the display name the generated values have been carrying by hand
since 3502cc6 and 035e55b, so the next regeneration stops reverting it.

@redpandabot redpandabot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regenerates faucet and faucet-agents against the released ansible collection and powfaucet chart 1.2.0, so the chart now creates the powfaucet-agents-basic-auth secret (and its ingress annotations) that was previously a missed manual step — fixing the 503 on the agents faucet hosted behind the panda proxy. Verified byte-identical charts/lockfiles, exact rendered output matching the description, an auth secret whose name and {PLAIN} htpasswd format are compatible with the existing nginx-ingress setup, and an added display-name var that keeps regeneration idempotent. No issues found.


Reviewed 10 changed file(s) @ 8bf0bacc — no blocking issues found.
"Two weeks is the universal estimate."

@qu0b
qu0b merged commit e46b944 into master Aug 21, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant