Bug: controller + multi mode advertises unroutable backends (Kubernetes)

[m3talstorm]

Chart: pangolin 0.1.0-alpha.1
appVersion: 1.18.3
Traefik: 3.6.9 (k3s, kube-system)

In deployment.type=controller + deployment.mode=multi - the combination the chart README and values both recommend - Pangolin advertises tunnel backends as Gerbil WireGuard peer addresses:

"services": {
  "service1": {"loadBalancer":{"servers":[{"url":"http://100.89.128.4:44602"}]}}
}

That address only exists inside Gerbil's pod network namespace. An externally installed Traefik (a different pod/namespace) has no route to it.

Reproduction

# from the gerbil pod: works
kubectl -n pangolin exec deploy/pangolin-gerbil -- wget -qO- http://100.89.128.4:44602/health
{"time":1784775051.561764}

# from any other pod: unreachable
kubectl -n kube-system run t --rm -i --image=curlimages/curl -- \
  curl -s -o /dev/null -w '%{http_code}\n' -m 5 http://100.89.128.4:44602/health
000

Traefik reports the router and middleware as healthy; every request returns a deterministic 502 Bad Gateway. The tunnel itself is fine, Newt is connected, and all targets report healthy.

No mechanism exists in the chart to bridge this: the template set contains no DaemonSet, route helper, NET_ADMIN init container, or hostNetwork usage.

Docker Compose avoids this by running Traefik with network_mode: service:gerbil (shared netns). Multi-mode Kubernetes has no equivalent.

Additional issue (same root cause): the generated badger middleware hardcodes apiBaseUrl: http://pangolin:3001/api/v1 as a bare hostname that doesn't resolve from another namespace. Badger then fails per-request and returns Go's default 404 page not found, while the Traefik dashboard still shows the router as Success. Workaround: an ExternalName Service aliasing pangolin with externalName: pangolin.pangolin.svc.cluster.local.

Question: how is an externally-installed Traefik expected to reach tunnel backends in controller+multi?

Edit: I also noticed your values-e2e-kind.yaml sets gerbil.startupMode: delayed ("keep Gerbil rendered but not started"), so the E2E workflow never exercises the tunnel data path. Controller+multi is documented as recommended production, and deployment.traefikNamespace explicitly supports an out-of-namespace Traefik, but nothing in the chart makes Gerbil's WireGuard peers routable from there.

[oschwartz10612]

@marcschaeferger could you take a look?

[marcschaeferger]

Will take a look asap. I User reported a similar Issue on Discord about 4 days ago.