Mozilla Secures Access to Kubernetes with Pangolin

Challenge

At Mozilla, engineers frequently spin up ephemeral Kubernetes development clusters that have all of the tools they need to develop and test new features against a repeatable preview environment. These clusters are not persistent and are created and destroyed on demand, so any access solution had to be provisioned and torn down just as quickly, without leaving stale credentials or exposed endpoints behind.

Solution

Pangolin delivered a declarative, programmatically configurable way to provide secure, temporary, and authenticated ingress to these environments. Blueprints let Mozilla define the resources and access rules for a cluster as YAML and apply them from the same pipeline that creates the cluster, so ingress comes up automatically as part of provisioning and disappears cleanly when the cluster is destroyed. No manual dashboard work was required and nothing is left listening once the environment is gone. Because access is identity-based rather than network-based, engineers reach a running preview environment with a single authenticated link instead of a shared kubeconfig or VPN profile, and the cluster itself is never exposed to the public internet, even temporarily.

Impact

• Ingress for ephemeral clusters is provisioned and torn down automatically as part of the same pipeline that creates and destroys the cluster
• Engineers get a single authenticated link to a preview environment instead of a shared kubeconfig or VPN profile
• No cluster is ever exposed on the public internet, even temporarily, during development and test cycles
• Blueprint-driven automation replaced manual, one-off CLI configuration for every new environment