From d78f89fb99ba713694c12041a5baf27bea8db0b1 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 19 Jul 2026 13:25:01 +0000 Subject: [PATCH] Add Dozzle container log viewer deployment Deploy Dozzle (https://dozzle.dev/) for real-time container log viewing in the k8s cluster. Configuration: - Namespace: dozzle - Domain: dozzle.basicstack.de - Storage: 1Gi PVC with hcloud-volumes-encrypted storage class - Authentication: Pocket ID OIDC integration - RBAC: Cluster-wide pod log access via service account - Strategy: Recreate with ReadWriteOnce PVC for persistent settings Created Pocket ID OIDC client: - Client ID: 179c13f2-d251-4e1e-b1a0-c070df350c4e - Callback URL: https://dozzle.basicstack.de/oauth/callback ArgoCD application configured with automated sync and self-heal. Co-Authored-By: Paperclip --- apps/app-dozzle.yaml | 20 +++++++++++ apps/dozzle/README.md | 35 ++++++++++++++++++ apps/dozzle/deployment.yaml | 56 +++++++++++++++++++++++++++++ apps/dozzle/dozzle-oidc-sealed.yaml | 19 ++++++++++ apps/dozzle/ingress.yaml | 26 ++++++++++++++ apps/dozzle/namespace.yaml | 4 +++ apps/dozzle/pvc.yaml | 12 +++++++ apps/dozzle/service-account.yaml | 40 +++++++++++++++++++++ apps/dozzle/service.yaml | 13 +++++++ 9 files changed, 225 insertions(+) create mode 100644 apps/app-dozzle.yaml create mode 100644 apps/dozzle/README.md create mode 100644 apps/dozzle/deployment.yaml create mode 100644 apps/dozzle/dozzle-oidc-sealed.yaml create mode 100644 apps/dozzle/ingress.yaml create mode 100644 apps/dozzle/namespace.yaml create mode 100644 apps/dozzle/pvc.yaml create mode 100644 apps/dozzle/service-account.yaml create mode 100644 apps/dozzle/service.yaml diff --git a/apps/app-dozzle.yaml b/apps/app-dozzle.yaml new file mode 100644 index 0000000..8bad403 --- /dev/null +++ b/apps/app-dozzle.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: dozzle + namespace: argocd +spec: + project: default + source: + repoURL: git@forgejo.forgejo.svc.cluster.local:basicstack/stack.basicstack.de.git + targetRevision: main + path: apps/dozzle + destination: + server: https://kubernetes.default.svc + namespace: dozzle + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/apps/dozzle/README.md b/apps/dozzle/README.md new file mode 100644 index 0000000..423612a --- /dev/null +++ b/apps/dozzle/README.md @@ -0,0 +1,35 @@ +# Dozzle Deployment + +Dozzle is a real-time log viewer for Docker containers running in the Kubernetes cluster. + +## Components + +- **Namespace**: `dozzle` +- **Domain**: `dozzle.basicstack.de` +- **Storage**: 1Gi PVC using `hcloud-volumes-encrypted` storage class +- **Authentication**: Pocket ID OIDC integration + +## Files + +- `namespace.yaml`: Dozzle namespace +- `service-account.yaml`: Service account with RBAC for accessing pod logs cluster-wide +- `pvc.yaml`: Persistent volume claim for Dozzle settings (1Gi, ReadWriteOnce with Recreate strategy) +- `deployment.yaml`: Dozzle deployment with OIDC authentication +- `service.yaml`: Kubernetes service +- `ingress.yaml`: Traefik ingress with TLS +- `dozzle-oidc-sealed.yaml`: Sealed secret with OIDC credentials + +## Pocket ID OIDC Client + +- **Client ID**: `179c13f2-d251-4e1e-b1a0-c070df350c4e` +- **Client Name**: Dozzle +- **Callback URL**: `https://dozzle.basicstack.de/oauth/callback` +- **Scopes**: `openid profile email` + +## Access + +After deployment, access Dozzle at https://dozzle.basicstack.de and authenticate with Pocket ID credentials. + +## ArgoCD + +The application is managed by ArgoCD via `app-dozzle.yaml` in the parent apps directory. diff --git a/apps/dozzle/deployment.yaml b/apps/dozzle/deployment.yaml new file mode 100644 index 0000000..ac24cf4 --- /dev/null +++ b/apps/dozzle/deployment.yaml @@ -0,0 +1,56 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: dozzle + namespace: dozzle +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: dozzle + template: + metadata: + labels: + app: dozzle + spec: + serviceAccountName: dozzle + containers: + - name: dozzle + image: amir20/dozzle:latest + ports: + - containerPort: 8080 + name: http + protocol: TCP + env: + - name: DOZZLE_LEVEL + value: "info" + - name: DOZZLE_AUTH_PROVIDER + value: "oidc" + - name: DOZZLE_AUTH_OIDC_PROVIDER_URL + value: "https://auth.basicstack.de" + - name: DOZZLE_AUTH_OIDC_CLIENT_ID + valueFrom: + secretKeyRef: + name: dozzle-oidc + key: client-id + - name: DOZZLE_AUTH_OIDC_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: dozzle-oidc + key: client-secret + volumeMounts: + - name: dozzle-data + mountPath: /data + resources: + limits: + cpu: 500m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + volumes: + - name: dozzle-data + persistentVolumeClaim: + claimName: dozzle-data diff --git a/apps/dozzle/dozzle-oidc-sealed.yaml b/apps/dozzle/dozzle-oidc-sealed.yaml new file mode 100644 index 0000000..6a23fa1 --- /dev/null +++ b/apps/dozzle/dozzle-oidc-sealed.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: dozzle-oidc + namespace: dozzle +spec: + encryptedData: + client-id: AgAijJ3Jxjath5x5mqYJ8YJYoDm0qEXRPvkShD53wRepXPkIInF/X+DaBfI8SEaqasfLI2j0SGLOB0xFR6j9CbiqSJ5Oy+AgI9pVB9eKLZEgrd0WywhYPW24SOflLxgsBOiQkhx6xy+S3dg7qj9q/CqPajnNQYS/FnJsV4YOzlZekcLnizhqnK2gPykAHMoKQZLecKSScUvMzDwwS21gEuhJK+8onR63i7q+EQWbZMSH/60yAvOAJDECM9ZxAwWziCkGZAhv+Ir+W+D6Hmls6uy53uARtUktVfZM9JDBcqM9M8WltXcQKOh9lV00V3Tu6HBF+3IP1gRMzQyDnli3zG6Zdnq41+wVv4k9nh6obZBeMbx/4aib2w0uwnCBFUXI6QaK3Uy309ZUF/tu6TshQExXTAHLRafOWTKmFlrutDF3gcLZqGhVrFzsant/IRmx3xiIOYphtJyAQA8KrvNJGLXSHOpDmkE96IJPYdAPypBAb9qKEFnDe05btem1ZqyPwjm27HDxmQHsz27Bnhd3o3a7I+cO7mM6J4yJex4zRiN/DEZfmxqfnGI2AwByn+xdxlCdxqjfAVn5NGo24KPLmayxNxSDeF/2tLl8uXaCPn0Q2qALgsMvbTmujLdU9PXsHqM6D5W9OOu1aG2MocIg/uMRXld9PjHG1mpw/81G1B/qVsY5BIlessEksoIARRb7DmVEmf18KjONnQc47VuQWmtjPgPtYdAeekUxxPwnMbtZVA/xYEM= + client-secret: AgBjUlnxkPi0KVwb/lM/C+F72+aU6TTGWk/t3hpYkCApG7lFuFukshwIi2WWf09UMa5HwHLDuF+a4pf88+JYgecE0tU3oAcDHHiL2xN97bjebustcLAM0JqORPW10yMJ0xqLg70SFyp/rR7AdJAIVETvTB/dxheaP7gtbR1m669FrP3MiAIcV2U2b3HUc1iw0tkpNv+lQD33b5pStSlZDdc8eg2xmfiLgsCTzVla3lysAtGwXORsaP9L1HOhCy4GDc3YfeAdbIsNbFy2q/ug6vlytM6rHZgwt9Pmln7CTQGuLkDPPN3qG79TUIUgQ4nK+CxVXZYq044b+2G+mihdEfNe6GwmQus/SsFqhv5+nQcxWJKZwl3VSf3zhWBLRSbnYSvTRnGyqOGnc5isffxNnXWuJ0UUBiV8wcy9l9j2La4isB+GTEIlUZTPxyCwCx3v43ugb0BzhEPpQ5kB/FR0kdQgBcYitxE+sonwe7CUcv+wDtm1JtDwPyTJLKY2JSFGafsJtoTf8VFIyXdXe4I54gRA5c51TW+86spKqCy01UGhOR9wbo/pzf/esG9SHaOZNDPWeXTZneLdeYRf+RVj+eGRusRaGgByKgIDR9UHiJQTPvJC35YB/J7glJN0+kkO2UVrlYeD+o6ukWttfE2oW2aPxHXrMs68iUsgyLg/Lpc0MwzjJqGnBXYHhbbEcg9Oa6p/OxvQhOpzXq0GtIhd70iXsmlrRMCp8YlW+Lq/kExWQA== + template: + metadata: + creationTimestamp: null + name: dozzle-oidc + namespace: dozzle + annotations: + argocd.argoproj.io/compare-options: IgnoreExtraneous + type: Opaque diff --git a/apps/dozzle/ingress.yaml b/apps/dozzle/ingress.yaml new file mode 100644 index 0000000..e617348 --- /dev/null +++ b/apps/dozzle/ingress.yaml @@ -0,0 +1,26 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: dozzle + namespace: dozzle + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + traefik.ingress.kubernetes.io/router.entrypoints: web,websecure + traefik.ingress.kubernetes.io/preserve-host: "true" +spec: + ingressClassName: traefik + rules: + - host: dozzle.basicstack.de + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: dozzle + port: + number: 8080 + tls: + - hosts: + - dozzle.basicstack.de + secretName: dozzle-tls diff --git a/apps/dozzle/namespace.yaml b/apps/dozzle/namespace.yaml new file mode 100644 index 0000000..58ca594 --- /dev/null +++ b/apps/dozzle/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: dozzle diff --git a/apps/dozzle/pvc.yaml b/apps/dozzle/pvc.yaml new file mode 100644 index 0000000..1b895cc --- /dev/null +++ b/apps/dozzle/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: dozzle-data + namespace: dozzle +spec: + accessModes: + - ReadWriteOnce + storageClassName: hcloud-volumes-encrypted + resources: + requests: + storage: 1Gi diff --git a/apps/dozzle/service-account.yaml b/apps/dozzle/service-account.yaml new file mode 100644 index 0000000..08bc556 --- /dev/null +++ b/apps/dozzle/service-account.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: dozzle + namespace: dozzle +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: dozzle +rules: +- apiGroups: + - "" + resources: + - pods + - pods/log + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: dozzle +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: dozzle +subjects: +- kind: ServiceAccount + name: dozzle + namespace: dozzle diff --git a/apps/dozzle/service.yaml b/apps/dozzle/service.yaml new file mode 100644 index 0000000..293d189 --- /dev/null +++ b/apps/dozzle/service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: dozzle + namespace: dozzle +spec: + selector: + app: dozzle + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP