325462b0f9
Move backup resources from separate 'backup' namespace to 'forgejo': - Change CronJob namespace from 'backup' to 'forgejo' - Reuse existing forgejo-postgres-secret instead of duplicate backup secret - Remove backup-namespace.yaml (no longer needed) - Remove forgejo-backup-secret-sealed.yaml (using existing secret) This simplifies the architecture by keeping all Forgejo-related resources in a single namespace and eliminating credential duplication. Co-Authored-By: Paperclip <noreply@paperclip.ing>
48 lines
2 KiB
Markdown
48 lines
2 KiB
Markdown
## Dozzle Deployment Progress
|
|
|
|
### Completed
|
|
|
|
1. ✅ Created deployment manifests in `apps/dozzle/` directory:
|
|
- Namespace, ServiceAccount with cluster-wide RBAC for pod log access
|
|
- PVC (1Gi, hcloud-volumes-encrypted, ReadWriteOnce with Recreate strategy)
|
|
- Deployment with oauth2-proxy sidecar for Pocket ID OIDC authentication
|
|
- Service routing to oauth2-proxy (port 4180)
|
|
- Ingress with TLS for `dozzle.basicstack.de`
|
|
|
|
2. ✅ Created ArgoCD application (`app-dozzle.yaml`) with automated sync
|
|
|
|
3. ✅ Created Pocket ID OIDC client:
|
|
- Client ID: `179c13f2-d251-4e1e-b1a0-c070df350c4e`
|
|
- Callback URL: `https://dozzle.basicstack.de/oauth2/callback`
|
|
- Sealed secret with client credentials and oauth2-proxy cookie secret
|
|
|
|
4. ✅ Configured oauth2-proxy sidecar (running successfully)
|
|
|
|
5. ✅ All manifests committed and pushed to repository
|
|
|
|
### Current Blocker
|
|
|
|
Dozzle container is failing to start with error: **"Could not connect to any Docker Engine"**
|
|
|
|
**Root cause**: Dozzle v10.6.10 is not auto-detecting Kubernetes mode despite:
|
|
- Proper RBAC permissions (ClusterRole with pods, pods/log, namespaces access)
|
|
- Service account correctly mounted at `/var/run/secrets/kubernetes.io/serviceaccount/`
|
|
- ClusterRoleBinding connecting service account to ClusterRole
|
|
|
|
**Troubleshooting attempted**:
|
|
- Tried various command-line flags (`--agent`, `--no-analytics`)
|
|
- Verified RBAC permissions are correct
|
|
- Checked service account token is mounted
|
|
- oauth2-proxy sidecar is working correctly (1/2 containers ready)
|
|
|
|
**Next steps**:
|
|
1. Research Dozzle Kubernetes deployment examples/Helm charts for missing configuration
|
|
2. Consider alternative: Try older Dozzle version or different container log viewer
|
|
3. May need to explicitly configure Kubernetes API endpoint or use different deployment approach
|
|
|
|
**Current pod status**:
|
|
```
|
|
dozzle-f4d557466-qh28j 1/2 CrashLoopBackOff
|
|
```
|
|
|
|
All infrastructure is in place; just need to resolve Dozzle's Kubernetes detection issue.
|