unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

logging: deploy logviewer v0.1.0 behind oauth2-proxy #404

Merged
benvin merged 1 commits from benvin/logviewer-deploy into main 2026-08-23 18:51:16 +10:00
Conversation 0 Commits 1 Files Changed 9
+401
unkin-agent commented 2026-08-23 17:32:05 +10:00
Member
Copy Link
Copy Source

Why

The logviewer UI gives browser access to the ClickHouse log store (logreader user). It must only be reachable by authorized users, so it sits behind an Authentik-gated oauth2-proxy front at https://logviewer.unkin.net, mirroring the arrstack front-door and mediamover/pdbmux gateway patterns.

Changes

  • Adds the logviewer Deployment (1 replica, docker-internal/logviewer:v0.1.0) reading ClickHouse at clickhouse-logs via the existing clickhouse-logreader Secret, /healthz probes, nonroot securityContext
  • Adds an oauth2-proxy (quay.io/oauth2-proxy/oauth2-proxy:v7.15.3) front with issuer https://identity.unkin.net/application/o/logviewer/, ak_groups claim, allowed group akP-logviewer-admin, internal-CA trust via the combine-certs initContainer
  • Syncs kv kubernetes/namespace/logging/default/oauth-credentials into the logviewer-oauth-credentials Secret via the existing default VaultAuth (kv path already seeded; no terraform-vault change needed)
  • Adds ClusterIP Services for the app and the oauth2-proxy front door
  • Adds internal Gateway + HTTPRoutes for logviewer.unkin.net (vault-issuer cert, external-dns -> 198.18.200.4, http->https redirect)
  • Registers logviewer/ in the logging base kustomization

Dependency

Login requires the Authentik logviewer provider/application from terraform-authentik PR #21. This PR is safe to merge first: the VSO secret sync and the deployment come up regardless; OIDC login only works once #21 is applied.

Validated with kustomize build (base + au-syd1 overlay) and kubeconform (49/49 valid).

## Why The logviewer UI gives browser access to the ClickHouse log store (`logreader` user). It must only be reachable by authorized users, so it sits behind an Authentik-gated oauth2-proxy front at https://logviewer.unkin.net, mirroring the arrstack front-door and mediamover/pdbmux gateway patterns. ## Changes - Adds the logviewer Deployment (1 replica, `docker-internal/logviewer:v0.1.0`) reading ClickHouse at `clickhouse-logs` via the existing `clickhouse-logreader` Secret, `/healthz` probes, nonroot securityContext - Adds an oauth2-proxy (quay.io/oauth2-proxy/oauth2-proxy:v7.15.3) front with issuer `https://identity.unkin.net/application/o/logviewer/`, `ak_groups` claim, allowed group `akP-logviewer-admin`, internal-CA trust via the combine-certs initContainer - Syncs kv `kubernetes/namespace/logging/default/oauth-credentials` into the `logviewer-oauth-credentials` Secret via the existing `default` VaultAuth (kv path already seeded; no terraform-vault change needed) - Adds ClusterIP Services for the app and the oauth2-proxy front door - Adds internal Gateway + HTTPRoutes for `logviewer.unkin.net` (vault-issuer cert, external-dns -> 198.18.200.4, http->https redirect) - Registers `logviewer/` in the logging base kustomization ## Dependency Login requires the Authentik `logviewer` provider/application from terraform-authentik PR #21. This PR is safe to merge first: the VSO secret sync and the deployment come up regardless; OIDC login only works once #21 is applied. Validated with `kustomize build` (base + au-syd1 overlay) and kubeconform (49/49 valid).
unkin-agent added 1 commit 2026-08-23 17:32:05 +10:00
logging: deploy logviewer v0.1.0 behind oauth2-proxy
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
96e82a3584 
The logviewer UI gives browser access to the ClickHouse log store; it is
deployed behind an Authentik-gated oauth2-proxy front so only
akP-logviewer-admin members reach it, at https://logviewer.unkin.net.

- Adds the logviewer Deployment (docker-internal/logviewer:v0.1.0) reading
  ClickHouse via the existing clickhouse-logreader credentials
- Adds an oauth2-proxy front (quay.io v7.15.3) with ak_groups-based
  authorization, mirroring the arrstack pattern
- Syncs kv kubernetes/namespace/logging/default/oauth-credentials into the
  logviewer-oauth-credentials Secret via the existing default VaultAuth
- Adds internal Gateway + HTTPRoutes for logviewer.unkin.net (vault-issuer
  cert, external-dns -> 198.18.200.4, http->https redirect)
- Registers the logviewer directory in the logging kustomization
benvin merged commit 08a3493097 into main 2026-08-23 18:51:16 +10:00
benvin deleted branch benvin/logviewer-deploy 2026-08-23 18:51:16 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#404
Delete Branch "benvin/logviewer-deploy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?