zabbix: Update openshift proxy configuration

Signed-off-by: David Kirwan <davidkirwanirl@gmail.com>

roles/zabbix/zabbix_openshift_proxy/defaults/main.yml

@@ -1,4 +1,11 @@
 ---
+zabbix_openshift_proxy_namespace: zabbix
+# Must match zabbixProxy.persistentVolume.existingClaim in templates/zabbix-values.yaml.j2.
+zabbix_openshift_proxy_pvc_name: zabbix-zabbix-helm-chart-proxy
+zabbix_openshift_proxy_pvc_size: 2Gi
+zabbix_openshift_proxy_pvc_storage_class: ocs-storagecluster-ceph-rbd
+zabbix_openshift_agent_daemonset_name: zabbix-zabbix-helm-chart-agent
+
 # Used by templates/zabbix-values.yaml.j2 for zabbixProxy TLS-PSK (incoming client connections).
 # Inventory sets zabbix_tls_psk_identity and zabbix_tls_psk (private) in group_vars; staging
 # layers map zabbix_tls_psk -> zabbix_tls_stg_psk. This fallback keeps the template valid when

roles/zabbix/zabbix_openshift_proxy/tasks/call-helm.yaml

@@ -19,12 +19,12 @@
     chdir: /tmp/zabbix-kubernetes-helm/
   changed_when: true
 
-- name: Deploy Forgejo chart from local path
+- name: Deploy Zabbix Openshift Proxy
   kubernetes.core.helm:
     name: zabbix
     create_namespace: true
     chart_ref: /tmp/zabbix-kubernetes-helm/
     release_name: zabbix
-    release_namespace: zabbix
+    release_namespace: "{{ zabbix_openshift_proxy_namespace }}"
     values_files:
       - "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-values.yaml"

roles/zabbix/zabbix_openshift_proxy/tasks/create-zabbix-proxy-pvc.yaml

@@ -0,0 +1,11 @@
+---
+- name: Generate the zabbix-proxy-pvc.yaml from template
+  ansible.builtin.template:
+    src: zabbix-proxy-pvc.yaml.j2
+    dest: "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-proxy-pvc.yaml"
+    mode: "0770"
+
+- name: Deploy the zabbix-proxy PVC
+  kubernetes.core.k8s:
+    state: present
+    src: "/root/ocp4/openshift-apps/zabbix-proxy/zabbix-proxy-pvc.yaml"

roles/zabbix/zabbix_openshift_proxy/tasks/grant-zabbix-agent-scc.yaml

@@ -0,0 +1,24 @@
+---
+- name: Look up Zabbix agent DaemonSet service account
+  kubernetes.core.k8s_info:
+    api_version: apps/v1
+    kind: DaemonSet
+    name: "{{ zabbix_openshift_agent_daemonset_name }}"
+    namespace: "{{ zabbix_openshift_proxy_namespace }}"
+  register: zabbix_openshift_agent_daemonset
+
+- name: Grant privileged SCC to Zabbix agent service account
+  ansible.builtin.command:
+    argv:
+      - oc
+      - adm
+      - policy
+      - add-scc-to-user
+      - privileged
+      - -z
+      - "{{ zabbix_openshift_agent_daemonset.resources[0].spec.template.spec.serviceAccountName }}"
+      - -n
+      - "{{ zabbix_openshift_proxy_namespace }}"
+  register: zabbix_openshift_agent_scc
+  changed_when: "'created' in zabbix_openshift_agent_scc.stdout"
+  when: zabbix_openshift_agent_daemonset.resources | length > 0

roles/zabbix/zabbix_openshift_proxy/tasks/main.yaml

@@ -5,4 +5,6 @@
     state: directory
 
 - include_tasks: create-zabbix-proxy-namespace.yaml
+- include_tasks: create-zabbix-proxy-pvc.yaml
 - include_tasks: call-helm.yaml
+- include_tasks: grant-zabbix-agent-scc.yaml

roles/zabbix/zabbix_openshift_proxy/templates/zabbix-proxy-namespace.yaml.j2

@@ -2,4 +2,9 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: "zabbix"
+  name: "{{ zabbix_openshift_proxy_namespace }}"
+  labels:
+    security.openshift.io/scc.podSecurityLabelSync: "false"
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: baseline

roles/zabbix/zabbix_openshift_proxy/templates/zabbix-proxy-pvc.yaml.j2

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: "{{ zabbix_openshift_proxy_pvc_name }}"
+  namespace: "{{ zabbix_openshift_proxy_namespace }}"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "{{ zabbix_openshift_proxy_pvc_size }}"
+  storageClassName: "{{ zabbix_openshift_proxy_pvc_storage_class }}"

roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2

@@ -181,7 +181,7 @@ zabbixProxy:
     ## Zabbix proxy data Persistent Volume existing claim name
     ## Requires zabbixProxy.persistentVolume.enabled: true
     ## If defined, PVC must be created manually before volume will be bound
-    existingClaim: "zabbix-zabbix-helm-chart-proxy"
+    existingClaim: "{{ zabbix_openshift_proxy_pvc_name }}"
 
     ## Zabbix proxy data Persistent Volume mount root path
     ##
@@ -189,7 +189,7 @@ zabbixProxy:
 
     ## Zabbix proxy data Persistent Volume size
     ##
-    size: 2Gi
+    size: {{ zabbix_openshift_proxy_pvc_size }}
 
     ## Zabbix proxy data Persistent Volume Storage Class
     ## If defined, storageClassName: <storageClass>
@@ -198,7 +198,7 @@ zabbixProxy:
     ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
     ##   GKE, AWS & OpenStack)
     ##
-    storageClass: "ocs-storagecluster-ceph-rbd"
+    storageClass: "{{ zabbix_openshift_proxy_pvc_storage_class }}"
 
     ## Zabbix proxy data Persistent Volume Binding Mode
     ## If defined, volumeBindingMode: <volumeBindingMode>