infra-ansible/roles/zabbix/zabbix_openshift_proxy

Zabbix OpenShift proxy (Helm)

Deploys the in-cluster Zabbix proxy and DaemonSet agent2 via the upstream Zabbix Helm chart.

Playbook: playbooks/openshift-apps/zabbix-proxy.yml

Networking: passive Server= / ZBX_PASSIVESERVERS

When the proxy polls agents (DaemonSet on nodes or external VMs such as Forgejo runner hosts), connections originate from the proxy pod IP on the OpenShift SDN (typically 10.128.0.0/14), not from the proxy Service ClusterIP.

Agents must allow that range in passive check ACLs:

Target	Config
DaemonSet agent (this chart)	ZBX_PASSIVESERVERS via zabbix_openshift_agent_passiveservers_extra (includes zabbix_openshift_pod_network_cidr)
External VM agents	Server= in agent config — see roles/openshift-apps/forgejo (forgejo_runnerhost_zabbix_agent_server)

Symptom if missing: tcpdump shows TCP handshake then agent FIN/RST; Zabbix logs access permissions / empty response.

Variables (defaults/main.yml)

Variable	Purpose
zabbix_openshift_proxy_upstream_server_host	Upstream Zabbix server host:port for active proxy
zabbix_openshift_agent_server_hostname	Proxy Service DNS for DaemonSet agent ZBX_SERVER_HOST
zabbix_openshift_pod_network_cidr	OpenShift pod network (10.128.0.0/14 default)
zabbix_openshift_agent_passiveservers_node_ips	Optional node IPs for hostNetwork agents
zabbix_openshift_agent_passiveservers_extra	Comma-separated list merged into ZBX_PASSIVESERVERS

Do not duplicate zabbix_openshift_agent_server_hostname in ZBX_PASSIVESERVERS — the chart merges both and duplicates break agent startup.