jcline/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

zabbix: configure openshift based agents config

Browse source 
Signed-off-by: David Kirwan <davidkirwanirl@gmail.com>
This commit is contained in:
David Kirwan 2026-05-11 17:10:12 +01:00
commit 035be95c3f
Signed by untrusted user: dkirwan
GPG key ID: A5893AB6474AC37D
2 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
roles/zabbix/zabbix_openshift_proxy/defaults/main.yml
View file

@ -5,3 +5,10 @@
# only zabbix_tls_stg_psk is provided (e.g. narrow play / extra-vars).
zabbix_tls_psk_identity: "Fedora"
zabbix_tls_stg_psk: ""
# Zabbix server DNS (no port) — reused for proxy Server=...:port and DaemonSet passive allowlist seed.
zabbix_openshift_agent_server_hostname: zabbix01.stg.rdu3.fedoraproject.org
# DaemonSet Agent 2 passive allowlist: comma-separated IPs/hostnames/CIDR that may poll :10050.
# Default is only the server; add proxy egress when passive checks flow through proxy (reject log shows IP).
# Example: "{{ zabbix_openshift_agent_server_hostname }},10.16.166.119"
zabbix_openshift_agent_passiveservers: "{{ zabbix_openshift_agent_server_hostname }}"

16
roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2
View file

@ -70,7 +70,7 @@ zabbixProxy:
## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value.
- name: ZBX_SERVER_HOST
value: "zabbix01.stg.rdu3.fedoraproject.org:10051"
value: "{{ zabbix_openshift_agent_server_hostname }}:10051"
## TLS split: proxy -> Zabbix server = plaintext; clients/agents -> proxy = TLS-PSK only.
## (TLSConnect outbound vs TLSAccept inbound — see Zabbix proxy TLS docs.)
## zabbix-docker builds TLSPSKFile from ZBX_TLSPSK for incoming PSK; TLSConnect must still be set
@ -279,13 +279,17 @@ zabbixAgent:
## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry
pullSecrets: []
env:
## Zabbix server host
## Passive checks are initiated by Zabbix server/proxy connecting IN to agent :10050.
## ZBX_PASSIVESERVERS is the comma-separated allowlist (hostnames, IPs, CIDR). It must include
## every observed source IP of pollers — if logs show rejection from an IP such as the OpenShift
## proxy Pod/Service egress, append it (inventory: zabbix_openshift_agent_passiveservers).
- name: ZBX_SERVER_HOST
value: zabbix01.stg.rdu3.fedoraproject.org
## Zabbix server port
value: "{{ zabbix_openshift_agent_server_hostname }}"
- name: ZBX_SERVER_PORT
value: 10051
## This variable is boolean (true or false) and enables or disables feature of passive checks. By default, value is true
value: "10051"
- name: ZBX_PASSIVESERVERS
value: "{{ zabbix_openshift_agent_passiveservers }}"
## This variable is boolean (true or false) and enables or disables feature of passive checks. By default, value is true
- name: ZBX_PASSIVE_ALLOW
value: true
## This variable is boolean (true or false) and enables or disables feature of active checks