jcline/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

zabbix: configure agents to use internal dns for proxy

Browse source 
Signed-off-by: David Kirwan <davidkirwanirl@gmail.com>
This commit is contained in:
David Kirwan 2026-05-11 17:51:41 +01:00
commit 269c4fd64d
Signed by untrusted user: dkirwan
GPG key ID: A5893AB6474AC37D
2 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
roles/zabbix/zabbix_openshift_proxy/defaults/main.yml
View file

@ -6,8 +6,11 @@
zabbix_tls_psk_identity: "Fedora"
zabbix_tls_stg_psk: ""
# Zabbix server DNS (no port) — reused for proxy Server=...:port and DaemonSet passive allowlist seed.
zabbix_openshift_agent_server_hostname: zabbix01.stg.rdu3.fedoraproject.org
# Upstream Zabbix *server* the proxy connects to (host:port → proxy ZBX_SERVER_HOST).
zabbix_openshift_proxy_upstream_server_host: "zabbix01.stg.rdu3.fedoraproject.org:10051"
# DaemonSet agent passive Server= (kube DNS name of proxy Service, no port). Agent resolves this to
# the ClusterIP proxies use for passive polls. Confirm: oc get svc -n zabbix (often zabbix-zabbix-proxy).
zabbix_openshift_agent_server_hostname: zabbix-zabbix-proxy.zabbix.svc.cluster.local
# Extra DaemonSet passive allowlist only (comma-separated IPs/hostnames/CIDR). Do NOT repeat
# zabbix_openshift_agent_server_hostname — it is already in ZBX_SERVER_HOST; duplication breaks startup.
# Add proxy/pod egress IPs seen in "connection from ... rejected" logs, e.g. "10.16.166.119".

6
roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2
View file

@ -70,7 +70,7 @@ zabbixProxy:
## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value.
- name: ZBX_SERVER_HOST
value: "{{ zabbix_openshift_agent_server_hostname }}:10051"
value: "{{ zabbix_openshift_proxy_upstream_server_host }}"
## TLS split: proxy -> Zabbix server = plaintext; clients/agents -> proxy = TLS-PSK only.
## (TLSConnect outbound vs TLSAccept inbound — see Zabbix proxy TLS docs.)
## zabbix-docker builds TLSPSKFile from ZBX_TLSPSK for incoming PSK; TLSConnect must still be set
@ -280,8 +280,8 @@ zabbixAgent:
pullSecrets: []
env:
## Passive checks: pollers reach agent :10050. ZBX_SERVER_HOST becomes Server= (must list each address once).
## zabbix-docker also merges ZBX_PASSIVESERVERS into Server; set passiveservers_extra to *additional*
## sources only (e.g. OpenShift proxy egress IP), never repeat zabbix_openshift_agent_server_hostname.
## zabbix-docker also merges ZBX_PASSIVESERVERS into Server=; extras must never repeat addresses
## already resolved from ZBX_SERVER_HOST (duplicate hostnames/IP sets break agent startup).
{% if zabbix_openshift_agent_passiveservers_extra | default('') | trim | length > 0 %}
- name: ZBX_PASSIVESERVERS
value: "{{ zabbix_openshift_agent_passiveservers_extra | trim }}"