jcline/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

zabbix: debugging agent/proxy config

Browse source 
Signed-off-by: David Kirwan <davidkirwanirl@gmail.com>
This commit is contained in:
David Kirwan 2026-05-11 17:29:54 +01:00
commit 7dad780f04
Signed by untrusted user: dkirwan
GPG key ID: A5893AB6474AC37D
2 changed files with 11 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

8
roles/zabbix/zabbix_openshift_proxy/defaults/main.yml
View file

@ -8,7 +8,7 @@ zabbix_tls_stg_psk: ""
# Zabbix server DNS (no port) — reused for proxy Server=...:port and DaemonSet passive allowlist seed.
zabbix_openshift_agent_server_hostname: zabbix01.stg.rdu3.fedoraproject.org
# DaemonSet Agent 2 passive allowlist: comma-separated IPs/hostnames/CIDR that may poll :10050.
# Default is only the server; add proxy egress when passive checks flow through proxy (reject log shows IP).
# Example: "{{ zabbix_openshift_agent_server_hostname }},10.16.166.119"
zabbix_openshift_agent_passiveservers: "{{ zabbix_openshift_agent_server_hostname }}"
# Extra DaemonSet passive allowlist only (comma-separated IPs/hostnames/CIDR). Do NOT repeat
# zabbix_openshift_agent_server_hostname — it is already in ZBX_SERVER_HOST; duplication breaks startup.
# Add proxy/pod egress IPs seen in "connection from ... rejected" logs, e.g. "10.16.166.119".
zabbix_openshift_agent_passiveservers_extra: ""

13
roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2
View file

@ -279,16 +279,17 @@ zabbixAgent:
## https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry
pullSecrets: []
env:
## Passive checks are initiated by Zabbix server/proxy connecting IN to agent :10050.
## ZBX_PASSIVESERVERS is the comma-separated allowlist (hostnames, IPs, CIDR). It must include
## every observed source IP of pollers — if logs show rejection from an IP such as the OpenShift
## proxy Pod/Service egress, append it (inventory: zabbix_openshift_agent_passiveservers).
## Passive checks: pollers reach agent :10050. ZBX_SERVER_HOST becomes Server= (must list each address once).
## zabbix-docker also merges ZBX_PASSIVESERVERS into Server; set passiveservers_extra to *additional*
## sources only (e.g. OpenShift proxy egress IP), never repeat zabbix_openshift_agent_server_hostname.
{% if zabbix_openshift_agent_passiveservers_extra | default('') | trim | length > 0 %}
- name: ZBX_PASSIVESERVERS
value: "{{ zabbix_openshift_agent_passiveservers_extra | trim }}"
{% endif %}
- name: ZBX_SERVER_HOST
value: "{{ zabbix_openshift_agent_server_hostname }}"
- name: ZBX_SERVER_PORT
value: "10051"
- name: ZBX_PASSIVESERVERS
value: "{{ zabbix_openshift_agent_passiveservers }}"
## This variable is boolean (true or false) and enables or disables feature of passive checks. By default, value is true
- name: ZBX_PASSIVE_ALLOW
value: true