zabbix-proxy: tls config for openshift based zabbix-agents

Signed-off-by: David Kirwan <davidkirwanirl@gmail.com>

roles/zabbix/zabbix_openshift_proxy/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+# Used by templates/zabbix-values.yaml.j2 for zabbixProxy TLS-PSK (incoming client connections).
+# Inventory sets zabbix_tls_psk_identity and zabbix_tls_psk (private) in group_vars; staging
+# layers map zabbix_tls_psk -> zabbix_tls_stg_psk. This fallback keeps the template valid when
+# only zabbix_tls_stg_psk is provided (e.g. narrow play / extra-vars).
+zabbix_tls_psk_identity: "Fedora"
+zabbix_tls_stg_psk: ""

roles/zabbix/zabbix_openshift_proxy/templates/zabbix-namespace.yaml.j2

@@ -2,4 +2,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: "dist-git"
+  name: "zabbix"

roles/zabbix/zabbix_openshift_proxy/templates/zabbix-values.yaml.j2

@@ -71,13 +71,19 @@ zabbixProxy:
     ## Note that since version 6.0 the variable ZBX_SERVER_PORT is not supported anymore. Instead, add a colon (:) followed by the port number to the end of ZBX_SERVER_HOST value.
     - name: ZBX_SERVER_HOST
       value: "zabbix01.stg.rdu3.fedoraproject.org:10051"
-    ## Security settings
+    ## TLS-PSK for connections *to this proxy from Zabbix clients* (incoming listener).
+    ## Identity: zabbix_tls_psk_identity (see inventory group_vars/all). PSK value: prefer
+    ## zabbix_tls_psk (set per-environment, e.g. staging -> zabbix_tls_stg_psk), else zabbix_tls_stg_psk,
+    ## matching zabbix_agent role private vars.
+    ## ZBX_TLSPSK requires zabbix-docker images that support passing the raw key via env (7.x proxy-sqlite3).
     #- name: ZBX_TLSCONNECT
     #  value: "psk"
     - name: ZBX_TLSACCEPT
       value: "unencrypted,psk"
     - name: ZBX_TLSPSKIDENTITY
-      value: "Fedora"
+      value: "{{ zabbix_tls_psk_identity }}"
+    - name: ZBX_TLSPSK
+      value: "{{ (env == 'production') | ternary(zabbix_tls_psk,, zabbix_tls_stg_psk,) }}"
     ## The variable is used to specify debug level. By default, value is 3
     - name: ZBX_DEBUGLEVEL
       value: 3