Zabbix Proxy on Kubernetes

[kcurtisfl]

Has anyone installed a zabbix proxy in AWS EKS (kubernetes)? The zabbix proxy docker image along with a mysql instance will work, but the issue is how do you send many zabbix agents to a proxy target, when that proxy target is a pod? Agents on hosts outside of kube need a single target and it doesn't lend itself well to the elb/ingress approach.
Any thoughts would be appreciated.

[gofree]

you need to create service for the zabbix proxy

https://kubernetes.io/docs/concepts/services-networking/service/

[kcurtisfl]

I have a working zabbix proxy pod and mysql pod working together. My concern is, routing external traffic (several thousand hosts with agents outside of kube) to a single pod. Yes we can create 'another' zabbix proxy and another mysql pod, then we would have some semblance of redundancy, but the challenge is routing 'to' it from monitored devices. Since each agent has a unique relationship/assignment 'to' a specific zabbix proxy, this could be problematic. So far HAProxy looks promising in this area, but each host agent may need to point to the elb name, with a unique port for each proxy, then maybe haproxy can route to that unique pod. Additionally this must be secure, so tls negotiation has to work as well.

[gofree]

I think what you need is some kind of entry point ( LB ) > Ingress that will route traffic to your Service ( zabbix proxy ) which will route traffic and will be tied to zabbix-proxy Pod ( zabbix proxy pod needs to be deployed via deployment and replica set - so in case it will crash new one will be immediately started - reducing the need of another zabbix proxy in the pair ). Thats the design for zabbix proxy 1 ( for first 100 servers ). For zabbix proxy 2 ( second 100 servers ) new Ingress, new Service, new deployment ( replicaset ). Maybe another recommendation would be to use sqlite database on those proxies ( some pod zabbix proxy + sqlite ) - so no need for mysql separate pods ( which should also deployed via deployment-replica set and have their own service ) - the mysql brings just another level of complexity which is not needed - sqlite can handle a huge number of VPS.

Im not sure how 2 replicas/pods ( see picture bellow ) will behave belonging to one service as the service would choose randomly one of them ...guess this would not be the best approach as usually Zabbix HA scenarios are active-passive and in case od pod crash k8s should start one just like it "nearly immidiatelly" - routing is kept by ingress and service.


https://kubernetes.io/docs/concepts/services-networking/ingress/

[lavanyasreepada]

Hi,


There are several different proxies you may encounter when using Kubernetes:

The kubectl proxy:

• runs on a user's desktop or in a pod
• proxies from a localhost address to the Kubernetes apiserver
• client to proxy uses HTTP
• proxy to apiserver uses HTTPS
• locates apiserver
• adds authentication headers

The apiserver proxy:

• is a bastion built into the apiserver
• connects a user outside of the cluster to cluster IPs which otherwise might not be reachable
• runs in the apiserver processes
• client to proxy uses HTTPS (or http if apiserver so configured)
• proxy to target may use HTTP or HTTPS as chosen by proxy using available information
• can be used to reach a Node, Pod, or Service
• does load balancing when used to reach a Service

The kube proxy:

• runs on each node
• proxies UDP, TCP and SCTP
• does not understand HTTP
• provides load balancing
• is just used to reach services

A Proxy/Load-balancer in front of apiserver(s):

• existence and implementation varies from cluster to cluster (e.g. nginx)
• sits between all clients and one or more apiservers
• acts as load balancer if there are several apiservers.

Cloud Load Balancers on external services:

• are provided by some cloud providers (e.g. AWS ELB, Google Cloud Load Balancer)
• are created automatically when the Kubernetes service has type LoadBalancer
• usually supports UDP/TCP only
• SCTP support is up to the load balancer implementation of the cloud provider

implementation varies by cloud provider.
Kubernetes users will typically not need to worry about anything other than the first two types. The cluster admin will typically ensure that the latter types are setup correctly.

If you want to achieve an in-depth understanding of the Kubernetes.then enroll in Mindmajix’s Kubernetes online training.

Thanks and Regards,
Lavanya Sreepada.

[vikas.rk123]

Can i know how can avoid the same zabbix proxy or zabbix agent host names can set to be different when you increase the replicas for the deployments

[gofree]

I was succesfull using services with rs=1 - but I'm not sure id using replica sets with proxies and agents are at any benefit ( I mean rs > 1, not sure if proxy , server are designed at the moment to run this way - at the end there is one db per server, proxy - with 2 or more RS service will be balancing the traffic to 2 pods and they will write to one db ( or 2 dbs which can bring inconsistance I think) maybe im mistaken - were you succesfull to run multiple pods per zabbix proxy service ?

[vikas.rk123]

i am able to run multiple pods for zabbix proxy service

[gofree]

from curiosity whats the setup your using - specifically DB backend for proxy ? every pod has its own db ( sqlite ) or you have mysql backend ( if so in what setup - 1db for multiple pods ) ?

I also had multiple pods running - but I'm not sure if they cooperate well enough as in standard installation only one zabbix_process process is reading/writing its db - thats why nativelly you dont have active/active HA - ive seen only active/passive pacemaker configurations. With multiple pods for zabbix proxy service I'm not sure how they will play ( both db backend scenarios ) - I thin if you make a k8s service by default its forwards trafic to its pods randomly - in this case there is this thing how single pods ( unique zabbix proxy processes ) will write to db ( either their own or some central backend ) and if such case you will not miss some information - that was the thinkink that made me use rs=1 at the moment and in case the pod crashes its automatically restarted anyway

for now I didnt have time to look into it deeper - maybe multiple pods work, maybe it doesnt - real HA is planned for version 6

https://www.zabbix.com/roadmap

[vikas.rk123]

i have using zabbix-proxy and its db in a single pod and rs >1 can possible in zabbix orchestration?

[gofree]

thats the question really maybe somebody can bring more light in to it - from my knowledge of zabbix and k8s it makes no sense to use it this way eg. you cant be sure what can happen at some point - eg. at the moment zabbix is not entirelly ready to be run as k8s native app with all the benefits ( like horizontal scaling by adding more pod )