How configure Helm Deployment Agent on Kubernetes Cluster with PSK Encryption

[raph_07]

Hello everyone,

I recently installed a Zabbix server and connected my different Kubernetes clusters with an agent deployed by Helm. Everything works fine but I can't configure the PSK part.

I find a piece of code but I don't know how use it :

extraEnv:
- name: "ZBX_TLSCONNECT"
value: "psk"
- name: "ZBX_TLSACCEPT"
value: "psk"
- name: "ZBX_TLSPSKIDENTITY"
value: "psk"
- name: "ZBX_TLSPSKFILE"
value: "/var/lib/zabbix/enc/key.psk"

Could you help me please ?

[semen.a]

You have to do it by yourself.
All variables except ZBX_TLSPSKFILE can be passed to the container with environment variables but the key file has to be mounted from configmap, which has to be created manually.

Here is an example of how I did it:

{{- if and .Values.zabbixAgent.tlsPskConnection.enable .Values.zabbixAgent.tlsPskConnection.tlspskkey }}
kind: ConfigMap
apiVersion: v1
metadata:
name: zabbix-agent-psk-key
namespace: {{ .Release.Namespace }}
labels:
{{ include "zabbix.labels" . | indent 4 }}
data:
zabbix-agent-psk-key: {{ .Values.zabbixAgent.tlsPskConnection.tlspskkey }}
{{- end }}

I have changed the chart to have one agent working for the whole cluster, so I mount the key file in the POD with the Agent, but you can do the same with Proxy.

[nioh]

You have to do it by yourself.
All variables except ZBX_TLSPSKFILE can be passed to the container with environment variables but the key file has to be mounted from configmap, which has to be created manually.

Here is an example of how I did it:

{{- if and .Values.zabbixAgent.tlsPskConnection.enable .Values.zabbixAgent.tlsPskConnection.tlspskkey }}
kind: ConfigMap
apiVersion: v1
metadata:
name: zabbix-agent-psk-key
namespace: {{ .Release.Namespace }}
labels:
{{ include "zabbix.labels" . | indent 4 }}
data:
zabbix-agent-psk-key: {{ .Values.zabbixAgent.tlsPskConnection.tlspskkey }}
{{- end }}

I have changed the chart to have one agent working for the whole cluster, so I mount the key file in the POD with the Agent, but you can do the same with Proxy.

Hi! Im trying to do this for the proxy. Could you send how your zabbix_values.yaml defines .Values.zabbixAgent.tlsPskConnection.tlspskkey? Thanks

[semen.a]

Hi! Im trying to do this for the proxy. Could you send how your zabbix_values.yaml defines .Values.zabbixAgent.tlsPskConnection.tlspskkey? Thanks

For me, everything ended up simple - I wrote my own helm-chart for zabbix-agent. And completely abandoned the chart and templates developed by Zabbix team for k8s. It didn't work for me as it should do.
It might make sense to do the same with proxy as well.

[nioh]

I also got this to work for the proxy where the tls psk is saved as a k8s secret. I will add my solution here later