How to create s secret file for proxy PSK and how to set values.yaml for it

[agnesyangwei]

How to create s secret file for proxy PSK and how to set values.yaml for it?

[aeciopires]

Hello @agnesyangwei!

It's a good question. I never made it before, but I will share some tips for your test.

Tutorial to create a PSK file:

• https://www.zabbix.com/documentation/current/en/manual/encryption/using_pre_shared_keys
• https://sbcode.net/zabbix/agent-psk-proxy/

Assuming you created a PSK file manually on your work computer outside of the Kubernetes cluster, example: $HOME/zabbix_proxy.psk.

You need create a secret manually in Kubernetes cluster. Doc:

• https://kubernetes.io/docs/reference/kubectl/generated/kubectl_create/kubectl_create_secret_generic/

Example:

kubectl create secret generic zabbix-proxy-psk-secret --from-file=$HOME/zabbix_proxy.psk -n monitoring

A list of additional environment variables. List can be extended with other environment variables listed here:

• https://github.com/zabbix/zabbix-docker/tree/7.2/Dockerfiles/proxy-sqlite3/alpine#environment-variables.
• https://github.com/zabbix/zabbix-docker/blob/7.2/config_templates/proxy/zabbix_proxy_tls.conf

Now you can use the follow values in values.yaml file. I am focus only on zabbixProxy config component.

# other values was hidden

zabbixProxy:
  enabled: true

# other values was hidden

  extraEnv:
    - name: "ZBX_TLSCONNECT"
      value: "psk"
    - name: "ZBX_TLSACCEPT"
      value: "psk"
    - name: "ZBX_TLSPSKIDENTITY"
      value: "CHANGE_HERE"  
    - name: "ZBX_TLSPSKIDENTITY"
      value: "/home/zabbix/secret.psk"
  extraVolumeMounts:
    - mountPath: /home/zabbix
      name: zabbix-proxy-psk-volume
  extraVolumes:
    - name: zabbix-proxy-psk-volume
      secret:
        secretName: zabbix-proxy-psk-secret

After this configure the Zabbix Web according the first tutorials in this answer.

Again, I've never had to do this before. I don't know if it works... but it's worth a try.

If it doesn't work, post the error here and let's wait and see if someone else knows and can help.

[agnesyangwei]

Hello @aeciopires,

Thanks for the complete answer. It works like a charm.
The only note is the mountPath to be /home/zabbix, which results in PSK file to be /home/zabbix/secret.psk, because the secret is created from a file.

[aeciopires]

Thanks the feedback @agnesyangwei
I was lucky:-)

I edited my answer.

Have a nice week.