mirror of
https://github.com/rtomik/helm-charts.git
synced 2026-08-22 14:53:51 +00:00
Compare commits
3 Commits
norish-0.0
...
adguard-ho
| Author | SHA1 | Date | |
|---|---|---|---|
| 7438b18313 | |||
| 5497301740 | |||
| d84a669a62 |
19
charts/adguard-home/Chart.yaml
Normal file
19
charts/adguard-home/Chart.yaml
Normal file
@ -0,0 +1,19 @@
|
||||
apiVersion: v2
|
||||
name: adguard-home
|
||||
description: AdGuard Home helm chart for Kubernetes - Network-wide ad and tracker blocking DNS server
|
||||
type: application
|
||||
version: 0.0.2
|
||||
appVersion: "v0.107.79"
|
||||
maintainers:
|
||||
- name: Richard Tomik
|
||||
email: no@m.com
|
||||
keywords:
|
||||
- dns
|
||||
- ad-blocking
|
||||
- dns-filtering
|
||||
- adguard-home
|
||||
- privacy
|
||||
- network-security
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
sources:
|
||||
- https://github.com/AdguardTeam/AdGuardHome
|
||||
55
charts/adguard-home/NOTES.txt
Normal file
55
charts/adguard-home/NOTES.txt
Normal file
@ -0,0 +1,55 @@
|
||||
1. Get the admin dashboard URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[?(@.name=='web')].nodePort}" services {{ include "adguard-home.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "adguard-home.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "adguard-home.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.ports.web.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "adguard-home.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
echo "Visit http://127.0.0.1:8080 to use the AdGuard Home setup wizard / dashboard"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:{{ .Values.ports.web.port }}
|
||||
{{- end }}
|
||||
|
||||
2. On first access, complete the AdGuard Home setup wizard (admin user, DNS listener
|
||||
interfaces/ports). The resulting AdGuardHome.yaml is written to the conf volume.
|
||||
|
||||
3. DNS listens on port {{ .Values.ports.dns.port }} (TCP/UDP).
|
||||
{{- if not .Values.hostNetwork }}
|
||||
NOTE: hostNetwork is disabled, so clients will see the Service/pod IP, not their
|
||||
real IP, in the AdGuard Home query log/filters. Set hostNetwork: true, or use a
|
||||
LoadBalancer Service with externalTrafficPolicy: Local, to preserve client IPs.
|
||||
{{- end }}
|
||||
{{- if .Values.ports.dhcp.enabled }}
|
||||
4. DHCP server is enabled on UDP 67/68.
|
||||
{{- if not .Values.hostNetwork }}
|
||||
WARNING: DHCP requires hostNetwork: true to function correctly - it will not
|
||||
work through a ClusterIP/LoadBalancer Service.
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.persistence.work.enabled .Values.persistence.conf.enabled }}
|
||||
|
||||
5. Data is persisted using PVCs:
|
||||
{{- if .Values.persistence.work.enabled }}
|
||||
- {{ .Values.persistence.work.existingClaim | default (printf "%s-work" (include "adguard-home.fullname" .)) }} (query log, filter cache, stats)
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.conf.enabled }}
|
||||
- {{ .Values.persistence.conf.existingClaim | default (printf "%s-conf" (include "adguard-home.fullname" .)) }} (AdGuardHome.yaml)
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
|
||||
5. WARNING: No persistence enabled. Configuration and filter data will be lost when
|
||||
the pod restarts.
|
||||
{{- end }}
|
||||
|
||||
For more information about using this Helm chart, please refer to the readme.md file.
|
||||
235
charts/adguard-home/readme.md
Normal file
235
charts/adguard-home/readme.md
Normal file
@ -0,0 +1,235 @@
|
||||
# AdGuard Home Helm Chart
|
||||
|
||||
A Helm chart for deploying [AdGuard Home](https://github.com/AdguardTeam/AdGuardHome), a network-wide DNS ad and tracker blocker, on Kubernetes.
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart deploys AdGuard Home on a Kubernetes cluster using the Helm package manager. AdGuard Home is a self-hosted DNS server that blocks ads and trackers for every device on your network, and can also act as a DHCP server, DNS-over-TLS/HTTPS/QUIC resolver, and DNSCrypt server.
|
||||
|
||||
Source code: https://github.com/rtomik/helm-charts/tree/main/charts/adguard-home
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.0+
|
||||
- PV provisioner support (if persistence is needed)
|
||||
- A way to route real LAN clients to the DNS Service (LoadBalancer/MetalLB, NodePort, or `hostNetwork: true`) if you intend to use it as your network's resolver
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
```bash
|
||||
helm repo add rtomik https://rtomik.github.io/helm-charts
|
||||
helm install adguard-home rtomik/adguard-home
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
```bash
|
||||
helm uninstall adguard-home
|
||||
```
|
||||
|
||||
## Configuration Examples
|
||||
|
||||
### Minimal Installation (admin UI only, no DNS exposed on the LAN)
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
work:
|
||||
enabled: true
|
||||
size: 2Gi
|
||||
conf:
|
||||
enabled: true
|
||||
size: 100Mi
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- host: adguard.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- adguard.example.com
|
||||
secretName: adguard-tls
|
||||
```
|
||||
|
||||
### Expose DNS to the LAN via LoadBalancer (e.g. MetalLB)
|
||||
|
||||
```yaml
|
||||
service:
|
||||
type: LoadBalancer
|
||||
loadBalancerIP: 192.168.1.53
|
||||
annotations:
|
||||
metallb.universe.tf/allow-shared-ip: adguard-home
|
||||
|
||||
hostNetwork: true # preserves real client IPs in the query log/filters
|
||||
```
|
||||
|
||||
### Enable DNS-over-TLS / DNS-over-QUIC and DNS-over-HTTPS
|
||||
|
||||
```yaml
|
||||
ports:
|
||||
dot:
|
||||
enabled: true
|
||||
https:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
### Enable the DHCP server
|
||||
|
||||
DHCP requires `hostNetwork: true` - it cannot be proxied through a ClusterIP/LoadBalancer Service.
|
||||
|
||||
```yaml
|
||||
hostNetwork: true
|
||||
ports:
|
||||
dhcp:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
### Use an existing PVC
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
work:
|
||||
existingClaim: "adguard-work-pvc"
|
||||
conf:
|
||||
existingClaim: "adguard-conf-pvc"
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
### Global Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `nameOverride` | Override the release name | `""` |
|
||||
| `fullnameOverride` | Fully override the release name | `""` |
|
||||
|
||||
### Image Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `image.repository` | AdGuard Home image repository | `adguard/adguardhome` |
|
||||
| `image.tag` | Image tag | `v0.107.79` |
|
||||
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `imagePullSecrets` | Image pull secrets | `[]` |
|
||||
|
||||
### Deployment Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `replicaCount` | Number of replicas (keep at 1 - AdGuard Home is not multi-writer safe) | `1` |
|
||||
| `revisionHistoryLimit` | Revisions to retain | `3` |
|
||||
| `podSecurityContext.runAsNonRoot` | Run as non-root | `true` |
|
||||
| `podSecurityContext.runAsUser` | User ID | `1000` |
|
||||
| `podSecurityContext.runAsGroup` | Group ID | `1000` |
|
||||
| `podSecurityContext.fsGroup` | Filesystem group ID | `1000` |
|
||||
| `containerSecurityContext.capabilities.add` | Capabilities added (NET_BIND_SERVICE for ports < 1024) | `["NET_BIND_SERVICE"]` |
|
||||
| `hostNetwork` | Use host networking (required for DHCP, recommended for accurate client IPs) | `false` |
|
||||
| `nodeSelector` | Node selector | `{}` |
|
||||
| `tolerations` | Tolerations | `[]` |
|
||||
| `affinity` | Affinity rules | `{}` |
|
||||
|
||||
### Ports Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `ports.web.port` | Admin dashboard / setup wizard | `3000` |
|
||||
| `ports.dns.port` | Plain DNS (TCP+UDP) | `53` |
|
||||
| `ports.dot.enabled` | Enable DNS-over-TLS / DNS-over-QUIC | `false` |
|
||||
| `ports.dot.port` | DoT/DoQ port (TCP+UDP) | `853` |
|
||||
| `ports.https.enabled` | Enable DNS-over-HTTPS / HTTPS admin dashboard | `false` |
|
||||
| `ports.https.port` | HTTPS port (TCP+UDP) | `443` |
|
||||
| `ports.dnscrypt.enabled` | Enable DNSCrypt | `false` |
|
||||
| `ports.dnscrypt.port` | DNSCrypt port (TCP+UDP) | `5443` |
|
||||
| `ports.dhcp.enabled` | Enable DHCP server (67/68 UDP, requires `hostNetwork: true`) | `false` |
|
||||
| `ports.pprof.enabled` | Enable the debug pprof API | `false` |
|
||||
| `ports.pprof.port` | pprof port | `6060` |
|
||||
|
||||
### Service Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `service.type` | Service type | `ClusterIP` |
|
||||
| `service.annotations` | Service annotations | `{}` |
|
||||
| `service.loadBalancerIP` | Static LoadBalancer IP (e.g. for MetalLB) | `""` |
|
||||
|
||||
### Ingress Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `ingress.enabled` | Enable ingress (routes to the admin dashboard only) | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.annotations` | Ingress annotations | See values.yaml |
|
||||
| `ingress.hosts` | Ingress hosts | See values.yaml |
|
||||
| `ingress.tls` | TLS configuration | See values.yaml |
|
||||
|
||||
### Persistence Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `persistence.work.enabled` | Persist `/opt/adguardhome/work` (query log, filter cache, stats) | `true` |
|
||||
| `persistence.work.existingClaim` | Use an existing PVC instead of creating one | `""` |
|
||||
| `persistence.work.storageClass` | Storage class | `""` |
|
||||
| `persistence.work.accessMode` | Access mode | `ReadWriteOnce` |
|
||||
| `persistence.work.size` | PVC size | `1Gi` |
|
||||
| `persistence.conf.enabled` | Persist `/opt/adguardhome/conf` (AdGuardHome.yaml) | `true` |
|
||||
| `persistence.conf.existingClaim` | Use an existing PVC instead of creating one | `""` |
|
||||
| `persistence.conf.storageClass` | Storage class | `""` |
|
||||
| `persistence.conf.accessMode` | Access mode | `ReadWriteOnce` |
|
||||
| `persistence.conf.size` | PVC size | `100Mi` |
|
||||
|
||||
### Resource Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `resources` | Resource limits and requests | `{}` |
|
||||
|
||||
### Health Check Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `probes.liveness.enabled` | Enable liveness probe (TCP check on the admin web port) | `true` |
|
||||
| `probes.liveness.initialDelaySeconds` | Liveness initial delay | `15` |
|
||||
| `probes.liveness.periodSeconds` | Liveness period | `30` |
|
||||
| `probes.readiness.enabled` | Enable readiness probe (TCP check on the admin web port) | `true` |
|
||||
| `probes.readiness.initialDelaySeconds` | Readiness initial delay | `5` |
|
||||
| `probes.readiness.periodSeconds` | Readiness period | `10` |
|
||||
|
||||
### Other Parameters
|
||||
|
||||
| Name | Description | Default |
|
||||
|------|-------------|---------|
|
||||
| `extraEnv` | Additional environment variables | `[]` |
|
||||
| `extraVolumeMounts` | Additional volume mounts | `[]` |
|
||||
| `extraVolumes` | Additional volumes | `[]` |
|
||||
|
||||
## Notes
|
||||
|
||||
- AdGuard Home has no supported way to bootstrap its admin account or DNS settings via
|
||||
environment variables - complete the setup wizard once at `http://<web-service>:3000`
|
||||
after the first install. The resulting `AdGuardHome.yaml` is written to the `conf` PVC,
|
||||
so it survives pod restarts/upgrades.
|
||||
- Because AdGuard Home stores state on disk and isn't multi-writer safe, do not scale
|
||||
`replicaCount` beyond `1`.
|
||||
- If you plan to use this as your network's DNS resolver, prefer `hostNetwork: true` (or
|
||||
a LoadBalancer Service with `externalTrafficPolicy: Local`) so AdGuard Home sees real
|
||||
client IPs rather than a single Service/NAT IP for every device.
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
- **Clients all show up as the same IP / filters by client don't work**: enable `hostNetwork` or use `externalTrafficPolicy: Local` on a LoadBalancer Service.
|
||||
- **DHCP doesn't hand out leases**: DHCP only works with `hostNetwork: true`.
|
||||
- **Setup wizard settings don't persist**: verify `persistence.conf.enabled` is `true` and the PVC is bound.
|
||||
|
||||
```bash
|
||||
kubectl logs -f deployment/adguard-home
|
||||
kubectl describe pod -l app.kubernetes.io/name=adguard-home
|
||||
```
|
||||
|
||||
## Links
|
||||
|
||||
- [AdGuard Home GitHub](https://github.com/AdguardTeam/AdGuardHome)
|
||||
- [AdGuard Home Docker documentation](https://adguard-dns.io/kb/adguard-home/docker/)
|
||||
- [Chart Source](https://github.com/rtomik/helm-charts/tree/main/charts/adguard-home)
|
||||
@ -1,14 +1,14 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "checkmk.name" -}}
|
||||
{{- define "adguard-home.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
*/}}
|
||||
{{- define "checkmk.fullname" -}}
|
||||
{{- define "adguard-home.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
@ -20,16 +20,16 @@ Create a default fully qualified app name.
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "checkmk.chart" -}}
|
||||
{{- define "adguard-home.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "checkmk.labels" -}}
|
||||
helm.sh/chart: {{ include "checkmk.chart" . }}
|
||||
{{ include "checkmk.selectorLabels" . }}
|
||||
{{- define "adguard-home.labels" -}}
|
||||
helm.sh/chart: {{ include "adguard-home.chart" . }}
|
||||
{{ include "adguard-home.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
@ -39,28 +39,7 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "checkmk.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "checkmk.name" . }}
|
||||
{{- define "adguard-home.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "adguard-home.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Name of the secret holding CMK_PASSWORD
|
||||
*/}}
|
||||
{{- define "checkmk.secretName" -}}
|
||||
{{- .Values.config.adminPassword.existingSecret | default (printf "%s-secrets" (include "checkmk.fullname" .)) }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Web UI path for health probes: /<siteId>/check_mk/login.py
|
||||
*/}}
|
||||
{{- define "checkmk.probePath" -}}
|
||||
{{- printf "/%s/check_mk/login.py" .Values.config.siteId }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
tmpfs mount path derived from site ID
|
||||
*/}}
|
||||
{{- define "checkmk.tmpPath" -}}
|
||||
{{- printf "/opt/omd/sites/%s/tmp" .Values.config.siteId }}
|
||||
{{- end }}
|
||||
175
charts/adguard-home/templates/deployment.yaml
Normal file
175
charts/adguard-home/templates/deployment.yaml
Normal file
@ -0,0 +1,175 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "adguard-home.fullname" . }}
|
||||
labels:
|
||||
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "adguard-home.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "adguard-home.selectorLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostNetwork }}
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- if .Values.persistence.conf.enabled }}
|
||||
initContainers:
|
||||
- name: init-config
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
# AdGuard Home's first-run setup wizard defaults the admin web interface
|
||||
# port to 80, regardless of ports.web.port below - if a user accepts that
|
||||
# default, the Service/Ingress (which forward to ports.web.port) end up
|
||||
# pointing at the wrong container port and the UI becomes unreachable
|
||||
# (502/Bad Gateway) as soon as setup completes. Seeding http.address here
|
||||
# before the wizard ever runs makes it pre-fill the correct port instead.
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
if [ ! -f /opt/adguardhome/conf/AdGuardHome.yaml ]; then
|
||||
cat > /opt/adguardhome/conf/AdGuardHome.yaml <<'CONF'
|
||||
http:
|
||||
address: 0.0.0.0:{{ .Values.ports.web.port }}
|
||||
CONF
|
||||
fi
|
||||
volumeMounts:
|
||||
- name: conf
|
||||
mountPath: /opt/adguardhome/conf
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: web
|
||||
containerPort: {{ .Values.ports.web.port }}
|
||||
protocol: TCP
|
||||
- name: dns-tcp
|
||||
containerPort: {{ .Values.ports.dns.port }}
|
||||
protocol: TCP
|
||||
- name: dns-udp
|
||||
containerPort: {{ .Values.ports.dns.port }}
|
||||
protocol: UDP
|
||||
{{- if .Values.ports.dot.enabled }}
|
||||
- name: dot-tcp
|
||||
containerPort: {{ .Values.ports.dot.port }}
|
||||
protocol: TCP
|
||||
- name: dot-udp
|
||||
containerPort: {{ .Values.ports.dot.port }}
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
{{- if .Values.ports.https.enabled }}
|
||||
- name: https-tcp
|
||||
containerPort: {{ .Values.ports.https.port }}
|
||||
protocol: TCP
|
||||
- name: https-udp
|
||||
containerPort: {{ .Values.ports.https.port }}
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
{{- if .Values.ports.dnscrypt.enabled }}
|
||||
- name: dnscrypt-tcp
|
||||
containerPort: {{ .Values.ports.dnscrypt.port }}
|
||||
protocol: TCP
|
||||
- name: dnscrypt-udp
|
||||
containerPort: {{ .Values.ports.dnscrypt.port }}
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
{{- if .Values.ports.dhcp.enabled }}
|
||||
- name: dhcp-server
|
||||
containerPort: 67
|
||||
protocol: UDP
|
||||
- name: dhcp-client
|
||||
containerPort: 68
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
{{- if .Values.ports.pprof.enabled }}
|
||||
- name: pprof
|
||||
containerPort: {{ .Values.ports.pprof.port }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if .Values.probes.liveness.enabled }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: web
|
||||
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.liveness.successThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.probes.readiness.enabled }}
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: web
|
||||
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.readiness.successThreshold }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnv }}
|
||||
env:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if .Values.persistence.work.enabled }}
|
||||
- name: work
|
||||
mountPath: /opt/adguardhome/work
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.conf.enabled }}
|
||||
- name: conf
|
||||
mountPath: /opt/adguardhome/conf
|
||||
{{- end }}
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumes:
|
||||
{{- if .Values.persistence.work.enabled }}
|
||||
- name: work
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.work.existingClaim | default (printf "%s-work" (include "adguard-home.fullname" .)) }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.conf.enabled }}
|
||||
- name: conf
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.conf.existingClaim | default (printf "%s-conf" (include "adguard-home.fullname" .)) }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@ -2,9 +2,9 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ include "checkmk.fullname" . }}
|
||||
name: {{ include "adguard-home.fullname" . }}
|
||||
labels:
|
||||
{{- include "checkmk.labels" . | nindent 4 }}
|
||||
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
@ -35,9 +35,9 @@ spec:
|
||||
pathType: {{ .pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "checkmk.fullname" $ }}
|
||||
name: {{ include "adguard-home.fullname" $ }}
|
||||
port:
|
||||
number: {{ $.Values.service.port }}
|
||||
number: {{ $.Values.ports.web.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
43
charts/adguard-home/templates/pvc.yaml
Normal file
43
charts/adguard-home/templates/pvc.yaml
Normal file
@ -0,0 +1,43 @@
|
||||
{{- if and .Values.persistence.work.enabled (not .Values.persistence.work.existingClaim) }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "adguard-home.fullname" . }}-work
|
||||
labels:
|
||||
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||
{{- with .Values.persistence.work.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.work.accessMode | quote }}
|
||||
{{- if .Values.persistence.work.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.work.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.work.size | quote }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if and .Values.persistence.conf.enabled (not .Values.persistence.conf.existingClaim) }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "adguard-home.fullname" . }}-conf
|
||||
labels:
|
||||
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||
{{- with .Values.persistence.conf.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.conf.accessMode | quote }}
|
||||
{{- if .Values.persistence.conf.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.conf.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.conf.size | quote }}
|
||||
{{- end }}
|
||||
76
charts/adguard-home/templates/service.yaml
Normal file
76
charts/adguard-home/templates/service.yaml
Normal file
@ -0,0 +1,76 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "adguard-home.fullname" . }}
|
||||
labels:
|
||||
{{- include "adguard-home.labels" . | nindent 4 }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- if .Values.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: web
|
||||
port: {{ .Values.ports.web.port }}
|
||||
targetPort: web
|
||||
protocol: TCP
|
||||
- name: dns-tcp
|
||||
port: {{ .Values.ports.dns.port }}
|
||||
targetPort: dns-tcp
|
||||
protocol: TCP
|
||||
- name: dns-udp
|
||||
port: {{ .Values.ports.dns.port }}
|
||||
targetPort: dns-udp
|
||||
protocol: UDP
|
||||
{{- if .Values.ports.dot.enabled }}
|
||||
- name: dot-tcp
|
||||
port: {{ .Values.ports.dot.port }}
|
||||
targetPort: dot-tcp
|
||||
protocol: TCP
|
||||
- name: dot-udp
|
||||
port: {{ .Values.ports.dot.port }}
|
||||
targetPort: dot-udp
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
{{- if .Values.ports.https.enabled }}
|
||||
- name: https-tcp
|
||||
port: {{ .Values.ports.https.port }}
|
||||
targetPort: https-tcp
|
||||
protocol: TCP
|
||||
- name: https-udp
|
||||
port: {{ .Values.ports.https.port }}
|
||||
targetPort: https-udp
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
{{- if .Values.ports.dnscrypt.enabled }}
|
||||
- name: dnscrypt-tcp
|
||||
port: {{ .Values.ports.dnscrypt.port }}
|
||||
targetPort: dnscrypt-tcp
|
||||
protocol: TCP
|
||||
- name: dnscrypt-udp
|
||||
port: {{ .Values.ports.dnscrypt.port }}
|
||||
targetPort: dnscrypt-udp
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
{{- if .Values.ports.dhcp.enabled }}
|
||||
- name: dhcp-server
|
||||
port: 67
|
||||
targetPort: dhcp-server
|
||||
protocol: UDP
|
||||
- name: dhcp-client
|
||||
port: 68
|
||||
targetPort: dhcp-client
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
{{- if .Values.ports.pprof.enabled }}
|
||||
- name: pprof
|
||||
port: {{ .Values.ports.pprof.port }}
|
||||
targetPort: pprof
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "adguard-home.selectorLabels" . | nindent 4 }}
|
||||
161
charts/adguard-home/values.yaml
Normal file
161
charts/adguard-home/values.yaml
Normal file
@ -0,0 +1,161 @@
|
||||
## Global settings
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
## Image settings
|
||||
image:
|
||||
repository: adguard/adguardhome
|
||||
tag: "v0.107.79"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets: []
|
||||
|
||||
## Deployment settings
|
||||
## AdGuard Home keeps its state on disk (PVCs below) and is not designed to run as
|
||||
## multiple replicas against the same data - keep replicaCount at 1.
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 3
|
||||
|
||||
## Pod security settings
|
||||
## AdGuard Home's own startup check refuses to run on its first launch unless the
|
||||
## process euid is 0 ("this is the first launch of adguard home; you must run it as
|
||||
## administrator"), so - unlike most charts here - this one runs as root. Capabilities
|
||||
## are still dropped to the minimum the binary needs.
|
||||
podSecurityContext:
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
fsGroup: 0
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
- CHOWN
|
||||
- DAC_OVERRIDE
|
||||
- SETUID
|
||||
- SETGID
|
||||
|
||||
## Pod scheduling
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
podAnnotations: {}
|
||||
|
||||
## Use host networking. Required if you enable the DHCP server, and recommended
|
||||
## when exposing DNS so AdGuard Home sees real client IPs instead of the pod/service IP.
|
||||
hostNetwork: false
|
||||
|
||||
## Ports exposed by AdGuard Home. web+dns are enabled by default; the rest are
|
||||
## optional protocols you can turn on as needed.
|
||||
## https://adguard-dns.io/kb/adguard-home/docker/
|
||||
ports:
|
||||
web:
|
||||
# Admin dashboard / setup wizard
|
||||
port: 3000
|
||||
dns:
|
||||
# Plain DNS (TCP+UDP)
|
||||
port: 53
|
||||
dot:
|
||||
# DNS-over-TLS / DNS-over-QUIC (TCP+UDP)
|
||||
enabled: false
|
||||
port: 853
|
||||
https:
|
||||
# DNS-over-HTTPS and HTTPS admin dashboard (TCP+UDP)
|
||||
enabled: false
|
||||
port: 443
|
||||
dnscrypt:
|
||||
# DNSCrypt (TCP+UDP)
|
||||
enabled: false
|
||||
port: 5443
|
||||
dhcp:
|
||||
# DHCP server (UDP 67/68). Requires hostNetwork: true.
|
||||
enabled: false
|
||||
pprof:
|
||||
# Debug pprof API - leave disabled unless troubleshooting
|
||||
enabled: false
|
||||
port: 6060
|
||||
|
||||
## Service settings
|
||||
## For exposing DNS to your LAN, set type to LoadBalancer (e.g. with MetalLB) and
|
||||
## add annotations/loadBalancerIP as needed, or use type: NodePort.
|
||||
service:
|
||||
type: ClusterIP
|
||||
annotations: {}
|
||||
# loadBalancerIP: 192.168.1.53
|
||||
|
||||
## Ingress settings (routes to the admin web UI only)
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
hosts:
|
||||
- host: adguard.domain.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- adguard.domain.com
|
||||
|
||||
## Persistence settings
|
||||
persistence:
|
||||
work:
|
||||
# /opt/adguardhome/work - query log, filter cache, stats
|
||||
enabled: true
|
||||
existingClaim: ""
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 1Gi
|
||||
annotations: {}
|
||||
conf:
|
||||
# /opt/adguardhome/conf - AdGuardHome.yaml configuration
|
||||
enabled: true
|
||||
existingClaim: ""
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 100Mi
|
||||
annotations: {}
|
||||
|
||||
## Resource limits and requests
|
||||
resources: {}
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 500m
|
||||
# memory: 256Mi
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 64Mi
|
||||
|
||||
## Application health checks
|
||||
## Uses a TCP check against the admin web port. The DNS listener only comes up after
|
||||
## the first-run setup wizard is completed, so probing the DNS port instead would
|
||||
## fail/restart the pod before it's ever configured; the web port is always up.
|
||||
probes:
|
||||
liveness:
|
||||
enabled: true
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
readiness:
|
||||
enabled: true
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
|
||||
## Extra environment variables
|
||||
extraEnv: []
|
||||
|
||||
## Extra volume mounts
|
||||
extraVolumeMounts: []
|
||||
|
||||
## Extra volumes
|
||||
extraVolumes: []
|
||||
@ -1,18 +0,0 @@
|
||||
apiVersion: v2
|
||||
name: checkmk
|
||||
description: Checkmk monitoring platform helm chart for Kubernetes
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "2.5.0p6"
|
||||
maintainers:
|
||||
- name: Richard Tomik
|
||||
email: richard.tomik@proton.me
|
||||
keywords:
|
||||
- monitoring
|
||||
- checkmk
|
||||
- infrastructure
|
||||
- observability
|
||||
home: https://github.com/rtomik/helm-charts
|
||||
sources:
|
||||
- https://checkmk.com
|
||||
- https://hub.docker.com/r/checkmk/check-mk-community
|
||||
@ -1,56 +0,0 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "checkmk.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "checkmk.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "checkmk.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "checkmk.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
echo "Visit http://127.0.0.1:5000/{{ .Values.config.siteId }}/check_mk/ to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 5000:5000
|
||||
{{- end }}
|
||||
|
||||
2. Checkmk web interface is available at:
|
||||
http://<host>/{{ .Values.config.siteId }}/check_mk/
|
||||
|
||||
3. Default credentials:
|
||||
Username: cmkadmin
|
||||
Password: (as configured in config.adminPassword)
|
||||
|
||||
4. Ports:
|
||||
- Web interface: {{ .Values.service.port }} → container 5000
|
||||
- Agent Receiver: {{ .Values.service.agentReceiverPort }} → container 8000
|
||||
|
||||
{{- if .Values.persistence.enabled }}
|
||||
5. Persistent storage: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "checkmk.fullname" . }}-sites{{ end }} ({{ .Values.persistence.size }})
|
||||
Mounted at /omd/sites — contains all site data, configs, and RRD files.
|
||||
{{- else }}
|
||||
5. WARNING: No persistent storage enabled. All monitoring data will be lost on pod restart.
|
||||
Enable persistence in values.yaml for production use.
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.config.livestatusTcp }}
|
||||
6. Livestatus TCP is enabled. Ensure appropriate NetworkPolicies are in place.
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.config.adminPassword.existingSecret }}
|
||||
7. SECURITY NOTE: For production use, store the admin password in a Kubernetes Secret:
|
||||
kubectl create secret generic checkmk-secrets \
|
||||
--from-literal=cmk-password=<your-password>
|
||||
Then set config.adminPassword.existingSecret=checkmk-secrets in your values.
|
||||
{{- else }}
|
||||
7. Admin password read from existing secret: {{ .Values.config.adminPassword.existingSecret }}
|
||||
{{- end }}
|
||||
|
||||
For more information, see the official Checkmk Docker documentation:
|
||||
https://docs.checkmk.com/latest/en/introduction_docker.html
|
||||
@ -1,91 +0,0 @@
|
||||
# Checkmk Helm Chart
|
||||
|
||||
Helm chart for deploying [Checkmk](https://checkmk.com/) — an infrastructure and application monitoring platform — on Kubernetes.
|
||||
|
||||
## Overview
|
||||
|
||||
Checkmk uses OMD (Open Monitoring Distribution) to manage monitoring sites. This chart deploys the Community Edition using the official Docker image with:
|
||||
|
||||
- Persistent storage for all site data (`/omd/sites`)
|
||||
- RAM-backed tmpfs for the site temp directory (performance optimization from the official docs)
|
||||
- Separate service ports for the web interface (5000) and agent receiver (8000)
|
||||
- Admin password stored in a Kubernetes Secret
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.19+
|
||||
- Helm 3.0+
|
||||
- A default StorageClass or an existing PersistentVolumeClaim
|
||||
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
helm install checkmk ./charts/checkmk \
|
||||
--set config.adminPassword.value=mysecretpassword \
|
||||
--set ingress.enabled=true \
|
||||
--set ingress.hosts[0].host=checkmk.example.com \
|
||||
--set ingress.hosts[0].paths[0].path=/ \
|
||||
--set ingress.hosts[0].paths[0].pathType=Prefix
|
||||
```
|
||||
|
||||
After installation, access the UI at `http://<host>/cmk/check_mk/` with username `cmkadmin`.
|
||||
|
||||
## Configuration
|
||||
|
||||
### Admin Password (recommended: use existing secret)
|
||||
|
||||
```bash
|
||||
kubectl create secret generic checkmk-secrets \
|
||||
--from-literal=cmk-password=<your-password>
|
||||
```
|
||||
|
||||
```yaml
|
||||
config:
|
||||
adminPassword:
|
||||
existingSecret: "checkmk-secrets"
|
||||
passwordKey: "cmk-password"
|
||||
```
|
||||
|
||||
### Site ID
|
||||
|
||||
The `config.siteId` value sets the Checkmk site name and determines the URL path (`/<siteId>/check_mk/`). Defaults to `cmk`.
|
||||
|
||||
### Livestatus TCP
|
||||
|
||||
Enable Livestatus TCP for distributed monitoring setups or external integrations:
|
||||
|
||||
```yaml
|
||||
config:
|
||||
livestatusTcp: true
|
||||
```
|
||||
|
||||
### Persistence
|
||||
|
||||
Site data (hosts, checks, RRD files) is stored in `/omd/sites`. A 5 Gi PVC is created by default. Adjust size or use an existing claim:
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
size: 20Gi
|
||||
storageClass: "fast-ssd"
|
||||
```
|
||||
|
||||
## Key Values
|
||||
|
||||
| Key | Default | Description |
|
||||
|-----|---------|-------------|
|
||||
| `image.tag` | `2.5.0p6` | Checkmk Community image tag |
|
||||
| `config.siteId` | `cmk` | Monitoring site name |
|
||||
| `config.timezone` | `UTC` | Container timezone |
|
||||
| `config.adminPassword.value` | `changeme` | cmkadmin password (use existingSecret in production) |
|
||||
| `config.livestatusTcp` | `false` | Enable Livestatus over TCP |
|
||||
| `config.mailRelayHost` | `""` | SMTP relay for notifications |
|
||||
| `service.port` | `5000` | Web interface port |
|
||||
| `service.agentReceiverPort` | `8000` | Agent registration port |
|
||||
| `persistence.enabled` | `true` | Enable persistent storage |
|
||||
| `persistence.size` | `5Gi` | PVC size |
|
||||
|
||||
## Security Notes
|
||||
|
||||
Checkmk (OMD) requires root access inside the container to manage monitoring sites and switch to the site user account. The `podSecurityContext.runAsUser` is set to `0` and `containerSecurityContext.allowPrivilegeEscalation` is `true` by default.
|
||||
|
||||
Place a reverse proxy (e.g. Traefik or nginx) in front for TLS termination rather than exposing the container port directly.
|
||||
@ -1,135 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "checkmk.fullname" . }}
|
||||
labels:
|
||||
{{- include "checkmk.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "checkmk.selectorLabels" . | nindent 6 }}
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "checkmk.selectorLabels" . | nindent 8 }}
|
||||
annotations:
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 5000
|
||||
protocol: TCP
|
||||
- name: agent-receiver
|
||||
containerPort: 8000
|
||||
protocol: TCP
|
||||
{{- if .Values.probes.startup.enabled }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: {{ include "checkmk.probePath" . }}
|
||||
port: http
|
||||
initialDelaySeconds: {{ .Values.probes.startup.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.probes.startup.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.startup.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.startup.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.startup.successThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.probes.liveness.enabled }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: {{ include "checkmk.probePath" . }}
|
||||
port: http
|
||||
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.liveness.successThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.probes.readiness.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: {{ include "checkmk.probePath" . }}
|
||||
port: http
|
||||
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
||||
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
||||
successThreshold: {{ .Values.probes.readiness.successThreshold }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: CMK_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "checkmk.secretName" . }}
|
||||
key: {{ .Values.config.adminPassword.passwordKey }}
|
||||
- name: CMK_SITE_ID
|
||||
value: {{ .Values.config.siteId | quote }}
|
||||
- name: TZ
|
||||
value: {{ .Values.config.timezone | quote }}
|
||||
{{- if .Values.config.livestatusTcp }}
|
||||
- name: CMK_LIVESTATUS_TCP
|
||||
value: "on"
|
||||
{{- end }}
|
||||
{{- if .Values.config.mailRelayHost }}
|
||||
- name: MAIL_RELAY_HOST
|
||||
value: {{ .Values.config.mailRelayHost | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: sites
|
||||
mountPath: /omd/sites
|
||||
# tmpfs for site temp dir — improves performance by using host RAM
|
||||
# equivalent to Docker's --tmpfs /opt/omd/sites/<siteId>/tmp:uid=1000,gid=1000
|
||||
- name: tmp
|
||||
mountPath: {{ include "checkmk.tmpPath" . }}
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumes:
|
||||
{{- if .Values.persistence.enabled }}
|
||||
- name: sites
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{ else }}{{ include "checkmk.fullname" . }}-sites{{ end }}
|
||||
{{- else }}
|
||||
- name: sites
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
- name: tmp
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
{{- with .Values.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@ -1,21 +0,0 @@
|
||||
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "checkmk.fullname" . }}-sites
|
||||
labels:
|
||||
{{- include "checkmk.labels" . | nindent 4 }}
|
||||
{{- with .Values.persistence.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.persistence.accessMode | quote }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- end }}
|
||||
@ -1,11 +0,0 @@
|
||||
{{- if not .Values.config.adminPassword.existingSecret }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "checkmk.fullname" . }}-secrets
|
||||
labels:
|
||||
{{- include "checkmk.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{ .Values.config.adminPassword.passwordKey }}: {{ .Values.config.adminPassword.value | default "changeme" | b64enc }}
|
||||
{{- end }}
|
||||
@ -1,25 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "checkmk.fullname" . }}
|
||||
labels:
|
||||
{{- include "checkmk.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
- port: {{ .Values.service.agentReceiverPort }}
|
||||
targetPort: agent-receiver
|
||||
protocol: TCP
|
||||
name: agent-receiver
|
||||
{{- if .Values.config.livestatusTcp }}
|
||||
- port: 6557
|
||||
targetPort: 6557
|
||||
protocol: TCP
|
||||
name: livestatus
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "checkmk.selectorLabels" . | nindent 4 }}
|
||||
@ -1,131 +0,0 @@
|
||||
## Global settings
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
## Image settings
|
||||
image:
|
||||
repository: checkmk/check-mk-community
|
||||
tag: "2.5.0p6"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
## Deployment settings
|
||||
replicaCount: 1
|
||||
revisionHistoryLimit: 3
|
||||
|
||||
# Pod security settings
|
||||
# Checkmk (OMD) requires root to manage monitoring sites and switch to site users.
|
||||
# fsGroup: 1000 matches Docker's --tmpfs uid=1000,gid=1000 so the site user can write to tmp.
|
||||
podSecurityContext:
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
fsGroup: 1000
|
||||
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
readOnlyRootFilesystem: false
|
||||
|
||||
## Pod scheduling
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
|
||||
## Pod annotations
|
||||
podAnnotations: {}
|
||||
|
||||
## Service settings
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 5000
|
||||
agentReceiverPort: 8000
|
||||
|
||||
## Ingress settings
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
hosts:
|
||||
- host: checkmk.domain.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- checkmk.domain.com
|
||||
# secretName: "existing-tls-secret"
|
||||
|
||||
## Persistence settings for /omd/sites (all site data, configs, and RRDs)
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: ""
|
||||
storageClass: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
annotations: {}
|
||||
|
||||
## Resource limits and requests
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 2000m
|
||||
# memory: 2Gi
|
||||
# requests:
|
||||
# cpu: 500m
|
||||
# memory: 512Mi
|
||||
|
||||
## Application health checks
|
||||
# startupProbe absorbs slow first-boot (site init + DB creation) so liveness/readiness
|
||||
# don't fire until the site is actually up. Budget: 120 * 10s = 20 minutes max.
|
||||
probes:
|
||||
startup:
|
||||
enabled: true
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 120
|
||||
successThreshold: 1
|
||||
liveness:
|
||||
enabled: true
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
readiness:
|
||||
enabled: true
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
|
||||
## Checkmk configuration
|
||||
config:
|
||||
# Site name — also determines the URL path: /<siteId>/check_mk/
|
||||
siteId: "cmk"
|
||||
|
||||
# Timezone (e.g. Europe/Berlin)
|
||||
timezone: "UTC"
|
||||
|
||||
# Enable Livestatus TCP access (for distributed monitoring or external tools).
|
||||
# When enabled, port 6557 is added to the Service.
|
||||
livestatusTcp: false
|
||||
|
||||
# SMTP relay host for notifications (leave empty to disable)
|
||||
mailRelayHost: ""
|
||||
|
||||
## Admin (cmkadmin) password
|
||||
adminPassword:
|
||||
# Use an existing Kubernetes secret
|
||||
existingSecret: ""
|
||||
passwordKey: "cmk-password"
|
||||
# Or set directly (not recommended for production)
|
||||
value: "changeme"
|
||||
|
||||
# Extra environment variables
|
||||
extraEnv: []
|
||||
# - name: CMK_LIVESTATUS_TCP
|
||||
# value: "on"
|
||||
|
||||
# Extra volume mounts
|
||||
extraVolumeMounts: []
|
||||
|
||||
# Extra volumes
|
||||
extraVolumes: []
|
||||
Reference in New Issue
Block a user