mirror of
https://github.com/rtomik/helm-charts.git
synced 2026-07-16 16:25:16 +00:00
92 lines
2.9 KiB
Markdown
92 lines
2.9 KiB
Markdown
# Checkmk Helm Chart
|
|
|
|
Helm chart for deploying [Checkmk](https://checkmk.com/) — an infrastructure and application monitoring platform — on Kubernetes.
|
|
|
|
## Overview
|
|
|
|
Checkmk uses OMD (Open Monitoring Distribution) to manage monitoring sites. This chart deploys the Community Edition using the official Docker image with:
|
|
|
|
- Persistent storage for all site data (`/omd/sites`)
|
|
- RAM-backed tmpfs for the site temp directory (performance optimization from the official docs)
|
|
- Separate service ports for the web interface (5000) and agent receiver (8000)
|
|
- Admin password stored in a Kubernetes Secret
|
|
|
|
## Prerequisites
|
|
|
|
- Kubernetes 1.19+
|
|
- Helm 3.0+
|
|
- A default StorageClass or an existing PersistentVolumeClaim
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
helm install checkmk ./charts/checkmk \
|
|
--set config.adminPassword.value=mysecretpassword \
|
|
--set ingress.enabled=true \
|
|
--set ingress.hosts[0].host=checkmk.example.com \
|
|
--set ingress.hosts[0].paths[0].path=/ \
|
|
--set ingress.hosts[0].paths[0].pathType=Prefix
|
|
```
|
|
|
|
After installation, access the UI at `http://<host>/cmk/check_mk/` with username `cmkadmin`.
|
|
|
|
## Configuration
|
|
|
|
### Admin Password (recommended: use existing secret)
|
|
|
|
```bash
|
|
kubectl create secret generic checkmk-secrets \
|
|
--from-literal=cmk-password=<your-password>
|
|
```
|
|
|
|
```yaml
|
|
config:
|
|
adminPassword:
|
|
existingSecret: "checkmk-secrets"
|
|
passwordKey: "cmk-password"
|
|
```
|
|
|
|
### Site ID
|
|
|
|
The `config.siteId` value sets the Checkmk site name and determines the URL path (`/<siteId>/check_mk/`). Defaults to `cmk`.
|
|
|
|
### Livestatus TCP
|
|
|
|
Enable Livestatus TCP for distributed monitoring setups or external integrations:
|
|
|
|
```yaml
|
|
config:
|
|
livestatusTcp: true
|
|
```
|
|
|
|
### Persistence
|
|
|
|
Site data (hosts, checks, RRD files) is stored in `/omd/sites`. A 5 Gi PVC is created by default. Adjust size or use an existing claim:
|
|
|
|
```yaml
|
|
persistence:
|
|
size: 20Gi
|
|
storageClass: "fast-ssd"
|
|
```
|
|
|
|
## Key Values
|
|
|
|
| Key | Default | Description |
|
|
|-----|---------|-------------|
|
|
| `image.tag` | `2.5.0p6` | Checkmk Community image tag |
|
|
| `config.siteId` | `cmk` | Monitoring site name |
|
|
| `config.timezone` | `UTC` | Container timezone |
|
|
| `config.adminPassword.value` | `changeme` | cmkadmin password (use existingSecret in production) |
|
|
| `config.livestatusTcp` | `false` | Enable Livestatus over TCP |
|
|
| `config.mailRelayHost` | `""` | SMTP relay for notifications |
|
|
| `service.port` | `5000` | Web interface port |
|
|
| `service.agentReceiverPort` | `8000` | Agent registration port |
|
|
| `persistence.enabled` | `true` | Enable persistent storage |
|
|
| `persistence.size` | `5Gi` | PVC size |
|
|
|
|
## Security Notes
|
|
|
|
Checkmk (OMD) requires root access inside the container to manage monitoring sites and switch to the site user account. The `podSecurityContext.runAsUser` is set to `0` and `containerSecurityContext.allowPrivilegeEscalation` is `true` by default.
|
|
|
|
Place a reverse proxy (e.g. Traefik or nginx) in front for TLS termination rather than exposing the container port directly.
|