Checkmk uses OMD (Open Monitoring Distribution) to manage monitoring sites. This chart deploys the Community Edition using the official Docker image with:

Persistent storage for all site data (/omd/sites)
RAM-backed tmpfs for the site temp directory (performance optimization from the official docs)
Separate service ports for the web interface (5000) and agent receiver (8000)
Admin password stored in a Kubernetes Secret

Prerequisites

Kubernetes 1.19+
Helm 3.0+
A default StorageClass or an existing PersistentVolumeClaim

Quick Start

helm install checkmk ./charts/checkmk \
  --set config.adminPassword.value=mysecretpassword \
  --set ingress.enabled=true \
  --set ingress.hosts[0].host=checkmk.example.com \
  --set ingress.hosts[0].paths[0].path=/ \
  --set ingress.hosts[0].paths[0].pathType=Prefix

After installation, access the UI at http://<host>/cmk/check_mk/ with username cmkadmin.

Configuration

Admin Password (recommended: use existing secret)

kubectl create secret generic checkmk-secrets \
  --from-literal=cmk-password=<your-password>

config:
  adminPassword:
    existingSecret: "checkmk-secrets"
    passwordKey: "cmk-password"

Site ID

The config.siteId value sets the Checkmk site name and determines the URL path (/<siteId>/check_mk/). Defaults to cmk.

Livestatus TCP

Enable Livestatus TCP for distributed monitoring setups or external integrations:

config:
  livestatusTcp: true

Persistence

Site data (hosts, checks, RRD files) is stored in /omd/sites. A 5 Gi PVC is created by default. Adjust size or use an existing claim:

persistence:
  size: 20Gi
  storageClass: "fast-ssd"

Key Values

Key	Default	Description
`image.tag`	`2.5.0p6`	Checkmk Community image tag
`config.siteId`	`cmk`	Monitoring site name
`config.timezone`	`UTC`	Container timezone
`config.adminPassword.value`	`changeme`	cmkadmin password (use existingSecret in production)
`config.livestatusTcp`	`false`	Enable Livestatus over TCP
`config.mailRelayHost`	`""`	SMTP relay for notifications
`service.port`	`5000`	Web interface port
`service.agentReceiverPort`	`8000`	Agent registration port
`persistence.enabled`	`true`	Enable persistent storage
`persistence.size`	`5Gi`	PVC size

Security Notes

Checkmk (OMD) requires root access inside the container to manage monitoring sites and switch to the site user account. The podSecurityContext.runAsUser is set to 0 and containerSecurityContext.allowPrivilegeEscalation is true by default.

Place a reverse proxy (e.g. Traefik or nginx) in front for TLS termination rather than exposing the container port directly.