Add Vault parameters to server
MODIFY
manifests/init.pp
manifests/init.pp
@@ -145,6 +145,9 @@ class zabbix (
$startjavapollers = $zabbix::params::server_startjavapollers,
Integer[1, 100] $startlldprocessors = $zabbix::params::server_startlldprocessors,
$startvmwarecollectors = $zabbix::params::server_startvmwarecollectors,
+ Optional[String[1]] $vaultdbpath = $zabbix::params::server_vaultdbpath,
+ Optional[String[1]] $vaulttoken = $zabbix::params::server_vaulttoken,
+ Stdlib::HTTPSUrl $vaulturl = $zabbix::params::server_vaulturl,
$vmwarefrequency = $zabbix::params::server_vmwarefrequency,
$vmwarecachesize = $zabbix::params::server_vmwarecachesize,
$vmwaretimeout = $zabbix::params::server_vmwaretimeout,
@@ -289,6 +292,9 @@ class zabbix (
startjavapollers => $startjavapollers,
startlldprocessors => $startlldprocessors,
startvmwarecollectors => $startvmwarecollectors,
+ vaultdbpath => $vaultdbpath,
+ vaulttoken => $vaulttoken,
+ vaulturl => $vaulturl,
vmwarefrequency => $vmwarefrequency,
vmwarecachesize => $vmwarecachesize,
vmwaretimeout => $vmwaretimeout,

MODIFY
manifests/params.pp
manifests/params.pp
@@ -296,6 +296,9 @@ class zabbix::params {
$server_unreachabledelay = '15'
$server_unreachableperiod = '45'
$server_valuecachesize = '8M'
+ $server_vaultdbpath = undef
+ $server_vaulttoken = undef
+ $server_vaulturl = 'https://127.0.0.1:8200'
$server_vmwarecachesize = '8M'
$server_vmwarefrequency = '60'
$server_vmwaretimeout = undef

MODIFY
manifests/server.pp
manifests/server.pp
# [*vmwarefrequency*]
# How often zabbix will connect to vmware service to obtain a new datan.
#
+# [*vaultdbpath*]
+# Vault path from where credentials for database will be retrieved by keys 'password' and 'username'.
+#
+# [*vaulttoken*]
+# Vault authentication token that should have been generated exclusively for Zabbix proxy with read-only
+# permission to the path specified in the optional VaultDBPath configuration parameter.
+#
+# [*vaulturl*]
+# Vault server HTTP[S] URL. System-wide CA certificates directory will be used if SSLCALocation is not specified.
+#
# [*vmwarecachesize*]
# Size of vmware cache, in bytes.
#
@@ -393,6 +403,9 @@ class zabbix::server (
$startjavapollers = $zabbix::params::server_startjavapollers,
Integer[1, 100] $startlldprocessors = $zabbix::params::server_startlldprocessors,
$startvmwarecollectors = $zabbix::params::server_startvmwarecollectors,
+ Optional[String[1]] $vaultdbpath = $zabbix::params::server_vaultdbpath,
+ Optional[String[1]] $vaulttoken = $zabbix::params::server_vaulttoken,
+ Stdlib::HTTPSUrl $vaulturl = $zabbix::params::server_vaulturl,
$vmwarefrequency = $zabbix::params::server_vmwarefrequency,
$vmwarecachesize = $zabbix::params::server_vmwarecachesize,
$vmwaretimeout = $zabbix::params::server_vmwaretimeout,

MODIFY
spec/classes/server_spec.rb
spec/classes/server_spec.rb
@@ -385,6 +385,24 @@ describe 'zabbix::server' do
it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').without_content %r{^LogFileSize=} }
end
end
+
+ # Zabbix Server 5.2 is not supported on RedHat family
+ if facts[:osfamily] != 'RedHat'
+ describe 'with zabbix_version 5.2 and Vault parameters defined' do
+ let :params do
+ {
+ zabbix_version: '5.2',
+ vaultdbpath: 'secret/zabbix/database',
+ vaulttoken: 'FKTYPEGL156DK',
+ vaulturl: 'https://127.0.0.1:8200',
+ }
+ end
+
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VaultDBPath=secret/zabbix/database$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VaultToken=FKTYPEGL156DK$} }
+ it { is_expected.to contain_file('/etc/zabbix/zabbix_server.conf').with_content %r{^VaultURL=https://127.0.0.1:8200$} }
+ end
+ end
end
end
end

MODIFY
templates/zabbix_server.conf.erb
templates/zabbix_server.conf.erb
@@ -618,5 +618,35 @@ LoadModulePath=<%= @loadmodulepath %>
# Default:
# TLSCipherAll13=
<% if @tlscipherall %>TLSCipherAll=<%= @tlscipherall %><% end %>
+<% end %>
+
+<% if @zabbix_version.to_f >= 5.2 %>
+### Option: VaultToken
+# Vault authentication token that should have been generated exclusively for Zabbix server with read only permission
+# to paths specified in Vault macros and read only permission to path specified in optional VaultDBPath
+# configuration parameter.
+# It is an error if VaultToken and VAULT_TOKEN environment variable are defined at the same time.
+#
+# Mandatory: no
+# Default:
+# VaultToken=
+<% if @vaulttoken %>VaultToken=<%= @vaulttoken -%><% end %>
+
+### Option: VaultURL
+# Vault server HTTP[S] URL. System-wide CA certificates directory will be used if SSLCALocation is not specified.
+#
+# Mandatory: no
+# Default:
+# VaultURL=https://127.0.0.1:8200
+<% if @vaulturl %>VaultURL=<%= @vaulturl -%><% end %>
+### Option: VaultDBPath
+# Vault path from where credentials for database will be retrieved by keys 'password' and 'username'.
+# Example: secret/zabbix/database
+# This option can only be used if DBUser and DBPassword are not specified.
+#
+# Mandatory: no
+# Default:
+# VaultDBPath=
+<% if @vaultdbpath %>VaultDBPath=<%= @vaultdbpath -%><% end %>
<% end %>

Add Vault parameters to server

Signed-off-by: Christos Papageorgiou <root.expert.xda@gmail.com>