[Feature]: Enable "check_by_ssh" functionality

[MTSym]

Affected Chart

icinga-stack

Please describe your feature request

As machines which either do not have binaries for the agent or other circumstances exists it would be great if the functionality for "check_by_ssh" could be supported.

After checking the helm charts and templates I already found the .Values.web_resources variable which is not exposed in the default values.yml which should allow to create the necessary SSH Identity resource for the web user in combination with manually generating the ssh file on the shared volume.

But the persistent volume of the icingaweb pod would have to also be mounted inside the icinga2 pods where the checks are made. Am I right?

As a quickfix for people who are searching for a solution: It should be possible to use kustomize to generate the yaml files from helm and then use patches to add the additional env variables for the resource as well as the volume mount

[mocdaniel]

Hi, thanks for your feature request. I gather you want to have dedicated values to add SSH keys to the Icinga deployment in order to run check_by_ssh against other hosts? We can certainly add this.

I don't get your request regarding the web user and its SSH identity, afaik check_by_ssh is being executed from the Icinga2 core like any other check. Could you elaborate on that part of your request?

[MTSym]

Yeah having those keys in the values.yaml would be great. It would even be greater if they could be referenced as a kubernetes secret.

About the web description:
It is currently possible to add an SSH-Key within the Resources of the web interface. If you do that once and then use the .Values.web_resources to match the configuration it is also possible to have the resource recreated after moving the web pod to a different node etc.

With that Resource you do have the private key on the icingaweb persistent volume. So if this volume would be shared with the icinga2 core pod which does the checking it would already be possible to perform those check_by_ssh right away.