From 13309b26e038ba7d34376a46a24a74b62820370e Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Thu, 10 Sep 2026 14:50:12 +0200
Subject: [PATCH] fix: add checkmk agent entrypoint update traefik to v3.7.13

---
 .gitignore                      |  1 +
 checkmk/k8s/checkmk.yaml        | 11 +++++++++--
 checkmk/k8s/ingress.yaml        | 16 ++++++++++++++++
 traefik/k8s/traefik-values.yaml | 32 +++++++++++++++++++++++++-------
 4 files changed, 51 insertions(+), 9 deletions(-)

diff --git a/.gitignore b/.gitignore
index 3af5679..d889d3f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,6 +41,7 @@ traefik/dynamic/fileservers.yml
 traefik/dynamic/*.local.y*ml.*
 traefik/dynamic/*.external.y*ml
 traefik/k8s/fileservers.y*ml
+traefik/k8s/aliasHeadersStrategy.md
 
 traefik/logs/*
 
diff --git a/checkmk/k8s/checkmk.yaml b/checkmk/k8s/checkmk.yaml
index f4dcd3a..896d76c 100644
--- a/checkmk/k8s/checkmk.yaml
+++ b/checkmk/k8s/checkmk.yaml
@@ -7,8 +7,12 @@ spec:
   selector:
     app: checkmk
   ports:
-    - port: 5000
+    - name: web
+      port: 5000
       targetPort: 5000
+    - name: agent-receiver
+      port: 8000
+      targetPort: 8000
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -34,7 +38,10 @@ spec:
             - configMapRef:
                 name: checkmk-config
           ports:
-            - containerPort: 5000
+            - name: web
+              containerPort: 5000
+            - name: agent-receiver
+              containerPort: 8000
           volumeMounts:
             - name: sites
               mountPath: /omd/sites
diff --git a/checkmk/k8s/ingress.yaml b/checkmk/k8s/ingress.yaml
index 88cffa9..1738ddd 100644
--- a/checkmk/k8s/ingress.yaml
+++ b/checkmk/k8s/ingress.yaml
@@ -16,6 +16,22 @@ spec:
     certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: checkmk-agent-receiver
+  namespace: checkmk
+spec:
+  entryPoints:
+    - checkmk-agent
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: checkmk-service
+          port: 8000
+  tls:
+    passthrough: true
+---
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: checkmk-local
diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml
index 61b6e97..4b570fa 100644
--- a/traefik/k8s/traefik-values.yaml
+++ b/traefik/k8s/traefik-values.yaml
@@ -3,7 +3,7 @@ hostNetwork: false
 image:
   registry: docker.io/library
   repository: traefik
-  tag: v3.7.6
+  tag: v3.7.13
 
 securityContext:
   capabilities:
@@ -44,6 +44,7 @@ ports:
   web:
     port: 80
     http:
+      aliasHeadersStrategy: delete
       redirections:
         entryPoint:
           to: websecure
@@ -52,32 +53,54 @@ ports:
   websecure:
     port: 443
     http:
+      aliasHeadersStrategy: delete
       tls:
         enabled: true
+  traefik:
+    port: 8080
+    exposedPort: 8080
+    protocol: TCP
+    expose:
+      default: false
+    http:
+      aliasHeadersStrategy: delete
   ssh:
     port: 2221
     exposedPort: 2221
     protocol: TCP
     expose:
       default: true
+    http:
+      aliasHeadersStrategy: delete
   minecraft-tcp:
     port: 25565
     exposedPort: 25565
     protocol: TCP
     expose:
       default: true
+    http:
+      aliasHeadersStrategy: delete
   minecraft-udp:
     port: 19132
     exposedPort: 19132
     protocol: UDP
     expose:
       default: true
+  checkmk-agent:
+    port: 8000
+    protocol: TCP
+    expose:
+      default: true
+    http:
+      aliasHeadersStrategy: delete
   metrics:
     port: 9100
     exposedPort: 9100
     protocol: TCP
     expose:
       default: false
+    http:
+      aliasHeadersStrategy: delete
 
 metrics:
   prometheus:
@@ -122,11 +145,6 @@ additionalArguments:
   - "--providers.file.directory=/etc/traefik/dynamic"
   - "--providers.file.watch=true"
   - "--providers.kubernetesCRD.allowCrossNamespace=true"
+  - "--providers.kubernetesCRD.safeNaming=false"
   - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
   - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
-
-log:
-  level: INFO
-accessLog:
-  enabled: true
-  format: common