Question about the agent role and the CEE about ansible-collection-checkmk.general HOT 5 CLOSED

Thanks for moving this to a new issue.
So, just to be sure: CheckMK Enterprise is supported by this playbook? I'd like to perform the full rollout of the agents created and signed by the bakery. Afterwards, they should keep themselves up to date automatically as far as I understood?

Would you recommend running the role only for initial deployment or does it correctly identify already installed monitoring agents? I'd like to avoid having the auto-updater and ansible fighting with each other once a host is onboarded.

from ansible-collection-checkmk.general.

Right, the README might be out of date, I need to check that.
edit: bd57bb4 resolves this.

You can use this role for initial rollout, if you plan on using the agent bakery. After initial deployment, the bakery will handle the agents. If you run this role again, however, it might break the agent until it updates again. Right now there is no detection of a working bakery setup.

from ansible-collection-checkmk.general.

Thank you very much. I will then write a check if the agent is already installed (any hints how to approach this? I'd probably check the file system for one of the config files and also add an option for force-installing via ansible) and skip the agent deployment if it returns true.

I'm planning to use a specific user for ansible deployment and I'd like this user to have as little permissions as possible. Is there any documentation on this topic? I've found this issue where the following permissions are recommended:

• Read access to all hosts and folders
• Write access to all hosts and folders
• Register Host & download monitoring agents of your hosts
• Register all hosts & download all monitoring agents

With this permissions, manually pairing an agent worked, but registering it with the update server and bakery was unfortunately not possible. Are there any further permissions required? I think this would be something nice to specifically document (especially for your enterprise versions as there's the bakery involved) because then one could give deployment capabilities to other users without allowing them full access.

Or should I move this to your forums / another separate issue?

from ansible-collection-checkmk.general.

Hi @edermi and thanks for your patience!
I am looking forward to your pull request with the detection of working bakery.

Regarding the permission question: It is out of scope here. Head for the Checkmk forum please.

Can we close this issue then, or is there anything else?

from ansible-collection-checkmk.general.

Hi,

we decided internally to move this into a separate playbook for various reasons. As this is only used on-demand when onboarding hosts, the detection is not required.

Thanks for your help!

(The issue can be closed, but I can't close it because it has been opened by you)

from ansible-collection-checkmk.general.