init.sls 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333
  1. #
  2. # Icinga2
  3. #
  4. {% set roles = salt['pillar.get']('nodes:' ~ grains.id ~ ':roles', []) %}
  5. include:
  6. - apt
  7. - sudo
  8. - needrestart
  9. /etc/apt/trusted.gpg.d/icinga.gpg:
  10. file.managed:
  11. - source: salt://icinga2/icinga.gpg
  12. /etc/apt/sources.list.d/icinga.list:
  13. file.managed:
  14. - source: salt://icinga2/icinga.list.tmpl
  15. - template: jinja
  16. - require:
  17. - file: /etc/apt/trusted.gpg.d/icinga.gpg
  18. # Install icinga2 package
  19. icinga2:
  20. pkg.installed:
  21. - name: icinga2
  22. - require:
  23. - file: /etc/apt/sources.list.d/icinga.list
  24. service.running:
  25. - enable: True
  26. - reload: True
  27. /etc/systemd/system/icinga2.service.d/override.conf:
  28. file.absent
  29. systemd-reload:
  30. cmd.run:
  31. - name: systemctl daemon-reload
  32. - watch:
  33. - file: /etc/systemd/system/icinga2.service.d/override.conf
  34. # Install plugins (official + our own)
  35. monitoring-plugin-pkgs:
  36. pkg.installed:
  37. - pkgs:
  38. - monitoring-plugins
  39. - nagios-plugins-contrib
  40. - libyaml-syck-perl
  41. - libmonitoring-plugin-perl
  42. - curl
  43. - lsof
  44. - python3-dnspython
  45. - watch_in:
  46. - service: icinga2
  47. ffho-plugins:
  48. file.recurse:
  49. - name: /usr/local/share/monitoring-plugins/
  50. - source: salt://icinga2/plugins/
  51. - file_mode: 755
  52. - dir_mode: 755
  53. - user: root
  54. - group: root
  55. # Install sudoers file for Icinga2 checks
  56. /etc/sudoers.d/icinga2:
  57. file.managed:
  58. - source: salt://icinga2/icinga2.sudoers
  59. - mode: 0440
  60. # Icinga2 master config (for master and all nodes)
  61. /etc/icinga2/icinga2.conf:
  62. file.managed:
  63. - source:
  64. - salt://icinga2/icinga2.conf.H_{{ grains.id }}
  65. - salt://icinga2/icinga2.conf.{{ grains.os }}.{{ grains.oscodename }}
  66. - salt://icinga2/icinga2.conf
  67. - require:
  68. - pkg: icinga2
  69. - watch_in:
  70. - service: icinga2
  71. # Add FFHOPluginDir
  72. /etc/icinga2/constants.conf:
  73. file.managed:
  74. - source: salt://icinga2/constants.conf
  75. - require:
  76. - pkg: icinga2
  77. - watch_in:
  78. - service: icinga2
  79. # Connect "master" and client zones
  80. /etc/icinga2/zones.conf:
  81. file.managed:
  82. - source:
  83. - salt://icinga2/zones.conf.H_{{ grains.id }}
  84. - salt://icinga2/zones.conf
  85. - template: jinja
  86. - require:
  87. - pkg: icinga2
  88. - watch_in:
  89. - service: icinga2
  90. # Install host cert + key readable for icinga
  91. {% set pillar_name = 'nodes:' ~ grains['id'] ~ ':certs:' ~ grains['id'] %}
  92. /etc/icinga2/pki/ffhohost.cert.pem:
  93. file.managed:
  94. {% if salt['pillar.get'](pillar_name ~ ':cert') == "file" %}
  95. - source: salt://certs/certs/{{ cn }}.cert.pem
  96. {% else %}
  97. - contents_pillar: {{ pillar_name }}:cert
  98. {% endif %}
  99. - user: root
  100. - group: root
  101. - mode: 644
  102. - require:
  103. - pkg: icinga2
  104. - watch_in:
  105. - service: icinga2
  106. /etc/icinga2/pki/ffhohost.key.pem:
  107. file.managed:
  108. - contents_pillar: {{ pillar_name }}:privkey
  109. - user: root
  110. - group: nagios
  111. - mode: 440
  112. - require:
  113. - pkg: icinga2
  114. - watch_in:
  115. - service: icinga2
  116. # Activate Icinga2 features: API
  117. {% for feature in ['api'] %}
  118. /etc/icinga2/features-enabled/{{ feature }}.conf:
  119. file.symlink:
  120. - target: "../features-available/{{ feature }}.conf"
  121. - require:
  122. - pkg: icinga2
  123. - watch_in:
  124. - service: icinga2
  125. {% endfor %}
  126. # Install command definitions
  127. /etc/icinga2/commands.d:
  128. file.recurse:
  129. - source: salt://icinga2/commands.d
  130. - template: jinja
  131. - file_mode: 644
  132. - dir_mode: 755
  133. - user: root
  134. - group: root
  135. - clean: true
  136. - require:
  137. - pkg: icinga2
  138. - watch_in:
  139. - service: icinga2
  140. # Create directory for ffho specific configs
  141. /etc/icinga2/ffho-conf.d:
  142. file.directory:
  143. - makedirs: true
  144. - require:
  145. - pkg: icinga2
  146. ################################################################################
  147. # Icinga2 Server #
  148. ################################################################################
  149. {% if 'icinga2server' in roles %}
  150. # Users and Notifications
  151. /etc/icinga2/ffho-conf.d/users.conf:
  152. file.managed:
  153. - source: salt://icinga2/users.conf.tmpl
  154. - template: jinja
  155. - require:
  156. - pkg: icinga2
  157. - watch_in:
  158. - service: icinga2
  159. /etc/icinga2/ffho-conf.d/notifications.conf:
  160. file.managed:
  161. - source: salt://icinga2/notifications.conf.tmpl
  162. - template: jinja
  163. - require:
  164. - pkg: icinga2
  165. - watch_in:
  166. - service: icinga2
  167. # Install command definitions
  168. /etc/icinga2/ffho-conf.d/services:
  169. file.recurse:
  170. - source: salt://icinga2/services
  171. - file_mode: 644
  172. - dir_mode: 755
  173. - user: root
  174. - group: root
  175. - clean: true
  176. - template: jinja
  177. - require:
  178. - pkg: icinga2
  179. - watch_in:
  180. - service: icinga2
  181. # Create client node/zone objects
  182. Create /etc/icinga2/ffho-conf.d/hosts/generated/:
  183. file.directory:
  184. - name: /etc/icinga2/ffho-conf.d/hosts/generated/
  185. - makedirs: true
  186. - require:
  187. - pkg: icinga2
  188. Cleanup /etc/icinga2/ffho-conf.d/hosts/generated/:
  189. file.directory:
  190. - name: /etc/icinga2/ffho-conf.d/hosts/generated/
  191. - clean: true
  192. - watch_in:
  193. - service: icinga2
  194. # Generate config file for every client known to pillar
  195. {% for node_id, node_config in salt['pillar.get']('nodes', {}).items () %}
  196. {# Only monitor hosts which are active or staged. #}
  197. {% if node_config.get ('status', '') not in [ '', 'active', 'staged' ] %}
  198. {% continue %}
  199. {% endif %}
  200. /etc/icinga2/ffho-conf.d/hosts/generated/{{ node_id }}.conf:
  201. file.managed:
  202. - source: salt://icinga2/host.conf.tmpl
  203. - template: jinja
  204. - context:
  205. node_id: {{ node_id }}
  206. node_config: {{ node_config }}
  207. - require:
  208. - file: Create /etc/icinga2/ffho-conf.d/hosts/generated/
  209. - require_in:
  210. - file: Cleanup /etc/icinga2/ffho-conf.d/hosts/generated/
  211. - watch_in:
  212. - service: icinga2
  213. {% endfor %}
  214. # Create configuration for network devices
  215. Create /etc/icinga2/ffho-conf.d/net/wbbl/:
  216. file.directory:
  217. - name: /etc/icinga2/ffho-conf.d/net/wbbl/
  218. - makedirs: true
  219. - require:
  220. - pkg: icinga2
  221. Cleanup /etc/icinga2/ffho-conf.d/net/wbbl/:
  222. file.directory:
  223. - name: /etc/icinga2/ffho-conf.d/net/wbbl/
  224. - makedirs: true
  225. - require:
  226. - pkg: icinga2
  227. - watch_in:
  228. - service: icinga2
  229. # Generate config files for every WBBL device known to pillar
  230. {% for link_id, link_config in salt['pillar.get']('net:wbbl', {}).items () %}
  231. /etc/icinga2/ffho-conf.d/net/wbbl/{{ link_id }}.conf:
  232. file.managed:
  233. - source: salt://icinga2/wbbl.conf.tmpl
  234. - template: jinja
  235. - context:
  236. link_id: {{ link_id }}
  237. link_config: {{ link_config }}
  238. - require:
  239. - file: Create /etc/icinga2/ffho-conf.d/net/wbbl/
  240. - require_in:
  241. - file: Cleanup /etc/icinga2/ffho-conf.d/net/wbbl/
  242. - watch_in:
  243. - service: icinga2
  244. {% endfor %}
  245. ################################################################################
  246. # Icinga2 Client #
  247. ################################################################################
  248. {% else %}
  249. # Nodes should accept config and commands from Icinga2 server
  250. /etc/icinga2/features-available/api.conf:
  251. file.managed:
  252. - source: salt://icinga2/api.conf
  253. - require:
  254. - pkg: icinga2
  255. - watch_in:
  256. - service: icinga2
  257. # Client should not notify by themselves
  258. /etc/icinga2/features-enabled/notification.conf:
  259. file.absent:
  260. - watch_in:
  261. - service: icinga2
  262. {% endif %}
  263. ################################################################################
  264. # Check related stuff #
  265. ################################################################################
  266. /etc/icinga2/ffho-conf.d/bird_ospf_interfaces_down_ok.txt:
  267. file.managed:
  268. - source: salt://icinga2/bird_ospf_interfaces_down_ok.txt.tmpl
  269. - template: jinja
  270. - require:
  271. - file: /etc/icinga2/ffho-conf.d
  272. /etc/icinga2/ffho-conf.d/bird_ibgp_sessions_down_ok.txt:
  273. file.managed:
  274. - source: salt://icinga2/bird_ibgp_sessions_down_ok.txt.tmpl
  275. - template: jinja
  276. - require:
  277. - file: /etc/icinga2/ffho-conf.d
  278. salt-cron-state-apply:
  279. cron.present:
  280. - identifier: SALT_CRON_STATE_APPLY
  281. - name: "/usr/bin/salt-call state.highstate --state-verbose=False test=True > /var/cache/salt/state_apply.tmp 2>/dev/null ; mv /var/cache/salt/state_apply.tmp /var/cache/salt/state_apply"
  282. - user: root
  283. - minute: random
  284. - hour: "*/6"