init.sls 7.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290
  1. #
  2. # Icinga2
  3. #
  4. {% set roles = salt['pillar.get']('nodes:' ~ grains.id ~ ':roles', []) %}
  5. include:
  6. - apt
  7. - sudo
  8. # Install icinga2 package
  9. icinga2:
  10. pkg.installed:
  11. - name: icinga2
  12. service.running:
  13. - enable: True
  14. - reload: True
  15. # Install plugins (official + our own)
  16. monitoring-plugin-pkgs:
  17. pkg.installed:
  18. - pkgs:
  19. - monitoring-plugins
  20. - nagios-plugins-contrib
  21. - libyaml-syck-perl
  22. - libmonitoring-plugin-perl
  23. - lsof
  24. - python3-dnspython
  25. - watch_in:
  26. - service: icinga2
  27. ffho-plugins:
  28. file.recurse:
  29. - name: /usr/local/share/monitoring-plugins/
  30. - source: salt://icinga2/plugins/
  31. - file_mode: 755
  32. - dir_mode: 755
  33. - user: root
  34. - group: root
  35. # Install sudoers file for Icinga2 checks
  36. /etc/sudoers.d/icinga2:
  37. file.managed:
  38. - source: salt://icinga2/icinga2.sudoers
  39. - mode: 0440
  40. # Icinga2 master config (for master and all nodes)
  41. /etc/icinga2/icinga2.conf:
  42. file.managed:
  43. - source:
  44. - salt://icinga2/icinga2.conf.H_{{ grains.id }}
  45. - salt://icinga2/icinga2.conf.{{ grains.os }}.{{ grains.oscodename }}
  46. - salt://icinga2/icinga2.conf
  47. - require:
  48. - pkg: icinga2
  49. - watch_in:
  50. - service: icinga2
  51. # Add FFHOPluginDir
  52. /etc/icinga2/constants.conf:
  53. file.managed:
  54. - source: salt://icinga2/constants.conf
  55. - require:
  56. - pkg: icinga2
  57. - watch_in:
  58. - service: icinga2
  59. # Connect "master" and client zones
  60. /etc/icinga2/zones.conf:
  61. file.managed:
  62. - source:
  63. - salt://icinga2/zones.conf.H_{{ grains.id }}
  64. - salt://icinga2/zones.conf
  65. - template: jinja
  66. - require:
  67. - pkg: icinga2
  68. - watch_in:
  69. - service: icinga2
  70. # Install host cert + key readable for icinga
  71. {% set pillar_name = 'nodes:' ~ grains['id'] ~ ':certs:' ~ grains['id'] %}
  72. /etc/icinga2/pki/ffhohost.cert.pem:
  73. file.managed:
  74. {% if salt['pillar.get'](pillar_name ~ ':cert') == "file" %}
  75. - source: salt://certs/certs/{{ cn }}.cert.pem
  76. {% else %}
  77. - contents_pillar: {{ pillar_name }}:cert
  78. {% endif %}
  79. - user: root
  80. - group: root
  81. - mode: 644
  82. - require:
  83. - pkg: icinga2
  84. - watch_in:
  85. - service: icinga2
  86. /etc/icinga2/pki/ffhohost.key.pem:
  87. file.managed:
  88. - contents_pillar: {{ pillar_name }}:privkey
  89. - user: root
  90. - group: nagios
  91. - mode: 440
  92. - require:
  93. - pkg: icinga2
  94. - watch_in:
  95. - service: icinga2
  96. # Activate Icinga2 features: API
  97. {% for feature in ['api'] %}
  98. /etc/icinga2/features-enabled/{{ feature }}.conf:
  99. file.symlink:
  100. - target: "../features-available/{{ feature }}.conf"
  101. - require:
  102. - pkg: icinga2
  103. - watch_in:
  104. - service: icinga2
  105. {% endfor %}
  106. # Install command definitions
  107. /etc/icinga2/commands.d:
  108. file.recurse:
  109. - source: salt://icinga2/commands.d
  110. - template: jinja
  111. - file_mode: 644
  112. - dir_mode: 755
  113. - user: root
  114. - group: root
  115. - clean: true
  116. - require:
  117. - pkg: icinga2
  118. - watch_in:
  119. - service: icinga2
  120. # Create directory for ffho specific configs
  121. /etc/icinga2/ffho-conf.d:
  122. file.directory:
  123. - makedirs: true
  124. - require:
  125. - pkg: icinga2
  126. ################################################################################
  127. # Icinga2 Server #
  128. ################################################################################
  129. {% if 'icinga2server' in roles %}
  130. # Install command definitions
  131. /etc/icinga2/ffho-conf.d/services:
  132. file.recurse:
  133. - source: salt://icinga2/services
  134. - file_mode: 644
  135. - dir_mode: 755
  136. - user: root
  137. - group: root
  138. - clean: true
  139. - require:
  140. - pkg: icinga2
  141. - watch_in:
  142. - service: icinga2
  143. # Create client node/zone objects
  144. Create /etc/icinga2/ffho-conf.d/hosts/generated/:
  145. file.directory:
  146. - name: /etc/icinga2/ffho-conf.d/hosts/generated/
  147. - makedirs: true
  148. - require:
  149. - pkg: icinga2
  150. Cleanup /etc/icinga2/ffho-conf.d/hosts/generated/:
  151. file.directory:
  152. - name: /etc/icinga2/ffho-conf.d/hosts/generated/
  153. - clean: true
  154. - watch_in:
  155. - service: icinga2
  156. # Generate config file for every client known to pillar
  157. {% for node_id, node_config in salt['pillar.get']('nodes', {}).items () %}
  158. {# Only monitor hosts which are active or staged. #}
  159. {% if node_config.get ('status', '') not in [ '', 'active', 'staged' ] %}
  160. {% continue %}
  161. {% endif %}
  162. /etc/icinga2/ffho-conf.d/hosts/generated/{{ node_id }}.conf:
  163. file.managed:
  164. - source: salt://icinga2/host.conf.tmpl
  165. - template: jinja
  166. - context:
  167. node_id: {{ node_id }}
  168. node_config: {{ node_config }}
  169. - require:
  170. - file: Create /etc/icinga2/ffho-conf.d/hosts/generated/
  171. - require_in:
  172. - file: Cleanup /etc/icinga2/ffho-conf.d/hosts/generated/
  173. - watch_in:
  174. - service: icinga2
  175. {% endfor %}
  176. # Create configuration for network devices
  177. Create /etc/icinga2/ffho-conf.d/net/wbbl/:
  178. file.directory:
  179. - name: /etc/icinga2/ffho-conf.d/net/wbbl/
  180. - makedirs: true
  181. - require:
  182. - pkg: icinga2
  183. Cleanup /etc/icinga2/ffho-conf.d/net/wbbl/:
  184. file.directory:
  185. - name: /etc/icinga2/ffho-conf.d/net/wbbl/
  186. - makedirs: true
  187. - require:
  188. - pkg: icinga2
  189. - watch_in:
  190. - service: icinga2
  191. # Generate config files for every WBBL device known to pillar
  192. {% for link_id, link_config in salt['pillar.get']('net:wbbl', {}).items () %}
  193. /etc/icinga2/ffho-conf.d/net/wbbl/{{ link_id }}.conf:
  194. file.managed:
  195. - source: salt://icinga2/wbbl.conf.tmpl
  196. - template: jinja
  197. - context:
  198. link_id: {{ link_id }}
  199. link_config: {{ link_config }}
  200. - require:
  201. - file: Create /etc/icinga2/ffho-conf.d/net/wbbl/
  202. - require_in:
  203. - file: Cleanup /etc/icinga2/ffho-conf.d/net/wbbl/
  204. - watch_in:
  205. - service: icinga2
  206. {% endfor %}
  207. ################################################################################
  208. # Icinga2 Client #
  209. ################################################################################
  210. {% else %}
  211. # Nodes should accept config and commands from Icinga2 server
  212. /etc/icinga2/features-available/api.conf:
  213. file.managed:
  214. - source: salt://icinga2/api.conf
  215. - require:
  216. - pkg: icinga2
  217. - watch_in:
  218. - service: icinga2
  219. # Client should not notify by themselves
  220. /etc/icinga2/features-enable/notification.conf:
  221. file.absent:
  222. - watch_in:
  223. - service: icinga2
  224. {% endif %}
  225. ################################################################################
  226. # Check related stuff #
  227. ################################################################################
  228. /etc/icinga2/ffho-conf.d/bird_ospf_interfaces_down_ok.txt:
  229. file.managed:
  230. - source: salt://icinga2/bird_ospf_interfaces_down_ok.txt.tmpl
  231. - template: jinja
  232. - require:
  233. - file: /etc/icinga2/ffho-conf.d
  234. /etc/icinga2/ffho-conf.d/bird_ibgp_sessions_down_ok.txt:
  235. file.managed:
  236. - source: salt://icinga2/bird_ibgp_sessions_down_ok.txt.tmpl
  237. - template: jinja
  238. - require:
  239. - file: /etc/icinga2/ffho-conf.d
  240. salt-cron-state-apply:
  241. cron.present:
  242. - identifier: SALT_CRON_STATE_APPLY
  243. - name: "/usr/bin/salt-call state.highstate --state-verbose=False test=True > /var/cache/salt/state_apply.tmp 2>/dev/null ; mv /var/cache/salt/state_apply.tmp /var/cache/salt/state_apply"
  244. - user: root
  245. - minute: random
  246. - hour: "*/6"