GithubHelp home page GithubHelp logo

adfinis / ansible-role-icinga2_master Goto Github PK

View Code? Open in Web Editor NEW
2.0 9.0 11.0 333 KB

This role is used to configure an icinga2 master

License: GNU General Public License v3.0

Shell 22.20% Jinja 77.80%
icinga2 monitoring ansible ansible-role ansible-galaxy automation infrastructure

ansible-role-icinga2_master's Introduction

ROLE ICINGA2_MASTER

image

image

image

This role configures icinga2 to act as a master. Furthermore, this role takes care of the configuration for all clients.

Requirements

When icinga2_master_ido_enabled is turned on the role tries to activate the IDO feature for icinga2. This needs a running database, either already existing or using the adfinis.mariadb role. Note: When using a multi-master setup, only one database must be used for both instances!

Role Variables

# The icinga2 master zone
icinga2_master_master_zone: monitoring-master

# A list of all icinga2 api users
icinga2_master_api_users: []
#  - username: root
#    password: 'passw0rd'
#    permissions: '*'
#  - username: token-generator
#    password: 'passw0rd'
#    permissions: 'actions/generate-ticket'

Templates can be adjusted using variables.

## Template settings

# If you have own templates for the configuration files in /etc/icinga2/conf.d
# consider adjusting the names here and add your template to
# templates/etc/icinga2/conf.d in the root of your playbook folder.
icinga2_master_template_confd_notifications: "notifications.conf"
icinga2_master_template_confd_templates: "templates.conf"
icinga2_master_template_confd_commands: "commands.conf"
icinga2_master_template_confd_groups: "groups.conf"
icinga2_master_template_confd_timeperiods: "timeperiods.conf"
icinga2_master_template_confd_users: "users.conf"

# These variables can be adjusted if you have custom templates for the global
# templates directory which gets synced to all clients.
icinga2_master_template_globaltemplates:
  - "services.conf"
  - "templates.conf"

If you want to use Twilio for the alerting, you can create an account. After that, you can receive an Application SID and Auth token from the twilio console. If you plan to make phone calls, please create a TwiML application.

## Twilio alerting

# The account sid from https://www.twilio.com/console
#icinga2_master_twilio_account_sid: 'account_sid'

# The auth token from https://www.twilio.com/console
#icinga2_master_twilio_auth_token: 'auth_token'

# Whether twilio sms are enabled or not
icinga2_master_twilio_sms_enabled: False

# The twilio phone numer used to send sms
#icinga2_master_twilio_sms_from: '+41123456789'

# Twilio SMS scripts additional commands
# Can be used to execute custom scripts after the SMS is sent
# defaults to an empty list, add command lines as necessary
# Example:
#icinga2_master_twilio_sms_additional_commands:
#  # Execute a custom script after the sms has been sent to also send
#  # the notification to mattermost
#  - "/etc/icinga2/scripts/mattermost.sh "${NOTIFICATION_MESSAGE}""
icinga2_master_twilio_sms_additional_commands: []

# Whether twilio calls are enabled or not
icinga2_master_twilio_phone_enabled: False

# The twilio phone number used to make calls
#icinga2_master_twilio_phone_from: '+41123456789'

# The twilio application on how to handle the call. You can either choose
# application sid or appication url. Choose only one. default is not defined.
# https://www.twilio.com/docs/voice/make-calls
#icinga2_master_twilio_phone_application_sid: 'application_sid'
#icinga2_master_twilio_phone_application_url: 'application_url'

Role Special Hostgroups

The following names will be used in the context of ansible group selectors and are evaluated inside of the role Their special meaning should be described in more depth (!!TODO!!).

  • monitoring_client
  • monitoring_master
  • monitoring_sat

Dependencies

This role depends on the role adfinis.icinga2_agent, which installs the icinga2 binary.

Example Playbook

- hosts: monitoring-master
  roles:
     - { role: adfinis.icinga2_agent }
     - { role: adfinis.icinga2_master }

License

GPL-3.0

Author Information

icinga2_master role was written by:

ansible-role-icinga2_master's People

Contributors

aconitumnapellus avatar ayekat avatar breml avatar eni23 avatar eyenx avatar flybyray avatar fujexo avatar gianklug avatar karras avatar madpat1998 avatar martinwe-adfinis avatar michaelimfeld avatar stdevel avatar strixbe avatar tongpu avatar

Stargazers

 avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

ansible-role-icinga2_master's Issues

Notification scripts: Log errors

Right now the notification scripts make API requests to Twilio with curl -s, effectively turning off every output (including error messages).

For troubleshooting purposes, it would however it preferrable to at least log error messages. Based on curl(1), this could be achieved with additionally passing -S/--show-error.

Configuration file owner/group incorrect for Debian-based systems

ISSUE TYPE
  • Bug Report
ANSIBLE VERSION
ansible 2.9.6
  config file = None
  configured module search path = ['/Users/christian/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/ansible
  executable location = /Library/Frameworks/Python.framework/Versions/3.8/bin/ansible
  python version = 3.8.2 (v3.8.2:7b3ab5921f, Feb 24 2020, 17:52:18) [Clang 6.0 (clang-600.0.57)]
CONFIGURATION
  • Vanilla Ansible 2.9 installation without modifications
OS / ENVIRONMENT

Apple macOS 10.15.3, but it also applies to other systems.

SUMMARY

Currently, the configuration file owner and group is always icinga which is correct for Red Hat-based systems. Anyhow, Debian-based systems name this user nagios for "historical reasons" - see also the official documentation: https://icinga.com/docs/icinga2/latest/doc/02-installation/#init-script

STEPS TO REPRODUCE

Try to deploy Icinga2 using the example playbook on a Debian system:

- hosts: monitoring-master
  roles:
     - { role: adfinis-sygroup.icinga2_agent }
     - { role: adfinis-sygroup.icinga2_master }
EXPECTED RESULTS

Icinga2 master is installed and enabled.

ACTUAL RESULTS

Installing the configuration files fails due to non-existent users and groups:

TASK [adfinis-sygroup.icinga2_master : install icinga2 configuration] ***************************************************************************************
fatal: [192.168.0.245]: FAILED! => {"changed": false, "checksum": "7952b01c49ff5f2250f3a3ded7458b522608500d", "gid": 116, "group": "icinga", "mode": "0640", "msg": "chown failed: failed to look up user icinga", "owner": "icinga", "path": "/etc/icinga2/icinga2.conf", "size": 1799, "state": "file", "uid": 111}
...

Feature: use a default variable for the recursive include directory

In several descriptions the default value for include_recursive in the icinga2 configuration will be overriden.
it is considered best practice to not mess with defaults from icinga package configuration files in the conf.d.

if you use a different custom directory the structure remains clean after an update. some backup or rpmnew files can be omitted by this practice. maintenance with tools like rpmconf will be easier.

https://github.com/adfinis-sygroup/ansible-role-icinga2_master/blob/4f9482a03b7eb6bfe867bf9e294d6f8890b4706d/templates/etc/icinga2/icinga2.conf.j2#L62

AnsibleUndefinedVariable: 'dict object' has no attribute 'monitoring_sat'

Applying this role with minimal mentioned variables, will result in the following failed task:

TASK [adfinis-sygroup.icinga2_master : create global zones configuration] ******
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ansible.errors.AnsibleUndefinedVariable: 'dict object' has no attribute 'monitoring_sat'
fatal: [icinga2srv01]: FAILED! => {"changed": false, "msg": "AnsibleUndefinedVariable: 'dict object' has no attribute 'monitoring_sat'"}

reason is:
https://github.com/adfinis-sygroup/ansible-role-icinga2_master/blob/4f9482a03b7eb6bfe867bf9e294d6f8890b4706d/templates/etc/icinga2/zones.conf.j2#L36

fixing may include something of the follwing:

  • the template zones.conf.j2 should be more tolerant to missing groups
  • if special groups are required role documentation should have some notes

Make lsb_release a dependency

ISSUE TYPE
  • Bug Report
OS / ENVIRONMENT

Fresh Debian 11 setup

SUMMARY

If lsb_release isn't installed (which is not on Debian 11), the rolewill fail:

fatal: []: FAILED! => {"msg": "The conditional check '(ansible_lsb.id != 'Univention' or ansible_distribution_release != 'stretch')' failed. The error was: error while evaluating conditional ((ansible_lsb.id != 'Univention' or ansible_distribution_release != 'stretch')): 'dict object' has no attribute 'id'\n\nThe error appears to be in '/tmp/semaphore/.ansible/roles/adfinis-sygroup.icinga2_agent/tasks/installation.yml': line 38, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: configure icinga apt repository\n ^ here\n"}
STEPS TO REPRODUCE

Run role against Debian 11 Host

Destination directory /etc/icinga2/zones.d/{{ icinga2_master_client_parent_zone }} does not exist

create all needed directories before

error:

TASK [adfinis-sygroup.icinga2_master : add our own host configuration] *********
failed: [icinga2srv01] (item=icinga2srv01) => {"ansible_loop_var": "item", "changed": false, "checksum": "20247d3d1fafa6dd4783b99d1687f904dfabba07", "item": "icinga2srv01", "msg": "Destination directory /etc/icinga2/zones.d/master does not exist"}

reasons:

Move the zone and host configuration into a single file

ISSUE TYPE
  • Feature Idea
SUMMARY

Currently, runs for around 100 hosts take approximately 1 minute and 15 seconds. This change would remove one template and have both zone and host configuration in one file.

EXPECTED RESULTS

The runs should be faster. mitogen already helps but shorter runs are better.

Why the ZoneName is the inventory_hostname per default for a icinga2 config master?

https://github.com/adfinis-sygroup/ansible-role-icinga2_master/blob/b71d39fabbeb6f03e6f83d585caa82f2a5aa2996/templates/etc/icinga2/constants.conf.j2#L30

Would it not be better to introduce a variable here which might be preinitilized with inventory_hostname but can be overriden?

compare and check with this default? Maybe it should just be this one:

https://github.com/adfinis-sygroup/ansible-role-icinga2_master/blob/5d601c5b15d0146c858fe2485beec97843409a12/defaults/main.yml#L4

Some important templates are missing

ISSUE TYPE
  • Bug Report
ANSIBLE VERSION
ansible 2.9.6
  config file = None
  configured module search path = ['/Users/christian/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/ansible
  executable location = /Library/Frameworks/Python.framework/Versions/3.8/bin/ansible
  python version = 3.8.2 (v3.8.2:7b3ab5921f, Feb 24 2020, 17:52:18) [Clang 6.0 (clang-600.0.57)]
CONFIGURATION
  • Vanilla Ansible 2.9 installation without modifications
OS / ENVIRONMENT

Apple macOS 10.15.3, but it also applies to other systems.

SUMMARY

There are several templates missing in templates.conf in comparison with the upstream templates.conf:

  • generic-host
  • generic-service
  • generic-user
STEPS TO REPRODUCE

Try to deploy Icinga2 using the example playbook on a Debian system:

- hosts: monitoring-master
  roles:
     - { role: adfinis-sygroup.icinga2_agent }
     - { role: adfinis-sygroup.icinga2_master }
EXPECTED RESULTS

Icinga2 master is installed and enabled.

ACTUAL RESULTS

Installing the configuration files fails due to missing templates:

RUNNING HANDLER [adfinis-sygroup.icinga2_master : icinga2_master reload icinga2] ****************************************************************************
fatal: [192.168.0.245]: FAILED! => {"changed": false, "msg": "Unable to reload service icinga2: Job for icinga2.service failed.\nSee \"systemctl status icinga2.service\" and \"journalctl -xe\" for details.\n"}

The status shows that the template generic-user is unknown:

[2020-04-05 11:12:39 +0100] critical/config: Error: Import references unknown template: 'generic-user'
Location: in /etc/icinga2/conf.d/users.conf: 13:3-13:23
/etc/icinga2/conf.d/users.conf(11):
/etc/icinga2/conf.d/users.conf(12): object User "admin" {
/etc/icinga2/conf.d/users.conf(13):   import "generic-user"
                                      ^^^^^^^^^^^^^^^^^^^^^

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.