The playbooks in ansible/ install and configure the plugin on
one or more Icinga2 hosts, using either a native installation or Docker. They also
create the CheckCommand and Service objects described in Icinga
Director and Icinga2 / Nagios.
This page is the short version. ansible/README.md is
the reference, and it is the file kept in step with the roles themselves.
- Automated deployment with Ansible
- Which role to use
- Quick start
- Configuring the check
- Before you commit a change to the role
Which role to use
| Role | Installs | Use it when |
|---|---|---|
opencloud_check_native |
The plugin into a dedicated virtualenv, symlinked into the Nagios plugin directory | The monitoring host has Python and you want the fewest moving parts |
opencloud_check_docker |
The image, built on the target host and invoked as docker run |
You would rather not install Python packages on the monitoring host |
Both roles write the same Icinga2 objects, so a host can be moved from one to the other without rewriting the service definition.
Quick start
cd ansible
cp inventory.example.ini inventory.ini
$EDITOR inventory.ini # the Icinga2 hosts, and opencloud_check_host per host
# Native (virtualenv) install:
ansible-playbook -i inventory.ini playbooks/deploy_native.yml
# ... or the Docker install:
ansible-galaxy collection install -r requirements.yml
ansible-playbook -i inventory.ini playbooks/deploy_docker.yml
The playbooks are idempotent, so re-running one is also how you upgrade: the plugin version and the Icinga2 objects are both converged every time.
Configuring the check
Every setting is an opencloud_check_* variable, mapping one-to-one onto the
COS_* environment variables and CLI flags in the
options table. A realistic host entry:
[icinga_hosts]
monitoring.example.com
[icinga_hosts:vars]
opencloud_check_host=opencloud.example.com
opencloud_check_port=9200
opencloud_check_check_hardening=true
opencloud_check_update_warning=true
opencloud_check_interval=24h
opencloud_check_host defaults to inventory_hostname, which is right when
the monitoring agent runs on the OpenCloud host itself and wrong in most other
cases - set it explicitly.
Leave opencloud_check_interval at 24h or higher. Each run is a real scan
against a real instance rather than a cached lookup, and nothing about an
instance's rating changes from minute to minute.
Every other option of the CheckCommand - --eol-warning, --release-track, --ignore-hardening and the rest - is set through opencloud_check_extra_vars, a map from the custom variable name without its opencloud_ prefix to its value; a list repeats the flag once per element.
opencloud_check_extra_vars={"eol_warning": 30, "ignore_hardening": ["hstsPreload"]}
The full variable table, including the ones specific to each role, is in
ansible/README.md.
Before you commit a change to the role
ansible-lint is only clean when run from inside ansible/; from the
repository root it reports dozens of false positives.
cd ansible
ansible-lint
ansible-playbook -i inventory.ini playbooks/deploy_native.yml --syntax-check