OpenCloud Security Scanner Logo Security scan for OpenCloud

CLI documentation

OpenCloud Security Scanner in Icinga Director

Import OpenCloud security check commands, fields, and apply rules into Icinga Director.

Icinga Director manages CheckCommand, Service Template, and Service objects through its web UI instead of hand-written config files. The steps below work for either the native install or the Docker image.

  1. Create the Command - Navigate to Icinga Director → Commands → Add. - Command name: check_opencloud_security - Command:

    • Native install: /usr/lib/nagios/plugins/check-opencloud-security (wherever you installed/symlinked it, see Installation).
    • Docker: /usr/bin/docker (see the Docker CheckCommand example for the required fixed arguments run, --rm, and the image name).
    • Command type: Plugin Check Command.

  2. Add the arguments on the same Command object (Fields tab → Add argument):

Argument Value Description
--host $address$ (or a custom Director Data Field, e.g. $opencloud_host$) OpenCloud hostname, IP or URL, required
--port Data Field $opencloud_port$, optional Port, e.g. 9200
--insecure Set-if Data Field $opencloud_insecure$ (boolean), optional Self-signed instance
--proxy Data Field $opencloud_proxy$, optional HTTP/HTTPS proxy
--debug Set-if Data Field $opencloud_debug$ (boolean), optional Verbose debug output

These are the common ones. Every other option, with its variable name, is in contrib/icinga2/check_opencloud_security.conf; add those the same way.

For each optional argument, tick Skip this argument on empty value so Director omits the flag entirely when the field isn't set.

  1. Expose the fields to services by defining matching Data Fields under the Command (Fields tab → Add data field), e.g. opencloud_host, opencloud_port, opencloud_insecure, opencloud_debug - then set their Data Type (String or Boolean) and Var Filter as needed.

  2. Create a Service Template - Icinga Director → Service Templates → Add. - Check command: check_opencloud_security. - Check interval: 24h is a good default; see the note under Icinga2 / Nagios before going much lower. - Leave the Data Fields empty here so they can be filled in per service/host.

  3. Apply it to a host or host group - Icinga Director → Services → Add (or a Service Apply Rule for a whole host group). - Import the Service Template created above. - Fill in opencloud_host (or rely on $address$ if you didn't override it) and any optional fields. - Deploy the configuration from Icinga Director → Deployments.

Once deployed, Icinga2 invokes the command exactly as described in the Icinga2 / Nagios section, whether that resolves to the native binary or docker run under the hood.

To have the Service object written for you from a configuration you just made, with its thresholds and release track already filled in, run check-opencloud-scanner configure --export-monitoring icinga - see configure. It still needs the CheckCommand from step 1.

To deploy the same objects without the web UI, see Automated deployment with Ansible.

Back to the documentation index | Back to the main README