Andrew Bogott has submitted this change and it was merged. (
https://gerrit.wikimedia.org/r/334658 )
Change subject: Move keystone icinga checks to nrpe on labnet1001
......................................................................
Move keystone icinga checks to nrpe on labnet1001
Bug: T157760
Change-Id: I98cecd9d65b5452add633109a72a22e16c0bf0a2
---
M modules/icinga/manifests/plugins.pp
D modules/icinga/templates/check_commands/check_keystone_projects.cfg.erb
D modules/icinga/templates/check_commands/check_keystone_roles.cfg.erb
R modules/openstack/files/check_keystone_projects.py
R modules/openstack/files/check_keystone_roles.py
A modules/openstack/manifests/keystonechecks.pp
M modules/role/manifests/labs/openstack/nova/network.pp
7 files changed, 50 insertions(+), 36 deletions(-)
Approvals:
Andrew Bogott: Looks good to me, approved
jenkins-bot: Verified
diff --git a/modules/icinga/manifests/plugins.pp
b/modules/icinga/manifests/plugins.pp
index 2571321..f6dd97e 100644
--- a/modules/icinga/manifests/plugins.pp
+++ b/modules/icinga/manifests/plugins.pp
@@ -73,18 +73,6 @@
group => 'root',
mode => '0755',
}
- file { '/usr/lib/nagios/plugins/check_keystone_roles':
- source => 'puppet:///modules/icinga/check_keystone_roles.py',
- owner => 'root',
- group => 'root',
- mode => '0755',
- }
- file { '/usr/lib/nagios/plugins/check_keystone_projects':
- source => 'puppet:///modules/icinga/check_keystone_projects.py',
- owner => 'root',
- group => 'root',
- mode => '0755',
- }
file { '/usr/lib/nagios/plugins/check_mysql-replication.pl':
source => 'puppet:///modules/icinga/check_mysql-replication.pl',
owner => 'root',
@@ -162,22 +150,6 @@
nagios_common::check_command::config { 'check_wikitech_static.cfg':
ensure => present,
content =>
template('icinga/check_commands/check_wikitech_static.cfg.erb'),
- config_dir => '/etc/icinga',
- owner => 'icinga',
- group => 'icinga',
- }
-
- nagios_common::check_command::config { 'check_keystone_roles.cfg':
- ensure => present,
- content =>
template('icinga/check_commands/check_keystone_roles.cfg.erb'),
- config_dir => '/etc/icinga',
- owner => 'icinga',
- group => 'icinga',
- }
-
- nagios_common::check_command::config { 'check_keystone_projects.cfg':
- ensure => present,
- content =>
template('icinga/check_commands/check_keystone_projects.cfg.erb'),
config_dir => '/etc/icinga',
owner => 'icinga',
group => 'icinga',
diff --git
a/modules/icinga/templates/check_commands/check_keystone_projects.cfg.erb
b/modules/icinga/templates/check_commands/check_keystone_projects.cfg.erb
deleted file mode 100644
index b46b349..0000000
--- a/modules/icinga/templates/check_commands/check_keystone_projects.cfg.erb
+++ /dev/null
@@ -1,4 +0,0 @@
-define command{
- command_name check_keystone_projects
- command_line $USER1$/check_keystone_projects $ARG1$ $ARG2$ $ARG3$
-}
diff --git
a/modules/icinga/templates/check_commands/check_keystone_roles.cfg.erb
b/modules/icinga/templates/check_commands/check_keystone_roles.cfg.erb
deleted file mode 100644
index 2ffc201..0000000
--- a/modules/icinga/templates/check_commands/check_keystone_roles.cfg.erb
+++ /dev/null
@@ -1,4 +0,0 @@
-define command{
- command_name check_keystone_roles
- command_line $USER1$/check_keystone_roles $ARG1$ $ARG2$ $ARG3$
-}
diff --git a/modules/icinga/files/check_keystone_projects.py
b/modules/openstack/files/check_keystone_projects.py
similarity index 100%
rename from modules/icinga/files/check_keystone_projects.py
rename to modules/openstack/files/check_keystone_projects.py
diff --git a/modules/icinga/files/check_keystone_roles.py
b/modules/openstack/files/check_keystone_roles.py
similarity index 100%
rename from modules/icinga/files/check_keystone_roles.py
rename to modules/openstack/files/check_keystone_roles.py
diff --git a/modules/openstack/manifests/keystonechecks.pp
b/modules/openstack/manifests/keystonechecks.pp
new file mode 100644
index 0000000..7864031
--- /dev/null
+++ b/modules/openstack/manifests/keystonechecks.pp
@@ -0,0 +1,48 @@
+# == Class: openstack::keystonechecks
+# NRPE checks to make sure that the right keystone projects
+# exist and that projects have the proper service users.
+#
+# This also checks the functionality of the keystone API generally.
+class openstack::keystonechecks() {
+ include ::openstack::clientlib
+
+ # Script to check all keystone projects for a given user and role
+ file { '/usr/local/bin/check_keystone_roles.py':
+ ensure => present,
+ source => 'puppet:///modules/openstack/check_keystone_roles.py',
+ mode => '0755',
+ owner => 'root',
+ group => 'root',
+ }
+
+ # Script to make sure that service projects e.g. 'admin'
+ # exist.
+ file { '/usr/local/bin/check_keystone_projects.py':
+ ensure => present,
+ source => 'puppet:///modules/openstack/check_keystone_projects.py',
+ mode => '0755',
+ owner => 'root',
+ group => 'root',
+ }
+
+ # Make sure 'novaobserver' has 'observer' everywhere
+ nrpe::monitor_service { 'check-novaobserver-membership':
+ nrpe_command => '/usr/local/bin/check_keystone_roles.py novaobserver
observer',
+ description => 'novaobserver has only observer role',
+ require => File['/usr/local/bin/check_keystone_roles.py'],
+ }
+
+ # Make sure 'novaadmin' has 'projectadmin' and 'user' everywhere
+ nrpe::monitor_service { 'check-novaadmin-membership':
+ nrpe_command => '/usr/local/bin/check_keystone_roles.py novaadmin user
projectadmin',
+ description => 'novaadmin has roles in every project',
+ require => File['/usr/local/bin/check_keystone_roles.py'],
+ }
+
+ # Verify service projects
+ nrpe::monitor_service { 'check-keystone-projects':
+ nrpe_command => '/usr/local/bin/check_keystone_projects.py',
+ description => 'Keystone admin and observer projects exist',
+ require => File['/usr/local/bin/check_keystone_roles.py'],
+ }
+}
diff --git a/modules/role/manifests/labs/openstack/nova/network.pp
b/modules/role/manifests/labs/openstack/nova/network.pp
index 96d6468..4593741 100644
--- a/modules/role/manifests/labs/openstack/nova/network.pp
+++ b/modules/role/manifests/labs/openstack/nova/network.pp
@@ -5,6 +5,8 @@
include role::labs::openstack::nova::common
$novaconfig = $role::labs::openstack::nova::common::novaconfig
+ include ::openstack::keystonechecks
+
interface::ip { 'openstack::network_service_public_dynamic_snat':
interface => 'lo',
address => $novaconfig['network_public_ip'],
--
To view, visit https://gerrit.wikimedia.org/r/334658
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I98cecd9d65b5452add633109a72a22e16c0bf0a2
Gerrit-PatchSet: 5
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Faidon Liambotis <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
