| Dir : /proc/self/root/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/ |
| Server: Linux ngx353.inmotionhosting.com 4.18.0-553.22.1.lve.1.el8.x86_64 #1 SMP Tue Oct 8 15:52:54 UTC 2024 x86_64 IP: 209.182.202.254 |
| Dir : //proc/self/root/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/icinga2.py |
"""
Icinga2 state
=============
.. versionadded:: 2017.7.0
:depends: - Icinga2 Python module
:configuration: See :py:mod:`salt.modules.icinga2` for setup instructions.
The icinga2 module is used to execute commands.
Its output may be stored in a file or in a grain.
.. code-block:: yaml
command_id:
icinga2.generate_ticket:
- name: domain.tld
- output: "/tmp/query_id.txt"
"""
import os.path
import salt.utils.files
import salt.utils.stringutils
from salt.utils.icinga2 import get_certs_path
def __virtual__():
"""
Only load if the icinga2 module is available in __salt__
"""
if "icinga2.generate_ticket" in __salt__:
return True
return (False, "icinga2 module could not be loaded")
def generate_ticket(name, output=None, grain=None, key=None, overwrite=True):
"""
Generate an icinga2 ticket on the master.
name
The domain name for which this ticket will be generated
output
grain: output in a grain
other: the file to store results
None: output to the result comment (default)
grain:
grain to store the output (need output=grain)
key:
the specified grain will be treated as a dictionary, the result
of this state will be stored under the specified key.
overwrite:
The file or grain will be overwritten if it already exists (default)
"""
ret = {"name": name, "changes": {}, "result": True, "comment": ""}
# Checking if execution is needed.
if output == "grain":
if grain and not key:
if not overwrite and grain in __salt__["grains.ls"]():
ret["comment"] = "No execution needed. Grain {} already set".format(
grain
)
return ret
elif __opts__["test"]:
ret["result"] = None
ret["comment"] = (
"Ticket generation would be executed, storing result in grain: {}".format(
grain
)
)
return ret
elif grain:
if grain in __salt__["grains.ls"]():
grain_value = __salt__["grains.get"](grain)
else:
grain_value = {}
if not overwrite and key in grain_value:
ret["comment"] = "No execution needed. Grain {}:{} already set".format(
grain, key
)
return ret
elif __opts__["test"]:
ret["result"] = None
ret["comment"] = (
"Ticket generation would be executed, storing result in grain:"
" {}:{}".format(grain, key)
)
return ret
else:
ret["result"] = False
ret["comment"] = "Error: output type 'grain' needs the grain parameter\n"
return ret
elif output:
if not overwrite and os.path.isfile(output):
ret["comment"] = f"No execution needed. File {output} already set"
return ret
elif __opts__["test"]:
ret["result"] = None
ret["comment"] = (
"Ticket generation would be executed, storing result in file: {}".format(
output
)
)
return ret
elif __opts__["test"]:
ret["result"] = None
ret["comment"] = "Ticket generation would be executed, not storing result"
return ret
# Executing the command.
ticket_res = __salt__["icinga2.generate_ticket"](name)
ticket = ticket_res["stdout"]
if not ticket_res["retcode"]:
ret["comment"] = str(ticket)
if output == "grain":
if grain and not key:
__salt__["grains.setval"](grain, ticket)
ret["changes"]["ticket"] = f"Executed. Output into grain: {grain}"
elif grain:
if grain in __salt__["grains.ls"]():
grain_value = __salt__["grains.get"](grain)
else:
grain_value = {}
grain_value[key] = ticket
__salt__["grains.setval"](grain, grain_value)
ret["changes"]["ticket"] = "Executed. Output into grain: {}:{}".format(
grain, key
)
elif output:
ret["changes"]["ticket"] = f"Executed. Output into {output}"
with salt.utils.files.fopen(output, "w") as output_file:
output_file.write(salt.utils.stringutils.to_str(ticket))
else:
ret["changes"]["ticket"] = "Executed"
return ret
def generate_cert(name):
"""
Generate an icinga2 certificate and key on the client.
name
The domain name for which this certificate and key will be generated
"""
ret = {"name": name, "changes": {}, "result": True, "comment": ""}
cert = f"{get_certs_path()}{name}.crt"
key = f"{get_certs_path()}{name}.key"
# Checking if execution is needed.
if os.path.isfile(cert) and os.path.isfile(key):
ret["comment"] = (
"No execution needed. Cert: {} and key: {} already generated.".format(
cert, key
)
)
return ret
if __opts__["test"]:
ret["result"] = None
ret["comment"] = "Certificate and key generation would be executed"
return ret
# Executing the command.
cert_save = __salt__["icinga2.generate_cert"](name)
if not cert_save["retcode"]:
ret["comment"] = "Certificate and key generated"
ret["changes"]["cert"] = f"Executed. Certificate saved: {cert}"
ret["changes"]["key"] = f"Executed. Key saved: {key}"
return ret
def save_cert(name, master):
"""
Save the certificate on master icinga2 node.
name
The domain name for which this certificate will be saved
master
Icinga2 master node for which this certificate will be saved
"""
ret = {"name": name, "changes": {}, "result": True, "comment": ""}
cert = f"{get_certs_path()}trusted-master.crt"
# Checking if execution is needed.
if os.path.isfile(cert):
ret["comment"] = f"No execution needed. Cert: {cert} already saved."
return ret
if __opts__["test"]:
ret["result"] = None
ret["comment"] = "Certificate save for icinga2 master would be executed"
return ret
# Executing the command.
cert_save = __salt__["icinga2.save_cert"](name, master)
if not cert_save["retcode"]:
ret["comment"] = "Certificate for icinga2 master saved"
ret["changes"]["cert"] = f"Executed. Certificate saved: {cert}"
return ret
def request_cert(name, master, ticket, port="5665"):
"""
Request CA certificate from master icinga2 node.
name
The domain name for which this certificate will be saved
master
Icinga2 master node for which this certificate will be saved
ticket
Authentication ticket generated on icinga2 master
port
Icinga2 port, defaults to 5665
"""
ret = {"name": name, "changes": {}, "result": True, "comment": ""}
cert = f"{get_certs_path()}ca.crt"
# Checking if execution is needed.
if os.path.isfile(cert):
ret["comment"] = f"No execution needed. Cert: {cert} already exists."
return ret
if __opts__["test"]:
ret["result"] = None
ret["comment"] = "Certificate request from icinga2 master would be executed"
return ret
# Executing the command.
cert_request = __salt__["icinga2.request_cert"](name, master, ticket, port)
if not cert_request["retcode"]:
ret["comment"] = "Certificate request from icinga2 master executed"
ret["changes"]["cert"] = f"Executed. Certificate requested: {cert}"
return ret
ret["comment"] = "FAILED. Certificate requested failed with output: {}".format(
cert_request["stdout"]
)
ret["result"] = False
return ret
def node_setup(name, master, ticket):
"""
Setup the icinga2 node.
name
The domain name for which this certificate will be saved
master
Icinga2 master node for which this certificate will be saved
ticket
Authentication ticket generated on icinga2 master
"""
ret = {"name": name, "changes": {}, "result": True, "comment": ""}
cert = f"{get_certs_path()}{name}.crt.orig"
key = f"{get_certs_path()}{name}.key.orig"
# Checking if execution is needed.
if os.path.isfile(cert) and os.path.isfile(cert):
ret["comment"] = "No execution needed. Node already configured."
return ret
if __opts__["test"]:
ret["result"] = None
ret["comment"] = "Node setup will be executed."
return ret
# Executing the command.
node_setup = __salt__["icinga2.node_setup"](name, master, ticket)
if not node_setup["retcode"]:
ret["comment"] = "Node setup executed."
ret["changes"]["cert"] = "Node setup finished successfully."
return ret
ret["comment"] = "FAILED. Node setup failed with outpu: {}".format(
node_setup["stdout"]
)
ret["result"] = False
return ret