-
Notifications
You must be signed in to change notification settings - Fork 33
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #204 from Icinga:feature/forward_checks_to_interna…
…l_api Feature: Adds experimental feature for internal API checks Adds experimental feature to forward checks executed by the Icinga Agent to an internal REST-Api, to reduce the performance impact on systems with lower ressources available
- Loading branch information
Showing
19 changed files
with
510 additions
and
77 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| <# | ||
| .SYNOPSIS | ||
| Adds a Cmdlet to an REST-Api endpoint which is either whitelisted or blacklisted. | ||
| Whitelisted Cmdlets can be executed over API endpoints, blacklisted not. | ||
| Use '*' for wildcard matches | ||
| .DESCRIPTION | ||
| Adds a Cmdlet to an REST-Api endpoint which is either whitelisted or blacklisted. | ||
| Whitelisted Cmdlets can be executed over API endpoints, blacklisted not. | ||
| Use '*' for wildcard matches | ||
| .FUNCTIONALITY | ||
| Enables or disables Cmdlets for REST-Api endpoints | ||
| .EXAMPLE | ||
| PS>Add-IcingaFrameworkApiCommand -Command 'Invoke-IcingaCheck*' -Endpoint 'checker'; | ||
| .EXAMPLE | ||
| PS>Add-IcingaFrameworkApiCommand -Command 'Invoke-IcingaCheck*' -Endpoint 'checker' -Blacklist; | ||
| .LINK | ||
| https://github.com/Icinga/icinga-powershell-framework | ||
| #> | ||
|
|
||
| function Add-IcingaFrameworkApiCommand() | ||
| { | ||
| param ( | ||
| [string]$Command = '', | ||
| [string]$Endpoint = '', | ||
| [switch]$Blacklist = $FALSE | ||
| ); | ||
|
|
||
| if ([string]::IsNullOrEmpty($Command) -Or [string]::IsNullOrEmpty($Endpoint)) { | ||
| return; | ||
| } | ||
|
|
||
| $Commands = $null; | ||
| $ConfigPath = ([string]::Format('Framework.RESTApiCommands.{0}.Whitelist', $Endpoint)); | ||
| [array]$Values = @(); | ||
|
|
||
| if ($Blacklist) { | ||
| $ConfigPath = ([string]::Format('Framework.RESTApiCommands.{0}.Blacklist', $Endpoint)); | ||
| } | ||
|
|
||
| $Commands = Get-IcingaPowerShellConfig -Path $ConfigPath; | ||
|
|
||
| if ((Test-IcingaPowerShellConfigItem -ConfigObject $Commands -ConfigKey $Command)) { | ||
| return; | ||
| } | ||
|
|
||
| if ($null -ne $Commands) { | ||
| $Values = $Commands; | ||
| } | ||
|
|
||
| $Values += $Command; | ||
|
|
||
| Set-IcingaPowerShellConfig -Path $ConfigPath -Value $Values; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| <# | ||
| .SYNOPSIS | ||
| Disables the feature to forward all executed checks to an internal | ||
| installed API to run them within a daemon | ||
| .DESCRIPTION | ||
| Disables the feature to forward all executed checks to an internal | ||
| installed API to run them within a daemon | ||
| .FUNCTIONALITY | ||
| Disables the Icinga for Windows Api checks forwarded | ||
| .EXAMPLE | ||
| PS>Disable-IcingaFrameworkApiChecks; | ||
| .LINK | ||
| https://github.com/Icinga/icinga-powershell-framework | ||
| #> | ||
|
|
||
| function Disable-IcingaFrameworkApiChecks() | ||
| { | ||
| Set-IcingaPowerShellConfig -Path 'Framework.Experimental.UseApiChecks' -Value $FALSE; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| <# | ||
| .SYNOPSIS | ||
| Enables the feature to forward all executed checks to an internal | ||
| installed API to run them within a daemon | ||
| .DESCRIPTION | ||
| Enables the feature to forward all executed checks to an internal | ||
| installed API to run them within a daemon | ||
| .FUNCTIONALITY | ||
| Enables the Icinga for Windows Api checks forwarded | ||
| .EXAMPLE | ||
| PS>Enable-IcingaFrameworkApiChecks; | ||
| .LINK | ||
| https://github.com/Icinga/icinga-powershell-framework | ||
| #> | ||
|
|
||
| function Enable-IcingaFrameworkApiChecks() | ||
| { | ||
| Set-IcingaPowerShellConfig -Path 'Framework.Experimental.UseApiChecks' -Value $TRUE; | ||
|
|
||
| Write-IcingaConsoleWarning 'Experimental Feature: Please ensure to install the packages "icinga-powershell-restapi" and "icinga-powershell-apichecks", install the Icinga for Windows background service and also register the daemon with "Register-IcingaBackgroundDaemon -Command {0}". Afterwards all services will be executed by the background daemon in case it is running.' -Objects "'Start-IcingaWindowsRESTApi'"; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| <# | ||
| .SYNOPSIS | ||
| Fetches the current enable/disable state of the feature | ||
| for executing checks of the internal REST-Api | ||
| .DESCRIPTION | ||
| Fetches the current enable/disable state of the feature | ||
| for executing checks of the internal REST-Api | ||
| .FUNCTIONALITY | ||
| Get the current API check execution configuration of the | ||
| Icinga PowerShell Framework | ||
| .EXAMPLE | ||
| PS>Get-IcingaFrameworkApiChecks; | ||
| .LINK | ||
| https://github.com/Icinga/icinga-powershell-framework | ||
| .OUTPUTS | ||
| System.Boolean | ||
| #> | ||
|
|
||
| function Get-IcingaFrameworkApiChecks() | ||
| { | ||
| $CodeCaching = Get-IcingaPowerShellConfig -Path 'Framework.Experimental.UseApiChecks'; | ||
|
|
||
| if ($null -eq $CodeCaching) { | ||
| return $FALSE; | ||
| } | ||
|
|
||
| return $CodeCaching; | ||
| } |
121 changes: 121 additions & 0 deletions
121
lib/core/framework/Invoke-IcingaInternalServiceCall.psm1
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| function Invoke-IcingaInternalServiceCall() | ||
| { | ||
| param ( | ||
| [string]$Command = '', | ||
| [array]$Arguments = @() | ||
| ); | ||
|
|
||
| # If our Framework is running as daemon, never call our api | ||
| if ($global:IcingaDaemonData.FrameworkRunningAsDaemon) { | ||
| return; | ||
| } | ||
|
|
||
| # If the API forward feature is disabled, do nothing | ||
| if ((Get-IcingaFrameworkApiChecks) -eq $FALSE) { | ||
| return; | ||
| } | ||
|
|
||
| # Test our Icinga for Windows service. If the service is not installed or not running, execute the plugin locally | ||
| $IcingaForWindowsService = (Get-Service 'icingapowershell' -ErrorAction SilentlyContinue); | ||
|
|
||
| if ($null -eq $IcingaForWindowsService -Or $IcingaForWindowsService.Status -ne 'Running') { | ||
| return; | ||
| } | ||
|
|
||
| # In case the REST-Api module ist not configured, do nothing | ||
| $BackgroundDaemons = Get-IcingaBackgroundDaemons; | ||
|
|
||
| if ($null -eq $BackgroundDaemons -Or $BackgroundDaemons.ContainsKey('Start-IcingaWindowsRESTApi') -eq $FALSE) { | ||
| return; | ||
| } | ||
|
|
||
| # If neither 'icinga-powershell-restapi' or 'icinga-powershell-apichecks' is installed, execute the plugin locally | ||
| if ((Test-IcingaFunction 'Invoke-IcingaApiChecksRESTCall') -eq $FALSE -Or (Test-IcingaFunction 'Start-IcingaWindowsRESTApi') -eq $FALSE) { | ||
| return; | ||
| } | ||
|
|
||
| $RestApiPort = 5668; | ||
| [int]$Timeout = 30; | ||
| $Daemon = $BackgroundDaemons['Start-IcingaWindowsRESTApi']; | ||
|
|
||
| # Fetch our deamon configuration | ||
| if ($Daemon.ContainsKey('-Port')) { | ||
| $RestApiPort = $Daemon['-Port']; | ||
| } elseif ($Daemon.ContainsKey('Port')) { | ||
| $RestApiPort = $Daemon['Port']; | ||
| } | ||
| if ($Daemon.ContainsKey('-Timeout')) { | ||
| $Timeout = $Daemon['-Timeout']; | ||
| } elseif ($Daemon.ContainsKey('Timeout')) { | ||
| $Timeout = $Daemon['Timeout']; | ||
| } | ||
|
|
||
| Enable-IcingaUntrustedCertificateValidation -SuppressMessages; | ||
|
|
||
| [hashtable]$CommandArguments = @{ }; | ||
| [hashtable]$DebugArguments = @{ }; | ||
| [hashtable]$ConvertedArgs = @{ }; | ||
| [int]$ArgumentIndex = 0; | ||
|
|
||
| # Resolve our array arguments provided by $args and build proper check arguments | ||
| while ($ArgumentIndex -lt $Arguments.Count) { | ||
| $Value = $Arguments[$ArgumentIndex]; | ||
| [string]$Argument = [string]$Value; | ||
| $ArgumentValue = $null; | ||
|
|
||
| if ($Value[0] -eq '-') { | ||
| if (($ArgumentIndex + 1) -lt $Arguments.Count) { | ||
| [string]$NextValue = $Arguments[$ArgumentIndex + 1]; | ||
| if ($NextValue[0] -eq '-') { | ||
| $ArgumentValue = $TRUE; | ||
| } else { | ||
| $ArgumentValue = $Arguments[$ArgumentIndex + 1]; | ||
| } | ||
| } else { | ||
| $ArgumentValue = $TRUE; | ||
| } | ||
| } else { | ||
| $ArgumentIndex += 1; | ||
| continue; | ||
| } | ||
|
|
||
| $Argument = $Argument.Replace('-', ''); | ||
|
|
||
| $ConvertedArgs.Add($Argument, $ArgumentValue); | ||
| $ArgumentIndex += 1; | ||
| } | ||
|
|
||
| # Now queue the check inside our REST-Api | ||
| try { | ||
| $ApiResult = Invoke-WebRequest -Method POST -UseBasicParsing -Uri ([string]::Format('https://localhost:{0}/v1/checker?command={1}', $RestApiPort, $Command)) -Body ($CommandArguments | ConvertTo-Json -Depth 100) -ContentType 'application/json' -TimeoutSec $Timeout; | ||
| } catch { | ||
| # Something went wrong -> fallback to local execution | ||
| $ExMsg = $_.Exception.message; | ||
| # Fallback to execute plugin locally | ||
| Write-IcingaEventMessage -Namespace 'Framework' -EventId 1553 -Objects $ExMsg, $Command, $DebugArguments; | ||
| return; | ||
| } | ||
|
|
||
| # Resolve our result from the API | ||
| $IcingaResult = ConvertFrom-Json -InputObject $ApiResult; | ||
| $IcingaCR = ''; | ||
|
|
||
| # In case we didn't receive a check result, fallback to local execution | ||
| if ($null -eq $IcingaResult.$Command.checkresult) { | ||
| Write-IcingaEventMessage -Namespace 'Framework' -EventId 1553 -Objects 'The check result for the executed command was empty', $Command, $DebugArguments; | ||
| return; | ||
| } | ||
|
|
||
| $IcingaCR = ($IcingaResult.$Command.checkresult.Replace("`r`n", "`n")); | ||
|
|
||
| if ($IcingaResult.$Command.perfdata.Count -ne 0) { | ||
| $IcingaCR += ' | '; | ||
| foreach ($perfdata in $IcingaResult.$Command.perfdata) { | ||
| $IcingaCR += $perfdata; | ||
| } | ||
| } | ||
|
|
||
| # Print our response and exit with the provide exit code | ||
| Write-IcingaConsolePlain $IcingaCR; | ||
| exit $IcingaResult.$Command.exitcode; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| <# | ||
| .SYNOPSIS | ||
| Removes a Cmdlet from an REST-Api endpoints whitelist or blacklist. | ||
| .DESCRIPTION | ||
| Removes a Cmdlet from an REST-Api endpoints whitelist or blacklist. | ||
| .FUNCTIONALITY | ||
| Removes Cmdlets for REST-Api endpoints | ||
| .EXAMPLE | ||
| PS>Remove-IcingaFrameworkApiCommand -Command 'Invoke-IcingaCheck*' -Endpoint 'checker'; | ||
| .EXAMPLE | ||
| PS>Add-IcingaFrameworkApiCommand -Command 'Invoke-IcingaCheck*' -Endpoint 'checker' -Blacklist; | ||
| .LINK | ||
| https://github.com/Icinga/icinga-powershell-framework | ||
| #> | ||
|
|
||
| function Remove-IcingaFrameworkApiCommand() | ||
| { | ||
| param ( | ||
| [string]$Command = '', | ||
| [string]$Endpoint = '', | ||
| [switch]$Blacklist = $FALSE | ||
| ); | ||
|
|
||
| if ([string]::IsNullOrEmpty($Command) -Or [string]::IsNullOrEmpty($Endpoint)) { | ||
| return; | ||
| } | ||
|
|
||
| $Commands = $null; | ||
| $ConfigPath = ([string]::Format('Framework.RESTApiCommands.{0}.Whitelist', $Endpoint)); | ||
| [array]$Values = @(); | ||
|
|
||
| if ($Blacklist) { | ||
| $ConfigPath = ([string]::Format('Framework.RESTApiCommands.{0}.Blacklist', $Endpoint)); | ||
| } | ||
|
|
||
| $Commands = Get-IcingaPowerShellConfig -Path $ConfigPath; | ||
|
|
||
| if ($null -eq $Commands) { | ||
| return; | ||
| } | ||
|
|
||
| foreach ($element in $Commands) { | ||
| if ($element.ToLower() -ne $Command.ToLower()) { | ||
| $Values += $element; | ||
| } | ||
| } | ||
|
|
||
| Set-IcingaPowerShellConfig -Path $ConfigPath -Value $Values; | ||
| } |
Oops, something went wrong.