[WIP] Complete rework of the role to simplify distributed site setup #53

ganto · 2017-04-13T16:42:38Z

This is an elaboration on how to solve the setup of distributed sites as discussed in #45. It is still a work in progress but mostly functional.

I choose a new approach in setting up and connecting the distributed sites. Previously the host running the site was responsible for configuring and setting up the site. However, the chosen approach was limited to one site per server and required a cumbersome manual configuration for connecting multiple sites to a distributed site setup (check e.g. #41).

This PR introduces a new way. The distributed site setup is mainly configured on the host running the master site. Like this it will hold most information required to setup and synchronized with the slave sites. This makes it mostly transparent if the site is running on the master site server or another one.

Those changes required an adjustment of the checkmk_server__distributed_sites format. Now it will accept a list of master (and their slave) sites. The simplest possible configuration for a two server setup (server01/server02), where server01 is running the master and server02 a slave site, would look as following. Enable the debops-contrib.checkmk_server role on both servers, then set the following values in the inventory:

Define a slave site in the host_vars/server01:

checkmk_server__distributed_sites:
  - name: 'slave'
    delegate_to: 'server02'

Disable the default site in the host_vars/server02:

checkmk_server__site: False

Eventually run the provided checkmk_server.yml playbook on both servers. This would create the default site on server01 and add a slave site (called slave) on the second server. The entire user account/password, URL, network port, synchronization configuration is completely transparent to the user.

Technically this is solved by a checkmk_server/env sub-role which is mostly responsible for generating a facts file on server01 and server02 which then can be used by the playbook and subsequent tasks for their individual site configuration. Additionally a lot of tasks which need on server02 which need in-depth knowledge about server01 or the master site are triggered from the master server via delegate_to tasks.

The chosen setup further allows an easy solution for fixing #44. However, when testing and investigation Check_MK in the course of writing this code, I found another maybe much more elegant way to handle the site config synchronization. More on that later...

In the next few days I will cleanup the documentation, fix the still missing debops.apache dependency, try to cleanup the macros and leverage the official DebOps macros and provide a simple Vagrant setup to simplify testing and debugging for me and potential users. Stay tuned.

ypid · 2017-04-13T18:40:37Z

defaults/main.yml

@@ -162,8 +160,7 @@ checkmk_server__webapi_url: '{{ checkmk_server__site_url + "/check_mk/webapi.py"
 # :ref:`checkmk_server__ref_omd_config` for more details.
 checkmk_server__omd_config: '{{
  checkmk_server__omd_config_email +
-  checkmk_server__omd_config_core +
-  (checkmk_server__omd_config_livestatus if checkmk_server__multisite_livestatus|d() else [])
+  checkmk_server__omd_config_core
 }}'


I was just looking into this when I saw your PR. I would propose to change this list to a dict.

What would be the advantage?

It is much more flexible to make changes to the final dict on various Ansible variable levels. That is what various core roles like debops.ferm debops.ifupdown are switching to or have already switched to. Refer to this example: https://github.com/debops-contrib/ansible-volkszaehler/blob/72f6a79c434d1d4c665a581506bc221507ee4608/defaults/main.yml#L383-L478

Ok, I'll keep that in mind. Will still need to have a look at your DebOps macros anyway

This allows easier access from the slave sites without a forced dependency on the hostname of the master.

…sites'

ganto · 2017-04-19T04:48:36Z

I rebased my patchset on current master to include all the recent feature and documentation updates.

…stency

ypid · 2017-04-21T06:45:27Z

defaults/main.yml

+# Configuration for debops.apache_ Ansible role.
+checkmk_server__apache__dependent_vhosts:
+  - name: '{{ checkmk_server__fqdn }}'
+    by_role: 'debops-contrib.checkmk_server'


NIce work! I guess the Apache omd snippet could be disabled and instead be included in checkmk_server__apache__dependent_vhosts to ensure that omd is only available for this vhost.

Ya, I thought about that, but I wasn't sure how to properly do this. To add the snipped to the vhost I guess I have to define include: '/omd/apache/*.conf' but how do I get rid of the conf-enabled/zzz_omd.conf?

Something like:

checkmk_server__apache__dependent_snippets: 'zzz_omd': enabled: False

should do.

For the vhost, item.include: [ '/omd/apache/*.conf' ] can be tried.

Added the snippet configuration as you suggested. However, it fails with:

TASK [debops.apache : Create conf-available snippets] ******************************************************************************************** [...] failed: [cmk01] (item={'key': u'zzz_omd', 'value': {u'enabled': False}}) => { "failed": true, "item": { "key": "zzz_omd", "value": { "enabled": false } }, "msg": "Unable to find 'etc/apache2/conf-available/zzz_omd.conf.j2' in expected paths." }

I didn't find a successful way to tell the role that this configuration is provided externally. Any suggestion?

My mistake, excuse me. Try:

checkmk_server__apache__dependent_snippets: 'zzz_omd': enabled: False type: 'dont-create'

type: 'dont-create' is there specifically for your usecase, as documented 😉
Have you seen the nice documenteion of the role btw? Ref: https://docs.debops.org/en/latest/ansible/roles/ansible-apache/docs/

Ack, my bad. I read the documentation, but not far enough 😉 I had in mind there is only raw and divert. I guess I was a bit confused by the following sentence:

Type: raw

Available when ``item.type`` is set to ``raw`` or ``divert``.

…t_rules'

ypid · 2017-05-18T22:02:18Z

meta/main.yml

@@ -11,14 +11,21 @@ galaxy_info:
  author: Reto Gantenbein
  description: 'Setup Check_MK monitoring server'
  license: 'GPL-3.0'
-  min_ansible_version: '2.1.5'
+  min_ansible_version: '2.3.0'


Any reason to drop 2.2 support as well? a3a149a does not mention one.

True, I didn't mention the reason here. Actually, I was bitten by ansible/ansible#14542. Ansible 2.3.0 fixed the issue for me. As mentioned in the linked PR it wasn't fixed in the 2.2.x tree back then and I never tried to find a release who does. 2.3.0 is the safe choice. Will update the commit message accordingly.

Lower Ansible versions might suffer from Ansible issue #14542. Version 2.3.0 has been tested to solve the issue.

ganto · 2017-05-19T05:19:55Z

In the mean time I achieved to satisfy the repospec test-suite. It will pass when being run from my own repository (which still misses 466e8bd). The results can be found at travis-ci.org: ganto/checkmk_server (branch distributed-rework). Once this PR is ready for merge, I will update debops/test-suite which should make it pass here too.

The etc/ansible/facts.d/checkmk_server.j2 template is cleaned up now. Next will be the lookup/checkmk_server__sites.j2 which again might shake up the entire configuration layout a bit.

ypid · 2018-03-11T17:53:43Z

@ganto Do you know when you can finish this PR? I would still like to look into the latest version of the role and make changes to it :)

ganto · 2018-04-13T06:14:05Z

@ypid What changes to you have in mind?

At the moment my development activity on this role is stalled. I realized that my approach would also write down the login secrets for the site synchronization as clear text local ansible facts. That definitely shouldn't be. 👎

Maybe I find again some time to work on it in the next few months...

ypid · 2018-04-18T22:09:25Z

What changes to you have in mind?

What ever is necessary. I would just like to have a clean state of the role so that I could propose bigger changes/reworks if I want to without causing pain with rebasing or stuff like this.

ypid reviewed Apr 13, 2017

View reviewed changes

This was referenced Apr 13, 2017

Rework ganto/ansible-checkmk_server#1

Open

Rework master #54

Merged

ganto added 17 commits April 18, 2017 07:38

Remove unneeded variables

5075df2

Add current status of site creation

66259aa

Fix 'multisite_password', set required 'multisite_alias'

ee665af

Set credential paths related to the inventory name instead of fqdn

7b8dbc2

This allows easier access from the slave sites without a forced dependency on the hostname of the master.

Convert user setup to run for distributed sites in 'checkmk_servers__…

821688e

…sites'

Iterate user setup tasks over all distributed sites

21a2bfa

Make distributed site login and config work with new site definition

2954cc2

Remove unused variables

231d06e

Create new env sub-role for site setup, write site facts

9128633

Adjust home that it matches the user created by 'omd'

3ea7723

Use user__dependent_accounts and etc_services__dependent_list from facts

333b001

Make sure the checkmk_server/env tasks are run by all play hosts

6b8fd58

Leverage ssh key setup from debops.users role, set public key local fact

1737762

Read correct facts after changes, add SSH authorized_keys setup

81f078a

Add users to 'sshusers' group which allows SSH login

a726abf

Run config synchronization to slave site via rsync

81810fd

Update playbook to use the 'checkmk_server/env' and 'debops.users' roles

e51f79f

ganto force-pushed the distributed-rework branch from 432e67d to e51f79f Compare April 19, 2017 04:44

ganto mentioned this pull request Apr 19, 2017

Rework 4 debops-contrib/ansible-checkmk_agent#28

Merged

ganto added 3 commits April 21, 2017 08:15

Rename 'checkmk_server__hostname' to 'checkmk_server__fqdn' for consi…

0d0a2fb

…stency

Fix applying custom patches, remove env role debugging

5b01f6c

Leverage 'debops.apache' role for local reverse proxy configuration

bae1222

ypid reviewed Apr 21, 2017

View reviewed changes

ganto added 3 commits April 26, 2017 18:58

Explicitly define Apache configuration includes provided by Check_MK

53c1e53

Remove HTTP-related ferm rules now handled by 'apache__ferm__dependen…

97aceb8

…t_rules'

Generate ferm rules for livestatus according to the configured sites

1924a7a

ganto added 9 commits May 4, 2017 19:07

Fix 'apache__dependent_snippets' configuration

5635218

Remove some debugging code

b2c4951

Define dependent vars in defaults, don't fail with no facts

af9d305

Run tests on Ubuntu trusty as precise is EOL

cdfb4e3

Create master site if 'checkmk_server__site' is defined

c5717d4

Don't fail if 'mod_headers' is not (yet) enabled

35bc317

Properly set and update local facts from the correct context

e641ae7

Adjust the fact that local facts are stored as dict not lists

5bc3e41

Adjust SSH public key lookup to new facts layout

5c0a5da

ypid reviewed May 18, 2017

View reviewed changes

Update dependency to Ansible >=2.3.0

6a5c4f5

Lower Ansible versions might suffer from Ansible issue #14542. Version 2.3.0 has been tested to solve the issue.

Clarify comments in the local facts template

4d0e8ca

ganto force-pushed the distributed-rework branch from a3a149a to 4d0e8ca Compare May 19, 2017 05:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] Complete rework of the role to simplify distributed site setup #53

[WIP] Complete rework of the role to simplify distributed site setup #53

ganto commented Apr 13, 2017

ypid Apr 13, 2017

ganto Apr 19, 2017

ypid Apr 19, 2017 •

edited

Loading

ganto Apr 19, 2017

ganto commented Apr 19, 2017

ypid Apr 21, 2017

ganto Apr 21, 2017

ypid Apr 21, 2017

ganto May 4, 2017

ypid May 4, 2017

ganto May 4, 2017

ypid May 18, 2017

ganto May 19, 2017

ganto commented May 19, 2017 •

edited

Loading

ypid commented Mar 11, 2018

ganto commented Apr 13, 2018

ypid commented Apr 18, 2018 •

edited

Loading

[WIP] Complete rework of the role to simplify distributed site setup #53

Are you sure you want to change the base?

[WIP] Complete rework of the role to simplify distributed site setup #53

Conversation

ganto commented Apr 13, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ypid Apr 19, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ganto commented Apr 19, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ganto commented May 19, 2017 • edited Loading

ypid commented Mar 11, 2018

ganto commented Apr 13, 2018

ypid commented Apr 18, 2018 • edited Loading

ypid Apr 19, 2017 •

edited

Loading

ganto commented May 19, 2017 •

edited

Loading

ypid commented Apr 18, 2018 •

edited

Loading