Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

put in many changes for new nagios server

Browse source
This commit is contained in:
Stephen Smoogen 2017-04-06 23:50:44 +00:00
parent 8cd3f46eb2
commit dfd088ab5e
23 changed files with 52 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

1
inventory/group_vars/value
View file

@ -18,6 +18,7 @@ custom_rules: [
'-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT',
# Needed to let nagios on noc01 and noc02 pipe alerts to zodbot here
'-A INPUT -p tcp -m tcp -s 10.5.126.41 --dport 5050 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 10.5.126.241 --dport 5050 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 192.168.1.20 --dport 5050 -j ACCEPT',
# batcave01 also needs access to announce commits.
'-A INPUT -p tcp -m tcp -s 10.5.126.23 --dport 5050 -j ACCEPT',

4
inventory/group_vars/value-stg
View file

@ -16,8 +16,10 @@ custom_rules: [
# Neeed for rsync from log01 for logs.
'-A INPUT -p tcp -m tcp -s 10.5.126.13 --dport 873 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 192.168.1.59 --dport 873 -j ACCEPT',
# Needed to let nagios on noc01 and noc02 pipe alerts to zodbot here
# Needed to let nagios on noc01 and noc02 (nagios01/noc01.stg) pipe alerts to zodbot here
'-A INPUT -p tcp -m tcp -s 10.5.126.41 --dport 5050 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 10.5.126.241 --dport 5050 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 10.5.126.2 --dport 5050 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 152.19.134.192 --dport 5050 -j ACCEPT',
# batcave01 also needs access to announce commits.
'-A INPUT -p tcp -m tcp -s 10.5.126.23 --dport 5050 -j ACCEPT',

3
inventory/host_vars/db-fas01.phx2.fedoraproject.org
View file

@ -40,8 +40,9 @@ custom_rules: [
# basset01
'-A INPUT -p tcp -m tcp -s 10.5.126.194 --dport 5432 -j ACCEPT',
# sundries02...
# sundries ??? but this is noc01?
'-A INPUT -p tcp -m tcp -s 10.5.126.41 --dport 5432 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 10.5.126.241 --dport 5432 -j ACCEPT',
# hosted03 and hosted04 (over the vpn)
'-A INPUT -p tcp -m tcp -s 192.168.1.16 --dport 5432 -j ACCEPT',

8
inventory/host_vars/db-koji01.phx2.fedoraproject.org
View file

@ -30,7 +30,13 @@ kernel_shmmax: 68719476736
#
# Only allow postgresql access from the frontend node.
#
custom_rules: [ '-A INPUT -p tcp -m tcp -s 10.5.125.59 --dport 5432 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.5.125.60 --dport 5432 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.5.125.61 --dport 5432 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.5.125.62 --dport 5432 -j ACCEPT', '-A INPUT -p tcp -m tcp -s 10.5.126.41 --dport 5432 -j ACCEPT' ]
custom_rules: [
'-A INPUT -p tcp -m tcp -s 10.5.125.59 --dport 5432 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 10.5.125.60 --dport 5432 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 10.5.125.61 --dport 5432 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 10.5.125.62 --dport 5432 -j ACCEPT',
'-A INPUT -p tcp -m tcp -s 10.5.126.41 --dport 5432 -j ACCEPT',
]
#
# Large updates pushes cause lots of db threads doing the tag moves, so up this from default.

4
playbooks/groups/nagios-new.yml
View file

@ -22,6 +22,8 @@
- fas_client
- collectd/base
- sudo
- { role: openvpn/client,
when: env != "staging" }
- mod_wsgi
- role: keytab/service
owner_user: apache
@ -37,7 +39,7 @@
- include: "{{ handlers }}/restart_services.yml"
- name: deploy nagios service config
hosts: nagios-stg
hosts: nagios-new-stg:nagios-new
user:
gather_facts: True

5
playbooks/groups/osbs-cluster.yml
View file

@ -722,5 +722,8 @@
shell: "oc import-image fedora --all"
when: env == "production" and hostvars[groups["osbs-masters"][0]]["docker_pull_fedora"]|changed
- name: enable nrpe for monitoring
- name: enable nrpe for monitoring (noc01)
iptables: action=insert chain=INPUT destination_port=5666 protocol=tcp source=10.5.126.41 state=present jump=ACCEPT
- name: enable nrpe for monitoring (nagios01)
iptables: action=insert chain=INPUT destination_port=5666 protocol=tcp source=10.5.126.241 state=present jump=ACCEPT

2
roles/base/templates/iptables/iptables
View file

@ -26,10 +26,12 @@
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging-friendly'] %}
#

2
roles/base/templates/iptables/iptables.download-phx2
View file

@ -19,10 +19,12 @@
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging-friendly'] %}
#

2
roles/base/templates/iptables/iptables.jenkins.fedorainfracloud.org
View file

@ -42,10 +42,12 @@ COMMIT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging-friendly'] %}
#

2
roles/base/templates/iptables/iptables.ns03.phx2.fedoraproject.org
View file

@ -26,10 +26,12 @@
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging-friendly'] %}
#

2
roles/base/templates/iptables/iptables.ns04.phx2.fedoraproject.org
View file

@ -26,10 +26,12 @@
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging-friendly'] %}
#

2
roles/base/templates/iptables/iptables.openqa-tap-workers
View file

@ -26,10 +26,12 @@
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging-friendly'] %}
#

2
roles/base/templates/iptables/iptables.openstack-compute
View file

@ -33,10 +33,12 @@
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}

2
roles/base/templates/iptables/iptables.osuosl
View file

@ -31,10 +31,12 @@
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
# if the host/group defines incoming tcp_ports - allow them
{% if tcp_ports is defined %}

2
roles/base/templates/iptables/iptables.pgbdr01.stg.phx2.fedoraproject.org
View file

@ -38,10 +38,12 @@ COMMIT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.2 -j ACCEPT
# if the host declares a fedmsg-enabled wsgi app, open ports for it

2
roles/base/templates/iptables/iptables.pgbdr02.stg.phx2.fedoraproject.org
View file

@ -38,10 +38,12 @@ COMMIT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.2 -j ACCEPT
# if the host declares a fedmsg-enabled wsgi app, open ports for it

2
roles/base/templates/iptables/iptables.releng
View file

@ -29,10 +29,12 @@ COMMIT
# Overwrite any global rules
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp -s 192.168.1.10 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 192.168.1.166 --dport 5666 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp -s 209.132.181.102 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 209.132.181.35 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 10.5.126.41 --dport 5666 -j ACCEPT
-A INPUT -p tcp -m tcp -s 10.5.126.241 --dport 5666 -j ACCEPT
# if the blocked_ips is defined - drop them
{% if blocked_ips is defined %}

2
roles/base/templates/iptables/iptables.staging
View file

@ -40,10 +40,12 @@ COMMIT
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.2 -j ACCEPT
# if the host declares a fedmsg-enabled wsgi app, open ports for it

2
roles/base/templates/iptables/iptables.torrent02.fedoraproject.org
View file

@ -26,10 +26,12 @@
# for nrpe - allow it from nocs
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.10 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 192.168.1.166 -j ACCEPT
# FIXME - this is the global nat-ip and we need the noc01-specific ip
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.102 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 209.132.181.35 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.41 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5666 -s 10.5.126.241 -j ACCEPT
{% if env != 'staging' and datacenter == 'phx2' and inventory_hostname not in groups['staging-friendly'] %}
#

4
roles/nagios/client/templates/nrpe.cfg.j2
View file

@ -80,9 +80,9 @@ nrpe_group=nrpe
{% if env == "staging" %}
allowed_hosts=10.5.126.2,10.5.126.41,192.168.1.10,192.168.1.20,209.132.181.35
allowed_hosts=10.5.126.2,10.5.126.41,10.5.126.241,192.168.1.10,192.168.1.20,209.132.181.35,192.168.1.166
{% else %}
allowed_hosts=10.5.126.41,192.168.1.10,192.168.1.20,209.132.181.35
allowed_hosts=10.5.126.41,192.168.1.10,192.168.1.20,209.132.181.35,10.5.126.241,192.168.1.166
{% endif %}

2
roles/nagios/server/files/nrpe.cfg
View file

@ -70,7 +70,7 @@ nrpe_group=nrpe
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
#allowed_hosts=127.0.0.1,192.168.0.2
allowed_hosts=10.5.126.41,127.0.0.1,192.168.1.10,192.168.1.20,209.132.181.35
allowed_hosts=10.5.126.41,10.5.126.241,127.0.0.1,192.168.1.10,192.168.1.20,209.132.181.35,192.168.1.166

4
roles/nagios_client/templates/nrpe.cfg.j2
View file

@ -79,9 +79,9 @@ nrpe_group=nrpe
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
{% if env == "staging" %}
allowed_hosts=10.5.126.2,10.5.126.41,192.168.1.10,192.168.1.20,209.132.181.35
allowed_hosts=10.5.126.2,10.5.126.41,10.5.126.241,192.168.1.10,192.168.1.20,209.132.181.35,192.168.1.166
{% else %}
allowed_hosts=10.5.126.41,192.168.1.10,192.168.1.20,209.132.181.35
allowed_hosts=10.5.126.41,10.5.126.241,192.168.1.10,192.168.1.20,209.132.181.35,192.168.1.166
{% endif %}

2
roles/nagios_server/files/nrpe/nrpe.cfg
View file

@ -96,7 +96,7 @@ nrpe_group=nrpe
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
#allowed_hosts=127.0.0.1,192.168.0.2
allowed_hosts=10.5.126.2,10.5.126.41,127.0.0.1,192.168.1.10,192.168.1.20,209.132.181.35
allowed_hosts=10.5.126.2,10.5.126.41,10.5.126.241,127.0.0.1,192.168.1.10,192.168.1.20,192.168.1.166,209.132.181.35