Skip to content

Commit 1acff23

Browse files
NapstyNapsty
authored
Add api-token check type, output fix in local-certs check, fix --help (#46)
1 parent 8f6e1fb commit 1acff23

File tree

3 files changed

+79
-19
lines changed

3 files changed

+79
-19
lines changed

‎check_rancher2.sh

Lines changed: 46 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
# You should have received a copy of the GNU General Public License along with this #
1919
# program; if not, see <https://www.gnu.org/licenses/>. #
2020
# #
21-
# Copyright 2018-2023 Claudio Kuenzler #
21+
# Copyright 2018-2023,2025 Claudio Kuenzler #
2222
# Copyright 2020 Matthias Kneer #
2323
# Copyright 2021-2023 Steffen Eichler #
2424
# Copyright 2021 lopf #
@@ -54,6 +54,7 @@
5454
# 20230110 1.11.0 Allow ignoring workload names, provisioning cluster not critical (#39) #
5555
# 20230202 1.12.0 Add local-certs check type #
5656
# 20231208 1.12.1 Use 'command -v' instead of 'which' for required command check #
57+
# 20250613 1.13.0 Add api-token check type, output fix in local-certs check, fix --help #
5758
##########################################################################################
5859
# (Pre-)Define some fixed variables
5960
STATE_OK=0 # define the exit code if status is OK
@@ -62,7 +63,7 @@ STATE_CRITICAL=2 # define the exit code if status is Critical
6263
STATE_UNKNOWN=3 # define the exit code if status is Unknown
6364
export PATH=/usr/local/bin:/usr/bin:/bin:$PATH # Set path
6465
proto=http # Protocol to use, default is http, can be overwritten with -S parameter
65-
version=1.12.1
66+
version=1.13.0
6667
##########################################################################################
6768
# functions
6869

@@ -152,7 +153,7 @@ function convertPods()
152153
# We all need help from time to time
153154
usage ()
154155
{
155-
printf "check_rancher2 v ${version} (c) 2018-2023 Claudio Kuenzler and contributers (published under GPLv2)
156+
printf "check_rancher2 v ${version} (c) 2018-2025 Claudio Kuenzler and contributers (published under GPLv2)
156157
Usage: $0 -H Rancher2Address -U user-token -P password [-S] -t checktype [-c cluster] [-p project] [-n namespace] [-w workload] [-o pod]
157158
158159
Options:
@@ -174,7 +175,8 @@ Options:
174175
\t[ --memory-crit ] Exit with CRITICAL status if more than PERCENT of mem capacity is used (supported check types: node, cluster)
175176
\t[ --pods-warn ] Exit with WARNING status if more than PERCENT of pod capacity is used (supported check types: node, cluster)
176177
\t[ --pods-crit ] Exit with CRITICAL status if more than PERCENT of pod capacity is used (supported check types: node, cluster)
177-
\t[ --cert-warn ] Warning threshold in days to warn before a certificate expires (supported check types: local-certs)
178+
\t[ --cert-warn ] DEPRECATED, use --expiry-warn
179+
\t[ --expiry-warn ] Warning threshold in days to warn before a local certificate or API token expires (supported check types: local-certs, api-token)
178180
\t[ -h | --help ] Help. I need somebody. Help. Not just anybody. Heeeeeelp!
179181
180182
Check Types:
@@ -185,6 +187,7 @@ Check Types:
185187
\tworkload -> Checks the current status of all or a specific (-w workloadname) workload within a project (-p projectid must be set!)
186188
\tpod -> Checks the current status of all or a specific (-o podname -n namespace) pod within a project (-p projectid must be set!)
187189
\tlocal-certs -> Checks the current status of all internal Rancher certificates (e.g. rancher-webhook) in local cluster under the System project (namespace: cattle-system)
190+
\tapi-token -> Checks the expiry of the API token used for this plugin
188191
"
189192
exit ${STATE_UNKNOWN}
190193
}
@@ -197,7 +200,7 @@ for cmd in jq curl; do
197200
fi
198201
done
199202
#########################################################################
200-
PARSED_ARGUMENTS=$(getopt -a -n check_rancher2 -o H:U:P:t:c:p:n:w:o:Ssi:h --long apihost:,apiuser:,apipass:,type:,clustername:,projectname:,namespacename:,workloadname:,podname:,secure,selfsigned,ignore:,cpu-warn:,cpu-crit:,memory-warn:,memory-crit:,pods-warn:,pods-crit:,cert-warn: -- "$@")
203+
PARSED_ARGUMENTS=$(getopt -a -n check_rancher2 -o H:U:P:t:c:p:n:w:o:Ssi:h --long apihost:,apiuser:,apipass:,type:,clustername:,projectname:,namespacename:,workloadname:,podname:,secure,selfsigned,ignore:,cpu-warn:,cpu-crit:,memory-warn:,memory-crit:,pods-warn:,pods-crit:,cert-warn:,expiry-warn:,help -- "$@")
201204
VALID_ARGUMENTS=$?
202205
if [ "$VALID_ARGUMENTS" != "0" ]; then
203206
usage
@@ -225,7 +228,8 @@ while :; do
225228
--memory-crit) memory_crit=${2} ; shift 2 ;;
226229
--pods-warn) pods_warn=${2} ; shift 2 ;;
227230
--pods-crit) pods_crit=${2} ; shift 2 ;;
228-
--cert-warn) cert_warn=${2} ; shift 2 ;;
231+
--cert-warn) expiry_warn=${2} ; shift 2 ;;
232+
--expiry-warn) expiry_warn=${2} ; shift 2 ;;
229233
--) shift; break ;;
230234
-h | --help) usage;;
231235
*) echo "Unexpected option: $1 - this should not happen. Please consult --help for valid options."
@@ -1191,7 +1195,7 @@ fi
11911195
# --- local-certs --- #
11921196
local-certs)
11931197
rightnow=$(date +%s)
1194-
if [[ ${cert_warn} -gt 0 ]]; then let warning=(${rightnow}+${cert_warn}*86400); fi
1198+
if [[ ${expiry_warn} -gt 0 ]]; then let warning=(${rightnow}+${expiry_warn}*86400); fi
11951199
projectid=$(curl -s ${selfsigned} -u "${apiuser}:${apipass}" "${proto}://${apihost}/v3/cluster/local/projects" | jq -r '.data[] | select(.name == "System").id')
11961200

11971201
api_out_certs=$(curl -s ${selfsigned} -u "${apiuser}:${apipass}" "${proto}://${apihost}/v3/projects/${projectid}/namespacedcertificates?namespaceId=cattle-system")
@@ -1213,7 +1217,7 @@ for entry in ${cert_expiry[*]}; do
12131217
cert_expired[${i}]="${cert_names[${i}]} expired ${diff} days ago -"
12141218
elif [[ ${warning} -gt ${expiry} ]]; then
12151219
let diff=(${warning}-${expiry})/86400
1216-
echo "${cert_names[${i}]} will expire in ${diff} days -"
1220+
#echo "${cert_names[${i}]} will expire in ${diff} days -" # Enable for debugging
12171221
cert_warning[${i}]="${cert_names[${i}]} will expire in ${diff} days -"
12181222
fi
12191223
let i++
@@ -1236,6 +1240,40 @@ fi
12361240

12371241
;;
12381242

1243+
# --- api-token --- #
1244+
api-token)
1245+
rightnow=$(date +%s)
1246+
if [[ ${expiry_warn} -gt 0 ]]; then let warning=(${rightnow}+${expiry_warn}*86400); fi
1247+
api_out_token=$(curl -s ${selfsigned} -u "${apiuser}:${apipass}" "${proto}://${apihost}/v3/tokens/${apiuser}")
1248+
description=$(echo "$api_out_token" | jq -r '.description')
1249+
expired=$(echo "$api_out_token" | jq -r '.expired')
1250+
expiredate=$(echo "$api_out_token" | jq -r '.expiresAt')
1251+
1252+
if [[ -n ${description} ]]; then token_description="(${description}) "; fi
1253+
1254+
# Check for expired token (usually this should never show up b/c access to Rancher API is already revoked)
1255+
if [[ ${expired} == true ]]; then
1256+
echo "CHECK_RANCHER2 CRITICAL - API Token for Rancher monitoring has expired"
1257+
exit ${STATE_CRITICAL}
1258+
fi
1259+
1260+
if [[ -n ${expiredate} && ${expiredate} != "" ]]; then
1261+
# Check expiry
1262+
token_expiry=$(date --date="${expiredate}" +%s)
1263+
let diff=(${token_expiry}-${rightnow})/86400
1264+
if [[ ${warning} -gt ${token_expiry} ]]; then
1265+
echo "CHECK_RANCHER2 WARNING - API Token ${token_description}will expire in ${diff} days"
1266+
exit ${STATE_WARNING}
1267+
else
1268+
echo "CHECK_RANCHER2 OK - API Token ${token_description}still valid (will expire in ${diff} days)"
1269+
exit ${STATE_OK}
1270+
fi
1271+
else
1272+
echo "CHECK_RANCHER2 OK - API Token ${token_description}does not expire"
1273+
exit ${STATE_OK}
1274+
fi
1275+
;;
1276+
12391277
esac
12401278
echo "UNKNOWN: should never reach this part"
12411279
exit ${STATE_UNKNOWN}

‎icinga2/command_check_rancher2.conf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,9 @@ object CheckCommand "check_rancher2" {
7777
description = "Exit with CRITICAL status if more than PERCENT of pod capacity is used (currently only supported in cluster specific node and cluster check type)"
7878
value = "$rancher2_pods_crit$"
7979
}
80-
"--cert-warn" = {
81-
description = "Warning threshold in days to warn before a certificate expires (supported check types: local-certs)"
82-
value = "$rancher2_cert_warn$"
80+
"--expiry-warn" = {
81+
description = "Warning threshold in days to warn before a certificate or API token expires (supported check types: local-certs, api-token)"
82+
value = "$rancher2_expiry_warn$"
8383
}
8484
"-h" = {
8585
description = "Help. I need somebody. Help. Not just anybody. Heeeeeelp!"

‎icinga2/example_service_checks.conf

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ object Service "Rancher2 Info" {
1414
host_name = "my-rancher2-host"
1515
check_command = "check_rancher2"
1616
vars.rancher2_username = "token-XXXXX"
17-
vars.rancher2_password = "iWahca3ohngeiReedeingaiiWahca3ohngeiReedeingai432k1dda"
17+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
1818
vars.rancher2_ssl = true
1919
vars.rancher2_type = "info"
2020
}
@@ -25,7 +25,7 @@ object Service "Rancher2 All Clusters" {
2525
host_name = "my-rancher2-host"
2626
check_command = "check_rancher2"
2727
vars.rancher2_username = "token-XXXXX"
28-
vars.rancher2_password = "iWahca3ohngeiReedeingaiiWahca3ohngeiReedeingai432k1dda"
28+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
2929
vars.rancher2_ssl = true
3030
vars.rancher2_type = "cluster"
3131
}
@@ -36,7 +36,7 @@ object Service "Rancher2 Cluster Test" {
3636
host_name = "my-rancher2-host"
3737
check_command = "check_rancher2"
3838
vars.rancher2_username = "token-XXXXX"
39-
vars.rancher2_password = "iWahca3ohngeiReedeingaiiWahca3ohngeiReedeingai432k1dda"
39+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
4040
vars.rancher2_ssl = true
4141
vars.rancher2_type = "cluster"
4242
vars.rancher2_cluster = "c-4kd22"
@@ -48,7 +48,7 @@ object Service "Rancher2 Nodes" {
4848
host_name = "my-rancher2-host"
4949
check_command = "check_rancher2"
5050
vars.rancher2_username = "token-XXXXX"
51-
vars.rancher2_password = "iWahca3ohngeiReedeingaiiWahca3ohngeiReedeingai432k1dda"
51+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
5252
vars.rancher2_ssl = true
5353
vars.rancher2_type = "node"
5454
vars.rancher2_ignore_status = "cordoned,drained"
@@ -60,7 +60,7 @@ object Service "Rancher2 All Projects" {
6060
host_name = "my-rancher2-host"
6161
check_command = "check_rancher2"
6262
vars.rancher2_username = "token-XXXXX"
63-
vars.rancher2_password = "iWahca3ohngeiReedeingaiiWahca3ohngeiReedeingai432k1dda"
63+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
6464
vars.rancher2_ssl = true
6565
vars.rancher2_type = "project"
6666
}
@@ -71,7 +71,7 @@ object Service "Rancher2 Project Test" {
7171
host_name = "my-rancher2-host"
7272
check_command = "check_rancher2"
7373
vars.rancher2_username = "token-XXXXX"
74-
vars.rancher2_password = "iWahca3ohngeiReedeingaiiWahca3ohngeiReedeingai432k1dda"
74+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
7575
vars.rancher2_ssl = true
7676
vars.rancher2_type = "project"
7777
vars.rancher2_project = "c-4kd22:p-44gjh"
@@ -83,7 +83,7 @@ object Service "Rancher2 Workloads in Project Test" {
8383
host_name = "my-rancher2-host"
8484
check_command = "check_rancher2"
8585
vars.rancher2_username = "token-XXXXX"
86-
vars.rancher2_password = "iWahca3ohngeiReedeingaiiWahca3ohngeiReedeingai432k1dda"
86+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
8787
vars.rancher2_ssl = true
8888
vars.rancher2_type = "workload"
8989
vars.rancher2_project = "c-4kd22:p-44gjh"
@@ -95,11 +95,33 @@ object Service "Rancher2 Workload Web in Project Test" {
9595
host_name = "my-rancher2-host"
9696
check_command = "check_rancher2"
9797
vars.rancher2_username = "token-XXXXX"
98-
vars.rancher2_password = "iWahca3ohngeiReedeingaiiWahca3ohngeiReedeingai432k1dda"
98+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
9999
vars.rancher2_ssl = true
100100
vars.rancher2_type = "workload"
101101
vars.rancher2_project = "c-4kd22:p-44gjh"
102102
vars.rancher2_workload = "Web"
103103
}
104104

105+
# Check expiry of Rancher local-certs
106+
object Service "Rancher2 internal certificates" {
107+
import "generic-service"
108+
host_name = "my-rancher2-host"
109+
check_command = "check_rancher2"
110+
vars.rancher2_username = "token-XXXXX"
111+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
112+
vars.rancher2_ssl = true
113+
vars.rancher2_type = "local-certs"
114+
vars.rancher2_expiry_warn = "30"
115+
}
105116

117+
# Check expiry of used API token
118+
object Service "Rancher2 Monitoring API Token" {
119+
import "generic-service"
120+
host_name = "my-rancher2-host"
121+
check_command = "check_rancher2"
122+
vars.rancher2_username = "token-XXXXX"
123+
vars.rancher2_password = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
124+
vars.rancher2_ssl = true
125+
vars.rancher2_type = "api-token"
126+
vars.rancher2_expiry_warn = "30"
127+
}

0 commit comments

Comments
 (0)