sensu-plugins-consul 2.1.1 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d9abedafc80a6a95bf6308a962080fa105058b28a3837feccf845457f4d6d115
-  data.tar.gz: ca315bf2270588c875288ed24d8c036608919785a406a93b9a71609da92cd921
+  metadata.gz: bd87ab15cda8e6d0cf6bb707400ea7ea3c06de15e3a61ef30879bbbb8339dd17
+  data.tar.gz: 29912ea95c1f1a217c67db3ccacadf53a398cdddedaa75bd8c9211b8350a7b82
 SHA512:
-  metadata.gz: d0f7784298275404d97983841c9eec49d18c148742d13d19a4532fa59d70d9046373a33930d95249ed6173ec809ced0ddb52d3b63580e5968793389de8eb0931
-  data.tar.gz: 62774bc2bb5bd8842f0becc96630425b52fd7e3fc0618e01abdc19940bd9162ceae4fdbec193e79877af33d11427be4cf4a51ad92f60d50bfe054e25ffd0321e
+  metadata.gz: aa4e77c4eee82eb047d4bc09c0c307111cc0bba12664bdcc1b022e914436c3ce38b970c2f34a3013a85d197eda02aa6ddfc93c18d0dcd26e5151df32efcff607
+  data.tar.gz: 5bccd93afe1a40063d4bdcc37ed390927bcc5c5a7740b21181fc82bf7e315f41bb453e6beba2fd34db1f08b2503fee89b3e3f2b0a5e767c91bf7a5c8e2c069db

data/CHANGELOG.md

@@ -5,6 +5,10 @@ This CHANGELOG follows the format listed [here](https://github.com/sensu-plugins
 
 ## [Unreleased]
 
+## [2.2.0] - 2018-06-11
+### Added
+- add ACL support to all consul checks except `check-consul-quorum.rb` (@scalp42)
+
 ## [2.1.1] - 2018-05-31
 ### Fixed
 - `check-consul-leader.rb`: Timeout option must be an integer (@scalp42)
@@ -128,7 +132,8 @@ This CHANGELOG follows the format listed [here](https://github.com/sensu-plugins
 ### Added
 - initial release
 
-[Unreleased]: https://github.com/sensu-plugins/sensu-plugins-consul/compare/2.1.1...HEAD
+[Unreleased]: https://github.com/sensu-plugins/sensu-plugins-consul/compare/2.2.0...HEAD
+[2.2.0]: https://github.com/sensu-plugins/sensu-plugins-consul/compare/2.1.1...2.2.0
 [2.1.1]: https://github.com/sensu-plugins/sensu-plugins-consul/compare/2.1.0...2.1.1
 [2.1.0]: https://github.com/sensu-plugins/sensu-plugins-consul/compare/2.0.1...2.1.0
 [2.0.1]: https://github.com/sensu-plugins/sensu-plugins-consul/compare/2.0.0...2.0.1

data/bin/check-consul-failures.rb

@@ -59,8 +59,16 @@ class ConsulStatus < Sensu::Plugin::Check::CLI
          boolean: true,
          default: false
 
+  option :token,
+         description: 'ACL token',
+         long: '--token ACL_TOKEN'
+
   def run
-    r = RestClient::Resource.new("#{config[:scheme]}://#{config[:server]}:#{config[:port]}/v1/agent/members", timeout: 5).get
+    r = RestClient::Resource.new(
+      "#{config[:scheme]}://#{config[:server]}:#{config[:port]}/v1/agent/members",
+      timeout: 5,
+      headers: { 'X-Consul-Token' => config[:token] }
+    ).get
     if r.code == 200
       failing_nodes = JSON.parse(r).find_all { |node| node['Status'] == 4 }
       if !failing_nodes.nil? && !failing_nodes.empty?
@@ -69,7 +77,11 @@ class ConsulStatus < Sensu::Plugin::Check::CLI
           nodes_names.push(node['Name'])
           next if config[:keep_failures]
           puts "Removing failed node: #{node['Name']}"
-          RestClient::Resource.new("#{config[:scheme]}://#{config[:server]}:#{config[:port]}/v1/agent/force-leave/#{node['Name']}", timeout: 5).get
+          RestClient::Resource.new(
+            "#{config[:scheme]}://#{config[:server]}:#{config[:port]}/v1/agent/force-leave/#{node['Name']}",
+            timeout: 5,
+            headers: { 'X-Consul-Token' => config[:token] }
+          ).get
           nodes_names.delete(node['Name'])
         end
         ok 'All clear' if nodes_names.empty?

data/bin/check-consul-kv-ttl.rb

@@ -60,7 +60,6 @@ class CheckConsulKvTTL < Sensu::Plugin::Check::CLI
          description: 'kv namespace to pull data from',
          short: '-k NAMESPACE',
          long: '--kv NAMESPACE',
-         default: nil,
          required: true
 
   option :json,
@@ -95,17 +94,28 @@ class CheckConsulKvTTL < Sensu::Plugin::Check::CLI
          proc: proc { |a| a.to_i },
          default: 60
 
+  option :token,
+         description: 'ACL token',
+         long: '--token ACL_TOKEN'
+
   # Do work
   def run
     Diplomat.configure do |dip|
       dip.url = config[:consul]
+      dip.acl_token = config[:token]
     end
 
     begin
       # Retrieve the kv
       data = Diplomat::Kv.get(config[:kv])
-    rescue Faraday::ResourceNotFound
-      critical "Key/Value(#{config[:kv]}) pair does not exist in Consul."
+    rescue Faraday::ResourceNotFound, Diplomat::KeyNotFound
+      critical %(Key/value pair "#{config[:kv]}" does not exist in Consul.)
+    rescue Diplomat::UnknownStatus => e
+      if e.message.include?('403')
+        critical %(ACL token is not authorized to access "#{config[:kv]}")
+      else
+        critical "Unhandled exception(#{e.class}) -- #{e.message}"
+      end
     rescue Exception => e # rubocop:disable Lint/RescueException
       critical "Unhandled exception(#{e.class}) -- #{e.message}"
     end

data/bin/check-consul-leader.rb

@@ -74,6 +74,10 @@ class ConsulStatus < Sensu::Plugin::Check::CLI
          proc: proc { |t| t.to_i },
          default: 5
 
+  option :token,
+         description: 'ACL token',
+         long: '--token ACL_TOKEN'
+
   def valid_ip(ip)
     case ip.to_s
     when Resolv::IPv4::Regex
@@ -100,7 +104,8 @@ class ConsulStatus < Sensu::Plugin::Check::CLI
   def run
     options = { timeout: config[:timeout],
                 verify_ssl: (OpenSSL::SSL::VERIFY_NONE if defined? config[:insecure]),
-                ssl_ca_file: (config[:capath] if defined? config[:capath]) }
+                ssl_ca_file: (config[:capath] if defined? config[:capath]),
+                headers: { 'X-Consul-Token' => config[:token] } }
     url = "#{config[:scheme]}://#{config[:server]}:#{config[:port]}/v1/status/leader"
 
     r = RestClient::Resource.new(url, options).get

data/bin/check-consul-maintenance.rb

@@ -47,6 +47,10 @@ class MaintenanceStatus < Sensu::Plugin::Check::CLI
          long: '--node NODE',
          default: 'localhost'
 
+  option :token,
+         description: 'ACL token',
+         long: '--token ACL_TOKEN'
+
   # Get the maintenance data for the node from consul
   #
   def acquire_maintenance_data
@@ -60,8 +64,14 @@ class MaintenanceStatus < Sensu::Plugin::Check::CLI
     end
   rescue Faraday::ConnectionFailed => e
     warning "Connection error occurred: #{e}"
+  rescue Faraday::ClientError => e
+    if e.response[:status] == 403
+      critical %(ACL token is not authorized to access resource: #{e.response[:body]})
+    else
+      unknown "Exception occurred when checking consul service: #{e}"
+    end
   rescue StandardError => e
-    unknown "Exception occurred when checking consul node maintenace: #{e}"
+    unknown "Exception occurred when checking consul node maintenance: #{e}"
   end
 
   # Main function
@@ -69,6 +79,12 @@ class MaintenanceStatus < Sensu::Plugin::Check::CLI
   def run
     Diplomat.configure do |dc|
       dc.url = config[:consul]
+      dc.acl_token = config[:token]
+      dc.options = {
+        headers: {
+          'X-Consul-Token' => config[:token]
+        }
+      }
     end
 
     data = acquire_maintenance_data

data/bin/check-consul-members.rb

@@ -94,11 +94,16 @@ class ConsulStatus < Sensu::Plugin::Check::CLI
          long: '--timeout TIMEOUT_IN_SECONDS',
          default: 5
 
+  option :token,
+         description: 'ACL token',
+         long: '--token ACL_TOKEN'
+
   def run
     url = "#{config[:scheme]}://#{config[:server]}:#{config[:port]}/v1/agent/members"
     options = { timeout: config[:timeout],
                 verify_ssl: (OpenSSL::SSL::VERIFY_NONE if defined? config[:insecure]),
-                ssl_ca_file: (config[:capath] if defined? config[:capath]) }
+                ssl_ca_file: (config[:capath] if defined? config[:capath]),
+                headers: { 'X-Consul-Token' => config[:token] } }
 
     if config[:wan]
       url += '?wan=1'

data/bin/check-consul-servers.rb

@@ -88,11 +88,16 @@ class ConsulStatus < Sensu::Plugin::Check::CLI
          proc: proc(&:to_i),
          default: 5
 
+  option :token,
+         description: 'ACL token',
+         long: '--token ACL_TOKEN'
+
   def run
     url = "#{config[:scheme]}://#{config[:server]}:#{config[:port]}/v1/status/peers"
     options = { timeout: config[:timeout],
                 verify_ssl: (OpenSSL::SSL::VERIFY_NONE if defined? config[:insecure]),
-                ssl_ca_file: (config[:capath] if defined? config[:capath]) }
+                ssl_ca_file: (config[:capath] if defined? config[:capath]),
+                headers: { 'X-Consul-Token' => config[:token] } }
 
     json = RestClient::Resource.new(url, options).get
     peers = JSON.parse(json).length.to_i

data/bin/check-consul-service-health.rb

@@ -70,6 +70,10 @@ class CheckConsulServiceHealth < Sensu::Plugin::Check::CLI
          short: '-f',
          long: '--fail-if-not-found'
 
+  option :token,
+         description: 'ACL token',
+         long: '--token ACL_TOKEN'
+
   # Get the service checks for the given service
   def acquire_service_data
     if config[:tags] && config[:service]
@@ -109,6 +113,12 @@ class CheckConsulServiceHealth < Sensu::Plugin::Check::CLI
 
     Diplomat.configure do |dc|
       dc.url = config[:consul]
+      dc.acl_token = config[:token]
+      dc.options = {
+        headers: {
+          'X-Consul-Token' => config[:token]
+        }
+      }
     end
 
     found      = false

data/bin/check-service-consul.rb

@@ -63,6 +63,10 @@ class ServiceStatus < Sensu::Plugin::Check::CLI
          short: '-f',
          long: '--fail-if-not-found'
 
+  option :token,
+         description: 'ACL token',
+         long: '--token ACL_TOKEN'
+
   # Get the check data for the service from consul
   #
   def acquire_service_data
@@ -82,6 +86,18 @@ class ServiceStatus < Sensu::Plugin::Check::CLI
     end
   rescue Faraday::ConnectionFailed => e
     warning "Connection error occurred: #{e}"
+  rescue Diplomat::UnknownStatus => e
+    if e.message.include?('403')
+      critical %(ACL token is not authorized to access service "#{config[:service]}")
+    else
+      critical "Unhandled exception(#{e.class}) -- #{e.message}"
+    end
+  rescue Faraday::ClientError => e
+    if e.response[:status] == 403
+      critical %(ACL token is not authorized to access service "#{config[:service]}": #{e.response[:body]})
+    else
+      unknown "Exception occurred when checking consul service: #{e}"
+    end
   rescue StandardError => e
     unknown "Exception occurred when checking consul service: #{e}"
   end
@@ -95,6 +111,12 @@ class ServiceStatus < Sensu::Plugin::Check::CLI
 
     Diplomat.configure do |dc|
       dc.url = config[:consul]
+      dc.acl_token = config[:token]
+      dc.options = {
+        headers: {
+          'X-Consul-Token' => config[:token]
+        }
+      }
     end
 
     data = acquire_service_data

data/lib/sensu-plugins-consul/check/base.rb

@@ -80,6 +80,10 @@ module SensuPluginsConsul
              proc: proc(&:to_i),
              default: 5
 
+      option :token,
+             description: 'ACL token',
+             long: '--token ACL_TOKEN'
+
       #
       # Fetch and return the parsed JSON data from a specified Consul API endpoint.
       #
@@ -88,7 +92,8 @@ module SensuPluginsConsul
               "v1/#{endpoint}"
         options = { timeout: config[:timeout],
                     verify_ssl: !config[:insecure],
-                    ssl_ca_file: config[:capath] }
+                    ssl_ca_file: config[:capath],
+                    headers: { 'X-Consul-Token' => config[:token] } }
 
         JSON.parse(RestClient::Resource.new(url, options).get)
       rescue Errno::ECONNREFUSED
@@ -96,7 +101,11 @@ module SensuPluginsConsul
       rescue RestClient::RequestTimeout
         critical 'Consul connection timed out'
       rescue RestClient::Exception => e
-        unknown "Consul returned: #{e}"
+        if e.message.include?('403')
+          critical 'ACL token is not authorized to access resource'
+        else
+          unknown "Consul returned: #{e}"
+        end
       end
     end
   end

data/lib/sensu-plugins-consul/version.rb

@@ -3,8 +3,8 @@
 module SensuPluginsConsul
   module Version
     MAJOR = 2
-    MINOR = 1
-    PATCH = 1
+    MINOR = 2
+    PATCH = 0
 
     VER_STRING = [MAJOR, MINOR, PATCH].compact.join('.')
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sensu-plugins-consul
 version: !ruby/object:Gem::Version
-  version: 2.1.1
+  version: 2.2.0
 platform: ruby
 authors:
 - Sensu Plugins and contributors
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-01 00:00:00.000000000 Z
+date: 2018-06-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sensu-plugin