Puppet Class: sensu::backend

Defined in:

manifests/backend.pp

Summary

Manage Sensu backend

Overview

Class to manage the Sensu backend.

Examples:

include sensu::backend

Parameters:

• version (Optional[String]) (defaults to: undef) —

  Version of sensu backend to install. Defaults to installed to support Windows MSI packaging and to avoid surprising upgrades.

• package_name (String) (defaults to: 'sensu-go-backend') —

  Name of Sensu backend package.

• service_env_vars_file (Optional[Stdlib::Absolutepath]) (defaults to: undef) —

  Path to the backend service ENV variables file. Debian based default: /etc/default/sensu-backend RedHat based default: /etc/sysconfig/sensu-backend

• service_env_vars (Hash) (defaults to: {}) —

  Hash of environment variables loaded by sensu-backend service

• service_name (String) (defaults to: 'sensu-backend') —

  Name of the Sensu backend service.

• service_ensure (String) (defaults to: 'running') —

  Sensu backend service ensure value.

• service_enable (Boolean) (defaults to: true) —

  Sensu backend service enable value.

• service_path (Stdlib::Absolutepath) (defaults to: '/usr/sbin/sensu-backend') —

  The path to sensu-backend service executable

• state_dir (Stdlib::Absolutepath) (defaults to: '/var/lib/sensu/sensu-backend') —

  Sensu backend state directory path.

• config_hash (Hash) (defaults to: {}) —

  Sensu backend configuration hash used to define backend.yml.

• ssl_cert_source (Optional[String]) (defaults to: $facts['puppet_hostcert']) —

  The SSL certificate source This parameter is mutually exclusive with ssl_cert_content

• ssl_cert_content (Optional[String]) (defaults to: undef) —

  The SSL certificate content This parameter is mutually exclusive with ssl_cert_source

• ssl_key_source (Optional[String]) (defaults to: $facts['puppet_hostprivkey']) —

  The SSL private key source This parameter is mutually exclusive with ssl_key_content

• ssl_key_content (Optional[String]) (defaults to: undef) —

  The SSL private key content This parameter is mutually exclusive with ssl_key_source

• include_default_resources (Boolean) (defaults to: true) —

  Sets if default sensu resources should be included

• include_agent_resources (Boolean) (defaults to: true) —

  Sets if agent RBAC resources should be included

• manage_agent_user (Boolean) (defaults to: true) —

  Sets if the Sensu agent user should be managed

• agent_user_disabled (Boolean) (defaults to: false) —

  Sets if the Sensu agent user should be disabled Not applicable if manage_agent_user is false This is useful if using agent TLS authentication See Sensu Go - Secure Sensu

• show_diff (Boolean) (defaults to: true) —

  Sets show_diff parameter for backend.yml configuration file

• license_source (Optional[String]) (defaults to: undef) —

  The source of sensu-go enterprise license. Supports any valid Puppet File sources such as absolute paths or puppet:/// Do not define with license_content

• license_content (Optional[String]) (defaults to: undef) —

  The content of sensu-go enterprise license Do not define with license_source

• manage_tessen (Boolean) (defaults to: true) —

  Boolean that determines if Tessen is managed

• tessen_ensure (Enum['present','absent']) (defaults to: 'present') —

  Determine if Tessen is opt-in (present) or opt-out (absent)

• datastore (Optional[Enum['postgresql']]) (defaults to: undef) —

  Datastore to configure for sensu events

• datastore_ensure (Enum['present','absent']) (defaults to: 'present') —

  The datastore ensure property. If set to absent all datastore parameters must still be defined.

• manage_postgresql_db (Boolean) (defaults to: true) —

  Boolean that sets of postgresql database should be managed

• postgresql_name (String) (defaults to: 'postgresql') —

  Name of PostgresConfig that is configured with sensuctl

• postgresql_user (String) (defaults to: 'sensu') —

  The PostgreSQL database user

• postgresql_password (String) (defaults to: 'changeme') —

  The PostgreSQL database password

• postgresql_host (Stdlib::Host) (defaults to: 'localhost') —

  The PostgreSQL host

• postgresql_port (Stdlib::Port) (defaults to: 5432) —

  The PostgreSQL port

• postgresql_dbname (String) (defaults to: 'sensu') —

  The name of the PostgreSQL database

• postgresql_sslmode (Enum['disable','require','verify-ca','verify-full']) (defaults to: 'require') —

  The PostgreSQL sslmode value

• postgresql_ssl_dir (Stdlib::Absolutepath) (defaults to: '/var/lib/sensu/.postgresql') —

  The path to store SSL related files for PostgreSQL connections

• postgresql_ssl_ca_source (Optional[String]) (defaults to: undef) —

  The source of PostgreSQL SSL CA Do not define with postgresql_ssl_ca_content

• postgresql_ssl_ca_content (Optional[String]) (defaults to: undef) —

  The content of PostgreSQL SSL CA Do not define with postgresql_ssl_ca_source

• postgresql_ssl_crl_source (Optional[String]) (defaults to: undef) —

  The source of PostgreSQL SSL CRL Do not define with postgresql_ssl_crl_content

• postgresql_ssl_crl_content (Optional[String]) (defaults to: undef) —

  The content of PostgreSQL SSL CRL Do not define with postgresql_ssl_crl_source

• postgresql_ssl_cert_source (Optional[String]) (defaults to: undef) —

  The source of PostgreSQL SSL certificate Do not define with postgresql_ssl_cert_content

• postgresql_ssl_cert_content (Optional[String]) (defaults to: undef) —

  The content of PostgreSQL SSL certificate Do not define with postgresql_ssl_cert_source

• postgresql_ssl_key_source (Optional[String]) (defaults to: undef) —

  The source of PostgreSQL SSL private key Do not define with postgresql_ssl_key_content

• postgresql_ssl_key_content (Optional[String]) (defaults to: undef) —

  The content of PostgreSQL SSL private key Do not define with postgresql_ssl_key_source

• postgresql_pool_size (Integer) (defaults to: 20) —

  The PostgreSQL pool size

• postgresql_strict (Boolean) (defaults to: false) —

  Enables strict configuration checks for PostgreSQL

• postgresql_batch_buffer (Integer) (defaults to: 0) —

  PostgreSQL batch buffer size

• postgresql_batch_size (Integer) (defaults to: 1) —

  PostgreSQL batch size

• postgresql_batch_workers (Integer) (defaults to: 20) —

  PostgreSQL batch workers

• postgresql_enable_round_robin (Boolean) (defaults to: false) —

  PostgreSQL enable round robin

# File 'manifests/backend.pp', line 127

class sensu::backend (
  Optional[String] $version = undef,
  String $package_name = 'sensu-go-backend',
  Optional[Stdlib::Absolutepath] $service_env_vars_file = undef,
  Hash $service_env_vars = {},
  String $service_name = 'sensu-backend',
  String $service_ensure = 'running',
  Boolean $service_enable = true,
  Stdlib::Absolutepath $service_path = '/usr/sbin/sensu-backend',
  Stdlib::Absolutepath $state_dir = '/var/lib/sensu/sensu-backend',
  Hash $config_hash = {},
  Optional[String] $ssl_cert_source = $facts['puppet_hostcert'],
  Optional[String] $ssl_cert_content = undef,
  Optional[String] $ssl_key_source = $facts['puppet_hostprivkey'],
  Optional[String] $ssl_key_content = undef,
  Boolean $include_default_resources = true,
  Boolean $include_agent_resources = true,
  Boolean $manage_agent_user = true,
  Boolean $agent_user_disabled = false,
  Boolean $show_diff = true,
  Optional[String] $license_source = undef,
  Optional[String] $license_content = undef,
  Boolean $manage_tessen = true,
  Enum['present','absent'] $tessen_ensure = 'present',
  Optional[Enum['postgresql']] $datastore = undef,
  Enum['present','absent'] $datastore_ensure = 'present',
  Boolean $manage_postgresql_db = true,
  String $postgresql_name = 'postgresql',
  String $postgresql_user = 'sensu',
  String $postgresql_password = 'changeme',
  Stdlib::Host $postgresql_host = 'localhost',
  Stdlib::Port $postgresql_port = 5432,
  String $postgresql_dbname = 'sensu',
  Enum['disable','require','verify-ca','verify-full'] $postgresql_sslmode = 'require',
  Stdlib::Absolutepath $postgresql_ssl_dir = '/var/lib/sensu/.postgresql',
  Optional[String] $postgresql_ssl_ca_source = undef,
  Optional[String] $postgresql_ssl_ca_content = undef,
  Optional[String] $postgresql_ssl_crl_source = undef,
  Optional[String] $postgresql_ssl_crl_content = undef,
  Optional[String] $postgresql_ssl_cert_source = undef,
  Optional[String] $postgresql_ssl_cert_content = undef,
  Optional[String] $postgresql_ssl_key_source = undef,
  Optional[String] $postgresql_ssl_key_content = undef,
  Integer $postgresql_pool_size = 20,
  Boolean $postgresql_strict = false,
  Integer $postgresql_batch_buffer = 0,
  Integer $postgresql_batch_size = 1,
  Integer $postgresql_batch_workers = 20,
  Boolean $postgresql_enable_round_robin = false,
) {

  if $license_source and $license_content {
    fail('sensu::backend: Do not define both license_source and license_content')
  }

  include sensu
  include sensu::common
  include sensu::cli
  include sensu::api
  if $datastore == 'postgresql' {
    include sensu::backend::datastore::postgresql
  }

  $_version = pick($version, $sensu::version)

  if $ssl_cert_content {
    $_ssl_cert_source = undef
  } else {
    $_ssl_cert_source = $ssl_cert_source
  }
  if $ssl_key_content {
    $_ssl_key_source = undef
  } else {
    $_ssl_key_source = $ssl_key_source
  }

  if $sensu::use_ssl {
    if !($_ssl_cert_source or $ssl_cert_content) {
      fail('sensu::backend: ssl_cert_source or ssl_cert_content must be defined when sensu::use_ssl is true')
    }
    if !($_ssl_key_source or $ssl_key_content) {
      fail('sensu::backend: ssl_key_source or ssl_key_content must be defined when sensu::use_ssl is true')
    }
    $ssl_config = {
      'cert-file'       => "${sensu::ssl_dir}/cert.pem",
      'key-file'        => "${sensu::ssl_dir}/key.pem",
      'trusted-ca-file' => $sensu::trusted_ca_file_path,
    }
    $service_subscribe = Class['sensu::ssl']
    Class['sensu::ssl'] -> Sensuctl_configure['puppet']
  } else {
    $ssl_config = {}
    $service_subscribe = undef
  }

  $default_config = {
    'state-dir' => $state_dir,
    'api-url'   => $sensu::api_url,
  }
  $config = $default_config + $ssl_config + $config_hash
  $_service_env_vars = $service_env_vars.map |$key,$value| {
    "${key}=\"${value}\""
  }
  $_service_env_vars_lines = ['# This file is being maintained by Puppet.','# DO NOT EDIT'] + $_service_env_vars

  if $include_default_resources {
    include sensu::backend::default_resources
  }
  if $include_agent_resources {
    include sensu::backend::agent_resources
  }

  sensu_user { 'admin':
    ensure                    => 'present',
    password                  => $sensu::password,
    groups                    => ['cluster-admins'],
    disabled                  => false,
    configure                 => true,
    configure_url             => $sensu::api_url,
    configure_trusted_ca_file => $sensu::trusted_ca_file,
    provider                  => 'sensu_api',
    before                    => Sensuctl_configure['puppet'],
  }

  if $manage_agent_user {
    sensu_user { 'agent':
      ensure   => 'present',
      disabled => $agent_user_disabled,
      password => $sensu::agent_password,
      groups   => ['system:agents'],
    }
  }

  if $manage_tessen {
    sensu_tessen { 'puppet': ensure => $tessen_ensure }
  }

  if $license_source or $license_content {
    file { 'sensu_license':
      ensure    => 'file',
      path      => "${sensu::etc_dir}/license.json",
      source    => $license_source,
      content   => $license_content,
      owner     => $sensu::user,
      group     => $sensu::group,
      mode      => '0600',
      show_diff => false,
      notify    => Sensu_license['puppet'],
    }

    sensu_license { 'puppet':
      ensure => 'present',
      file   => "${sensu::etc_dir}/license.json",
    }
  }

  if $sensu::use_ssl {
    file { 'sensu_ssl_cert':
      ensure    => 'file',
      path      => "${sensu::ssl_dir}/cert.pem",
      source    => $_ssl_cert_source,
      content   => $ssl_cert_content,
      owner     => $sensu::user,
      group     => $sensu::group,
      mode      => '0644',
      show_diff => false,
      notify    => Service['sensu-backend'],
    }
    file { 'sensu_ssl_key':
      ensure    => 'file',
      path      => "${sensu::ssl_dir}/key.pem",
      source    => $_ssl_key_source,
      content   => $ssl_key_content,
      owner     => $sensu::user,
      group     => $sensu::group,
      mode      => '0600',
      show_diff => false,
      notify    => Service['sensu-backend'],
    }
  }

  package { 'sensu-go-backend':
    ensure  => $_version,
    name    => $package_name,
    before  => File['sensu_etc_dir'],
    require => $sensu::package_require,
    notify  => Service['sensu-backend'],
  }

  file { 'sensu_backend_state_dir':
    ensure  => 'directory',
    path    => $state_dir,
    owner   => $sensu::user,
    group   => $sensu::group,
    mode    => '0750',
    require => Package['sensu-go-backend'],
    before  => Service['sensu-backend'],
  }

  file { 'sensu_backend_config':
    ensure    => 'file',
    path      => "${sensu::etc_dir}/backend.yml",
    content   => to_yaml($config),
    owner     => $sensu::user,
    group     => $sensu::group,
    mode      => '0640',
    show_diff => $show_diff,
    require   => Package['sensu-go-backend'],
    notify    => Service['sensu-backend'],
  }

  if $service_env_vars_file {
    $_service_env_vars_content = join($_service_env_vars_lines, "\n")
    file { 'sensu-backend_env_vars':
      ensure    => 'file',
      path      => $service_env_vars_file,
      content   => "${_service_env_vars_content}\n",
      owner     => $sensu::sensu_user,
      group     => $sensu::sensu_group,
      mode      => '0640',
      show_diff => $show_diff,
      require   => Package['sensu-go-backend'],
      notify    => Service['sensu-backend'],
    }
  }

  if $facts['service_provider'] == 'systemd' {
    systemd::dropin_file { 'sensu-backend-start.conf':
      unit    => 'sensu-backend.service',
      content => join([
        '[Service]',
        'ExecStart=',
        "ExecStart=${service_path} start -c ${sensu::etc_dir}/backend.yml",
      ], "\n"),
      notify  => Service['sensu-backend'],
    }
  }

  service { 'sensu-backend':
    ensure    => $service_ensure,
    enable    => $service_enable,
    name      => $service_name,
    subscribe => $service_subscribe,
  }

  if $sensu::validate_api {
    $init_require = Sensu_api_validator['sensu']
  } else {
    $init_require = undef
  }
  exec { 'sensu-backend init':
    path        => '/usr/bin:/bin:/usr/sbin:/sbin',
    command     => "sensu-backend init --config-file ${sensu::etc_dir}/backend.yml",
    environment => [
      'SENSU_BACKEND_CLUSTER_ADMIN_USERNAME=admin',
      "SENSU_BACKEND_CLUSTER_ADMIN_PASSWORD=${sensu::password}",
    ],
    returns     => [0, 3],
    # sensu-backend init will exit with code 3 if already run
    # If exit code is 3, do not need to run sensu-backend init again
    # If exit is not 3, run sensu-backend init
    unless      => "sensu-backend init --config-file ${sensu::etc_dir}/backend.yml ; [ \$? -eq 3 ] && exit 0 || exit 1",
    require     => $init_require,
    before      => [
      Sensu_user['admin'],
      Sensuctl_configure['puppet'],
    ],
  }
}