release: version 1.4.0

.gitignore

@@ -1,2 +1,2 @@
 .kitchen/*
-
+*.pyc

.kitchen.yml

@@ -1,27 +0,0 @@
----
-driver:
-  name: docker_cli
-
-transport:
-  name: docker_cli
-
-provisioner:
-  name: ansible_playbook
-  hosts: localhost
-  require_ansible_repo: false
-  require_ansible_omnibus: false
-  require_chef_for_busser: true
-  ansible_verbose: false
-  ansible_inventory: ./test/integration/inventory
-
-platforms:
-  - name: debian-9
-    driver_config:
-      image: "nishiki/debian9:ansible-<%= ENV['ANSIBLE_VERSION'] ? ENV['ANSIBLE_VERSION'] : '2.7' %>"
-      command: /bin/systemd
-      volume:
-        - /sys/fs/cgroup:/sys/fs/cgroup:ro
-      security_opt: seccomp=unconfined
-
-suites:
-  - name: default

.rubocop.yml

@@ -1,38 +0,0 @@
----
-AllCops:
-  Exclude:
-    - db/**/*
-    - config/**/*
-    - Vagrantfile
-  TargetRubyVersion: 2.4
-
-Naming/AccessorMethodName:
-  Enabled: false
-
-Lint/RescueWithoutErrorClass:
-  Enabled: false
-
-Metrics/LineLength:
-  Max: 120
-Metrics/CyclomaticComplexity:
-  Enabled: false
-Metrics/PerceivedComplexity:
-  Enabled: false
-Metrics/MethodLength:
-  Enabled: false
-Metrics/BlockLength:
-  Enabled: false
-Metrics/ClassLength:
-  Enabled: false
-Metrics/AbcSize:
-  Enabled: false
-
-Style/NumericLiteralPrefix:
-  Enabled: false
-Style/FrozenStringLiteralComment:
-  Enabled: false
-Style/CommandLiteral:
-  Enabled: true
-  EnforcedStyle: percent_x
-Style/Documentation:
-  Enabled: false

.travis.yml

@@ -0,0 +1,29 @@
+---
+sudo: required
+dist: bionic
+addons:
+  apt:
+    packages:
+      - python3
+      - python3-pip
+      - python3-setuptools
+
+env:
+  - ANSIBLE_VERSION=2.7.16
+  - ANSIBLE_VERSION=2.8.8
+  - ANSIBLE_VERSION=2.9.4
+
+services:
+  - docker
+
+before_install:
+  - sudo pip3 install ansible==${ANSIBLE_VERSION}
+  - sudo pip3 install molecule 'molecule[docker]' docker testinfra ansible-lint yamllint
+  - git clone https://github.com/ansible/galaxy-lint-rules.git
+
+script:
+  - ansible --version
+  - molecule test
+
+notifications:
+  webhooks: https://galaxy.ansible.com/api/v1/notifications/

.yamllint

@@ -2,7 +2,7 @@
 extends: default
 
 ignore: |
-  .kitchen/*
+  .kitchen*
   vendor/
 
 rules:

CHANGELOG.md

@@ -5,5 +5,50 @@ Which is based on [Keep A Changelog](http://keepachangelog.com/)
 
 ## [Unreleased]
 
+## [1.4.0] - 2020-08-09
+
+### Feat
+
+- add hooks
+
+### Fixed
+
+- add full python3 support
+- remove useless no_log variable
+
+## [1.3.0] - 2020-04-04
+
+### Fixed
+
+- add compatibily with new sensu version
+- remove no_log warnings with sensu_go libraries
+
+### Changed
+
+- test: replace kitchen to molecule
+- add loop label for sensu_go modules
+
+## [1.2.0] - 2019-06-22
+
+- feat: add support for ansible 2.8
+- feat: add labels in checks
+- feat: add a debug mode with sensu_no_log variable
+- feat: add mutators
+- feat: add sensu_agent_redact variable to add new redact keywords
+- fix: add new return code for api with the version 5.10
+- fix: handler, asset and filter wasn't idempotent
+- fix: create roles before users
+- doc: add example in readme
+
+## [1.1.0] - 2019-02-17
+
+- feat: add support of centos 7
+- feat: add support of ubuntu 16.04
+- feat: add support of ubuntu 18.04
+- feat: add multiple namespaces for the checks, filters, handlers or assets
+- fix: install python-requests for backend
+- test: add travis ci
+
 ## [1.0.0] - 2019-02-06
+
 - first version

Gemfile

@@ -1,8 +0,0 @@
-source 'https://rubygems.org'
-
-group :development do
-  gem 'kitchen-ansible'
-  gem 'kitchen-docker_cli'
-  gem 'rubocop', '0.50.0'
-  gem 'test-kitchen'
-end

Gemfile.lock

@@ -1,92 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    ast (2.4.0)
-    builder (3.2.3)
-    erubis (2.7.0)
-    ffi (1.9.25)
-    gssapi (1.2.0)
-      ffi (>= 1.0.1)
-    gyoku (1.3.1)
-      builder (>= 2.1.2)
-    httpclient (2.8.3)
-    kitchen-ansible (0.49.0)
-      net-ssh (>= 3)
-      test-kitchen (~> 1.4)
-    kitchen-docker_cli (0.19.0)
-      test-kitchen (>= 1.3)
-    little-plugger (1.1.4)
-    logging (2.2.2)
-      little-plugger (~> 1.1)
-      multi_json (~> 1.10)
-    mixlib-install (3.11.5)
-      mixlib-shellout
-      mixlib-versioning
-      thor
-    mixlib-shellout (2.4.4)
-    mixlib-versioning (1.2.7)
-    multi_json (1.13.1)
-    net-scp (1.2.1)
-      net-ssh (>= 2.6.5)
-    net-ssh (4.2.0)
-    net-ssh-gateway (1.3.0)
-      net-ssh (>= 2.6.5)
-    nori (2.6.0)
-    parallel (1.12.1)
-    parser (2.5.3.0)
-      ast (~> 2.4.0)
-    powerpack (0.1.2)
-    rainbow (2.2.2)
-      rake
-    rake (12.3.2)
-    rubocop (0.50.0)
-      parallel (~> 1.10)
-      parser (>= 2.3.3.1, < 3.0)
-      powerpack (~> 0.1)
-      rainbow (>= 2.2.2, < 3.0)
-      ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
-    ruby-progressbar (1.10.0)
-    rubyntlm (0.6.2)
-    rubyzip (1.2.2)
-    test-kitchen (1.24.0)
-      mixlib-install (~> 3.6)
-      mixlib-shellout (>= 1.2, < 3.0)
-      net-scp (~> 1.1)
-      net-ssh (>= 2.9, < 5.0)
-      net-ssh-gateway (~> 1.2)
-      thor (~> 0.19)
-      winrm (~> 2.0)
-      winrm-elevated (~> 1.0)
-      winrm-fs (~> 1.1)
-    thor (0.20.3)
-    unicode-display_width (1.4.1)
-    winrm (2.3.1)
-      builder (>= 2.1.2)
-      erubis (~> 2.7)
-      gssapi (~> 1.2)
-      gyoku (~> 1.0)
-      httpclient (~> 2.2, >= 2.2.0.2)
-      logging (>= 1.6.1, < 3.0)
-      nori (~> 2.0)
-      rubyntlm (~> 0.6.0, >= 0.6.1)
-    winrm-elevated (1.1.1)
-      winrm (~> 2.0)
-      winrm-fs (~> 1.0)
-    winrm-fs (1.3.2)
-      erubis (~> 2.7)
-      logging (>= 1.6.1, < 3.0)
-      rubyzip (~> 1.1)
-      winrm (~> 2.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  kitchen-ansible
-  kitchen-docker_cli
-  rubocop (= 0.50.0)
-  test-kitchen
-
-BUNDLED WITH
-   1.16.0

README.md

@@ -1,13 +1,18 @@
 # Ansible role: Sensu
-[![Version](https://img.shields.io/badge/latest_version-1.0.0-green.svg)](https://git.yaegashi.fr/nishiki/ansible-role-sensu/releases)
+[![Version](https://img.shields.io/badge/latest_version-1.4.0-green.svg)](https://git.yaegashi.fr/nishiki/ansible-role-sensu/releases)
+[![Build Status](https://travis-ci.org/nishiki/ansible-role-sensu.svg?branch=master)](https://travis-ci.org/nishiki/ansible-role-sensu)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](https://git.yaegashi.fr/nishiki/ansible-role-sensu/src/branch/master/LICENSE)
 
 Install and configure sensu-go backend and agent
 
 ## Requirements
 
-* Ansible >= 2.7
+* Ansible >= 2.5
+* OS
   * Debian Stretch
+  * Ubuntu 18.04
+  * Ubuntu 16.04
+  * Centos 7
 
 ## Role variables
 ### General
@@ -15,6 +20,8 @@ Install and configure sensu-go backend and agent
 * `sensu_repository_system` - system for package repository (default: `ansible_distribution`)
 * `sensu_repository_release` - system release for package repository (default: `ansible_distribution_release`)
 
+Notice: for debian9 set `sensu_repository_system` to `ubuntu` and `sensu_repository_release` to `xenial`
+
 ### Agent
 
 * `sensu_agent` - enable sensu agent installation (default: `yes`)
@@ -38,9 +45,15 @@ Install and configure sensu-go backend and agent
 
 ```
   region: Europe
-  disk:
+  disk_critical: 90
-    critical: 90
+  disk_warning: 75
-    warning: 75
+```
+
+* `sensu_agent_redact` - array with the redact keywords
+
+```
+  - supersecret
+  - apikey
 ```
 
 * `sensu_agent_backends` - array with the backends url
@@ -60,7 +73,8 @@ Install and configure sensu-go backend and agent
 
 ```
   - name: http-binary
-    namespace: default
+    namespace:
+      - default
     url: http://host.local
     sha512: XXXX
     filters: []
@@ -77,7 +91,10 @@ Install and configure sensu-go backend and agent
 
 ```
   - name: load
-    namespace: default
+    namespace:
+      - default
+    labels:
+      criticity: high
     command: /usr/bin/load -w 2 -c 5
     handlers:
       - mailer
@@ -88,11 +105,23 @@ Install and configure sensu-go backend and agent
       ttl: 300
 ```
 
+* `sensu_mutators` - array with the mutator definitions
+
+```
+  - name: convert2csv
+    namespace:
+      - default
+    command: /usr/local/bin/convert_to_csv
+    options:
+      timeout: 10
+```
+
 * `sensu_handlers` - array with the handler definitions
 
 ```
   - name: mailer
-    namespace: default
+    namespace:
+      - default
     type: pipe
     command: /usr/local/bin/sensu-email-handler -t sensu@host.local
     filters:
@@ -101,11 +130,22 @@ Install and configure sensu-go backend and agent
       timeout: 10
 ```
 
+* `sensu_hooks` - array with the hook definitions
+
+```
+  - name: restart-apache
+    namespace:
+      - default
+    command: /etc/init.d/apache2 restart
+    timeout: 10
+```
+
 * `sensu_filters` - array with the filter definitions
 
 ```
   - name: max_occurences
-    namespace: default
+    namespace:
+      - default
     action: allow
     expressions:
     runtime_assets: []
@@ -140,33 +180,75 @@ Install and configure sensu-go backend and agent
 * `sensu_api_password` - password for sensu api (default: `P@ssw0rd!`)
 
 ## How to use
+### Agent
+
+```
+- hosts: webserver
+  roles:
+    - sensu
+  vars:
+    sensu_agent_subscriptions:
+      - debian
+      - webserver
+    sensu_agent_labels:
+      datacenter: paris
+      disk_warning: 30
+      disk_critical: 50
+    sensu_agent_plugins:
+      - name: sensu-plugins-disk-checks
+        version: 3.1.1
+```
+
+### Backend
 
 ```
 - hosts: monitoring
   roles:
     - sensu
+  vars:
+    sensu_backend: yes
+    sensu_namespaces:
+      - name: production
+      - name: dev
+    sensu_users:
+      - name: johndoe
+        password: secret1234
+        groups:
+          - devops
+          - users
+    sensu_handlers:
+      - name: mail
+        command: /usr/local/bin/handler-mailer
+        namespaces:
+          - production
+          - dev
+    sensu_filters:
+      - name: state_changed
+        expressions:
+          - event.check.occurrences == 1
+        namespaces:
+          - production
+          - dev
+    sensu_checks:
+      - name: ping
+        command: ping -c 1 127.0.0.1
+        subscriptions:
+          - linux
+        namespaces:
+          - production
+          - dev
+    sensu_cluster_roles:
+      - name: superview
 ```
 
 ## Development
-### Test syntax with yamllint
 
-* install `python` and `python-pip`
+### Test with molecule and docker
-* install yamllint `pip install yamllint`
-* run `yamllint .`
-
-### Test syntax with ansible-lint
-
-* install `python` and `python-pip`
-* install yamllint `pip install ansible-lint`
-* run `ansible-lint .`
-
-### Tests with docker
 
 * install [docker](https://docs.docker.com/engine/installation/)
-* install ruby
+* install `python3` and `python3-pip`
-* install bundler `gem install bundler`
+* install molecule and dependencies `pip3 install molecule 'molecule[docker]' docker ansible-lint testinfra yamllint`
-* install dependencies `bundle install`
+* run `molecule test`
-* run the tests `kitchen test`
 
 ## License
 

defaults/main.yml

@@ -15,6 +15,17 @@ sensu_agent_password: 'P@ssw0rd!'
 sensu_agent_plugins: []
 sensu_agent_subscriptions: []
 sensu_agent_labels: {}
+sensu_agent_default_redact:
+  - password
+  - passwd
+  - pass
+  - secret
+  - api_key
+  - api_token
+  - access_key
+  - secret_key
+  - private_key
+sensu_agent_redact: []
 sensu_agent_backends:
   - 'ws://localhost:8081'
 sensu_agent_namespace: default
@@ -26,6 +37,7 @@ sensu_agent_default_config:
   password: '{{ sensu_agent_password }}'
   subscriptions: '{{ sensu_agent_subscriptions }}'
   labels: '{{ sensu_agent_labels }}'
+  redact: '{{ sensu_agent_default_redact + sensu_agent_redact }}'
 sensu_agent_config: {}
 sensu_agent_full_config: '{{ sensu_agent_default_config|combine(sensu_agent_config) }}'
 
@@ -41,3 +53,5 @@ sensu_handlers: []
 sensu_filters: []
 sensu_users: []
 sensu_cluster_roles: []
+sensu_mutators: []
+sensu_hooks: []

files/docker-compose.service

@@ -1,12 +0,0 @@
-[Unit]
-Description= Docker compose for %i
-After=network.target docker.service
-
-[Service]
-Type=simple
-ExecStart=/usr/bin/docker-compose -f /etc/docker/compose/%i/docker-compose.yml up
-ExecReload=/usr/bin/docker-compose -f /etc/docker/compose/%i/docker-compose.yml up --no-recreate -d
-Restart=always
-
-[Install]
-WantedBy=multi-user.target

library/sensugo_asset.py

@@ -21,8 +21,8 @@ class SensuAsset:
       }
     
   def has_changed(self, options):
-    for option, value in self.options.iteritems():
+    for option, value in self.options.items():
-      if options[option] != value:
+      if (options[option] or value) and options[option] != value:
         return True
     
     return False
@@ -43,13 +43,13 @@ class SensuAsset:
 def main():
   fields = {
     'name':         { 'type': 'str',  'required': True },
-    'namespace':    { 'type': 'str',  'default': 'default' },
+    'namespaces':   { 'type': 'list', 'default': ['default'] },
     'url':          { 'type': 'str',  'required': True },
     'sha512':       { 'type': 'str',  'required': True },
     'filters':      { 'type': 'list', 'default': [] },
     'api_url':      { 'type': 'str',  'default': 'http://127.0.0.1:8080' },
     'api_user':     { 'type': 'str',  'default': 'admin' },
-    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!' },
+    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!', 'no_log': True },
   }
   module = AnsibleModule(argument_spec=fields)
   changed = True
@@ -67,10 +67,11 @@ def main():
   )
   api.auth()
 
+  for namespace in module.params['namespaces']:
     asset = SensuAsset(
       api,
       module.params['name'],
-    module.params['namespace']
+      namespace
     )
     asset.get_data()
 

library/sensugo_check.py

@@ -4,21 +4,42 @@ from ansible.module_utils.basic import *
 from ansible.module_utils.sensu_api import *
 
 class SensuCheck:
-  def __init__(self, api, name, namespace):
+  def __init__(self, api, name, namespace, labels):
     self.api       = api
     self.name      = name
     self.namespace = namespace
+    self.labels    = labels
     self.exist     = False
 
   def get_data(self):
     status_code, data = self.api.get('namespaces/{}/checks/{}'.format(self.namespace, self.name))
     if status_code == 200:
       self.exist   = True
-      self.options = data
+      return data
-      self.options.pop('metadata')
+
+    return {}
+
+  def labels_has_changed(self, new_labels, old_labels):
+    if not old_labels and not new_labels:
+      return False
+
+    if len(new_labels) != len(old_labels):
+      return True
+
+    for old_label, old_value in old_labels.items():
+      if old_label in new_labels and new_labels[old_label] == old_value:
+        continue
+      return True
+
+    return False
 
   def has_changed(self, options):
-    for option, value in self.options.iteritems():
+    data = self.get_data()
+    if self.labels_has_changed(self.labels, data['metadata'].get('labels')):
+      return True
+
+    data.pop('metadata')
+    for option, value in data.items():
       if not option in options:
         if value:
           return True
@@ -31,7 +52,8 @@ class SensuCheck:
     options.update({
       'metadata': {
         'name': self.name,
-        'namespace': self.namespace
+        'namespace': self.namespace,
+        'labels': self.labels
       }
     })
 
@@ -49,7 +71,8 @@ class SensuCheck:
 def main():
   fields = {
     'name':          { 'type': 'str',  'required': True },
-    'namespace':     { 'type': 'str',  'default': 'default' },
+    'namespaces':    { 'type': 'list', 'default': ['default'] },
+    'labels':        { 'type': 'dict', 'default': {} },
     'command':       { 'type': 'str',  'required': True },
     'handlers':      { 'type': 'list', 'default': [] },
     'subscriptions': { 'type': 'list', 'required': True },
@@ -57,7 +80,7 @@ def main():
     'options':       { 'type': 'dict', 'default': {} },
     'api_url':       { 'type': 'str',  'default': 'http://127.0.0.1:8080' },
     'api_user':      { 'type': 'str',  'default': 'admin' },
-    'api_password':  { 'type': 'str',  'default': 'P@ssw0rd!' },
+    'api_password':  { 'type': 'str',  'default': 'P@ssw0rd!', 'no_log': True },
     'state':         { 'type': 'str',  'default': 'present', 'choices': ['present', 'absent'] }
   }
   module = AnsibleModule(argument_spec=fields)
@@ -81,10 +104,12 @@ def main():
   )
   api.auth()
 
+  for namespace in module.params['namespaces']:
     check = SensuCheck(
       api,
       module.params['name'],
-    module.params['namespace']
+      namespace,
+      module.params['labels']
     )
     check.get_data()
 

library/sensugo_cluster_role.py

@@ -22,14 +22,14 @@ class SensuClusterRole:
       return True
 
     for i in range(0, len(self.options['rules'])):
-      for rule, value in self.options['rules'][i].iteritems():
+      for rule, value in self.options['rules'][i].items():
         if not rule in options['rules'][i]:
           if value:
             return True
         elif options['rules'][i][rule] != value:
           return True
         
-      for rule, value in options['rules'][i].iteritems():
+      for rule, value in options['rules'][i].items():
         if not rule in self.options['rules'][i]:
           if value:
             return True
@@ -63,7 +63,7 @@ def main():
     'rules':        { 'type': 'list', 'required': True },
     'api_url':      { 'type': 'str',  'default': 'http://127.0.0.1:8080' },
     'api_user':     { 'type': 'str',  'default': 'admin' },
-    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!' },
+    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!', 'no_log': True },
     'state':        { 'type': 'str',  'default': 'present', 'choices': ['present', 'absent'] }
   }
   module = AnsibleModule(argument_spec=fields)

library/sensugo_filter.py

@@ -18,11 +18,11 @@ class SensuFilter:
       self.options.pop('metadata')
     
   def has_changed(self, options):
-    for option, value in self.options.iteritems():
+    for option, value in self.options.items():
       if not option in options:
         if value:
           return True
-      elif options[option] != value:
+      elif (options[option] or value) and options[option] != value:
         return True
     
     return False
@@ -49,13 +49,13 @@ class SensuFilter:
 def main():
   fields = {
     'name':           { 'type': 'str',  'required': True },
-    'namespace':      { 'type': 'str',  'default': 'default' },
+    'namespaces':     { 'type': 'list', 'default': ['default'] },
     'action':         { 'type': 'str',  'default': 'allow', 'choices': ['allow', 'deny'] },
     'expressions':    { 'type': 'list', 'required': True },
     'runtime_assets': { 'type': 'list', 'default': [] },
     'api_url':        { 'type': 'str',  'default': 'http://127.0.0.1:8080' },
     'api_user':       { 'type': 'str',  'default': 'admin' },
-    'api_password':   { 'type': 'str',  'default': 'P@ssw0rd!' },
+    'api_password':   { 'type': 'str',  'default': 'P@ssw0rd!', 'no_log': True },
     'state':          { 'type': 'str',  'default': 'present', 'choices': ['present', 'absent'] }
   }
   module = AnsibleModule(argument_spec=fields)
@@ -74,10 +74,11 @@ def main():
   )
   api.auth()
 
+  for namespace in module.params['namespaces']:
     filter = SensuFilter(
       api,
       module.params['name'],
-    module.params['namespace']
+      namespace
     )
     filter.get_data()
 

library/sensugo_handler.py

@@ -18,11 +18,11 @@ class SensuHandler:
       self.options.pop('metadata')
     
   def has_changed(self, options):
-    for option, value in self.options.iteritems():
+    for option, value in self.options.items():
       if not option in options:
         if value:
           return True
-      elif options[option] != value:
+      elif (options[option] or value) and options[option] != value:
         return True
     
     return False
@@ -49,14 +49,14 @@ class SensuHandler:
 def main():
   fields = {
     'name':         { 'type': 'str',  'required': True },
-    'namespace':    { 'type': 'str',  'default': 'default' },
+    'namespaces':   { 'type': 'list', 'default': ['default'] },
     'type':         { 'type': 'str',  'default': 'pipe', 'choices': ['pipe', 'tcp', 'udp', 'set'] },
     'command':      { 'type': 'str',  'required': True },
     'filters':      { 'type': 'list', 'default': [] },
     'options':      { 'type': 'dict', 'default': {} },
     'api_url':      { 'type': 'str',  'default': 'http://127.0.0.1:8080' },
     'api_user':     { 'type': 'str',  'default': 'admin' },
-    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!' },
+    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!', 'no_log': True },
     'state':        { 'type': 'str',  'default': 'present', 'choices': ['present', 'absent'] }
   }
   module = AnsibleModule(argument_spec=fields)
@@ -76,10 +76,11 @@ def main():
   )
   api.auth()
 
+  for namespace in module.params['namespaces']:
     handler = SensuHandler(
       api,
       module.params['name'],
-    module.params['namespace']
+      namespace
     )
     handler.get_data()
 

library/sensugo_hook.py

@@ -0,0 +1,95 @@
+#!/usr/bin/python
+
+from ansible.module_utils.basic import *
+from ansible.module_utils.sensu_api import *
+
+class SensuHook:
+  def __init__(self, api, name, namespace):
+    self.api       = api
+    self.name      = name
+    self.namespace = namespace
+    self.exists    = False
+
+  def get_data(self):
+    status_code, data = self.api.get('namespaces/{}/hooks/{}'.format(self.namespace, self.name))
+    if status_code == 200:
+      self.exists  = True
+      return data
+
+    return {}
+
+  def has_changed(self, options):
+    data = self.get_data()
+    data.pop('metadata')
+    for option, value in data.items():
+      if not option in options:
+        if value:
+          return True
+      elif options[option] != value:
+        return True
+
+    return False
+
+  def create(self, options):
+    options.update({
+      'metadata': {
+        'name': self.name,
+        'namespace': self.namespace
+      }
+    })
+
+    self.api.put(
+      'namespaces/{}/hooks/{}'.format(self.namespace, self.name),
+      options
+    )
+
+  def delete(self):
+    self.api.delete(
+      'namespaces/{}/hooks/{}'.format(self.namespace, self.name)
+    )
+
+def main():
+  fields = {
+    'name':         { 'type': 'str',  'required': True },
+    'namespaces':   { 'type': 'list', 'default': ['default'] },
+    'command':      { 'type': 'str',  'required': True },
+    'timeout':      { 'type': 'int',  'default': 10 },
+    'api_url':      { 'type': 'str',  'default': 'http://127.0.0.1:8080' },
+    'api_user':     { 'type': 'str',  'default': 'admin' },
+    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!', 'no_log': True },
+    'state':        { 'type': 'str',  'default': 'present', 'choices': ['present', 'absent'] }
+  }
+  module = AnsibleModule(argument_spec=fields)
+  changed = False
+
+  options = {
+    'command': module.params['command'],
+    'timeout': module.params['timeout']
+  }
+  api = SensuApi(
+    module.params['api_url'],
+    module.params['api_user'],
+    module.params['api_password']
+  )
+  api.auth()
+
+  for namespace in module.params['namespaces']:
+    hook = SensuHook(
+      api,
+      module.params['name'],
+      namespace
+    )
+    hook.get_data()
+
+    if module.params['state'] == 'present':
+      if not hook.exists or hook.has_changed(options):
+        hook.create(options)
+        changed = True
+    elif hook.exists:
+        hook.delete()
+        changed = True
+
+  module.exit_json(changed=changed)
+
+if __name__ == '__main__':
+  main()

library/sensugo_mutator.py

@@ -0,0 +1,94 @@
+#!/usr/bin/python
+
+from ansible.module_utils.basic import *
+from ansible.module_utils.sensu_api import *
+
+class SensuMutator:
+  def __init__(self, api, name, namespace):
+    self.api       = api
+    self.name      = name
+    self.namespace = namespace
+    self.exist     = False
+
+  def get_data(self):
+    status_code, data = self.api.get('namespaces/{}/mutators/{}'.format(self.namespace, self.name))
+    if status_code == 200:
+      self.exist   = True
+      self.options = data
+      self.options.pop('metadata')
+    
+  def has_changed(self, options):
+    for option, value in self.options.items():
+      if not option in options:
+        if value:
+          return True
+      elif options[option] != value:
+        return True
+    
+    return False
+
+  def create(self, options):
+    options.update({
+      'metadata': {
+        'name': self.name,
+        'namespace': self.namespace
+      }
+    })
+
+    self.api.put(
+      'namespaces/{}/mutators/{}'.format(self.namespace, self.name),
+      options
+    )
+
+  def delete(self):
+    self.api.delete(
+      'namespaces/{}/mutators/{}'.format(self.namespace, self.name)
+    )
+ 
+    
+def main():
+  fields = {
+    'name':          { 'type': 'str',  'required': True },
+    'namespaces':    { 'type': 'list', 'default': ['default'] },
+    'command':       { 'type': 'str',  'required': True },
+    'options':       { 'type': 'dict', 'default': {} },
+    'api_url':       { 'type': 'str',  'default': 'http://127.0.0.1:8080' },
+    'api_user':      { 'type': 'str',  'default': 'admin' },
+    'api_password':  { 'type': 'str',  'default': 'P@ssw0rd!', 'no_log': True },
+    'state':         { 'type': 'str',  'default': 'present', 'choices': ['present', 'absent'] }
+  }
+  module = AnsibleModule(argument_spec=fields)
+  changed = False
+
+  options = {
+    'command': module.params['command'],
+  }
+  options.update(module.params['options'])
+
+  api = SensuApi(
+    module.params['api_url'],
+    module.params['api_user'],
+    module.params['api_password']
+  )
+  api.auth()
+
+  for namespace in module.params['namespaces']:
+    mutator = SensuMutator(
+      api,
+      module.params['name'],
+      namespace
+    )
+    mutator.get_data()
+
+    if module.params['state'] == 'present':
+      if not mutator.exist or mutator.has_changed(options):
+        mutator.create(options)
+        changed = True
+    elif mutator.exist:
+        mutator.delete()
+        changed = True
+
+  module.exit_json(changed=changed)
+
+if __name__ == '__main__':
+  main()

library/sensugo_namespace.py

@@ -31,7 +31,7 @@ def main():
     'name':         { 'type': 'str',  'required': True },
     'api_url':      { 'type': 'str',  'default': 'http://127.0.0.1:8080' },
     'api_user':     { 'type': 'str',  'default': 'admin' },
-    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!' },
+    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!', 'no_log': True },
     'state':        { 'type': 'str',  'default': 'present', 'choices': ['present', 'absent'] }
   }
   module = AnsibleModule(argument_spec=fields)

library/sensugo_user.py

@@ -21,7 +21,7 @@ class SensuUser:
       pass
     
   def has_changed(self, options):
-    for option, value in self.options.iteritems():
+    for option, value in self.options.items():
       if options[option] != value:
         return True
     
@@ -55,10 +55,10 @@ def main():
   fields = {
     'name':         { 'type': 'str',  'required': True },
     'groups':       { 'type': 'list', 'default': [] },
-    'password':     { 'type': 'str',  'default': None },
+    'password':     { 'type': 'str',  'default': None, 'no_log': True },
     'api_url':      { 'type': 'str',  'default': 'http://127.0.0.1:8080' },
     'api_user':     { 'type': 'str',  'default': 'admin' },
-    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!' },
+    'api_password': { 'type': 'str',  'default': 'P@ssw0rd!', 'no_log': True },
     'state':        { 'type': 'str',  'default': 'present', 'choices': ['present', 'absent'] }
   }
   module = AnsibleModule(argument_spec=fields)

meta/main.yml

@@ -5,15 +5,26 @@ galaxy_info:
   company: Adrien Waksberg
   description: Install and configure sensu-go
   license: Apache2
-  min_ansible_version: 2.7
+  min_ansible_version: 2.5
 
   platforms:
     - name: Debian
       versions:
         - stretch
+    - name: Ubuntu
+      versions:
+        - xenial
+        - cosmic
+    - name: el
+      versions:
+        - 7
 
   galaxy_tags:
     - sensu
+    - sensugo
+    - dashboard
+    - agent
+    - backend
     - monitoring
     - alerting
 

module_utils/sensu_api.py

@@ -19,7 +19,7 @@ class SensuApi:
     if r.status_code == 401:
       raise Exception('Authentification has failed')
 
-    self.headers = { 'Authorization': r.json()['access_token'] }
+    self.headers = { 'Authorization': 'Bearer %s' % (r.json()['access_token']) }
 
   def get(self, path):
     r = requests.get(
@@ -59,7 +59,7 @@ class SensuApi:
       raise Exception('Server return 500 error: {}'.format(r.text))
     elif r.status_code == 401:
       raise Exception('Authentification has failed')
-    elif r.status_code != 200:
+    elif r.status_code not in [200, 201, 204]:
       raise Exception('Server return an unknown error: {}'.format(r.text))
 
   def delete(self, path):

molecule/default/converge.yml

@@ -1,20 +1,23 @@
 ---
-- hosts: default
+- name: Converge
-  connection: local
+  hosts: all
+  roles:
+    - ansible-role-sensu
   vars:
-    sensu_backend: yes
     sensu_repository_system: ubuntu
     sensu_repository_release: xenial
+    sensu_backend: yes
+    sensu_agent_redact:
+      - supersecret
     sensu_agent_plugins:
       - name: sensu-plugins-disk-checks
         version: 3.1.1
     sensu_agent_labels:
       test: coucou
-      hello:
+      supersecret: password
-        warning: 30
-        critical: 50
     sensu_namespaces:
-      - name: supernamespace
+      - name: production
+      - name: dev
     sensu_users:
       - name: johndoe
         password: secret1234
@@ -27,18 +30,44 @@
         sha512: >
           cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce
           47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
+        namespaces:
+          - production
+          - dev
+    sensu_mutators:
+      - name: transform
+        command: /path/value_to_csv
+        namespaces:
+          - production
+          - dev
     sensu_handlers:
       - name: mail
         command: echo test | mail -s coucou
+        namespaces:
+          - production
+          - dev
     sensu_filters:
       - name: state_changed
         expressions:
           - event.check.occurrences == 1
+        namespaces:
+          - production
+          - dev
+    sensu_hooks:
+      - name: restart-apache
+        command: /etc/init.d/apache2 restart
+        namespaces:
+          - production
+          - dev
     sensu_checks:
       - name: ping
         command: ping -c 1 127.0.0.1
+        labels:
+          ping_warning: '200'
         subscriptions:
           - linux
+        namespaces:
+          - production
+          - dev
     sensu_cluster_roles:
       - name: superview
         rules:
@@ -47,6 +76,3 @@
               - list
             resources:
               - '*'
-
-  roles:
-    - ansible-role-sensu

molecule/default/molecule.yml

@@ -0,0 +1,18 @@
+---
+driver:
+  name: docker
+platforms:
+  - name: debian10
+    image: nishiki/debian10:molecule
+    privileged: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    command: /bin/systemd
+    capabilities:
+      - SYS_ADMIN
+lint: |
+  set -e
+  yamllint .
+  ansible-lint
+verifier:
+  name: testinfra

molecule/default/tests/test_default.py

@@ -0,0 +1,64 @@
+import re
+import testinfra.utils.ansible_runner
+
+def test_packages(host):
+  for package_name in ['sensu-go-agent', 'sensu-go-cli', 'sensu-go-backend']:
+    package = host.package(package_name)
+    assert package.is_installed
+
+def test_services(host):
+  for service_name in ['sensu-backend', 'sensu-agent']:
+    service = host.service(service_name)
+    assert service.is_running
+    assert service.is_enabled
+
+def test_sockets(host):
+  for port in [3000, 8080, 8081]:
+    socket = host.socket('tcp://0.0.0.0:%d' % (port))
+    assert socket.is_listening
+
+def test_configure_sensuctl(host):
+  cmd = host.run('sensuctl configure -n --password "P@ssw0rd!" --url http://127.0.0.1:8080 --username admin --format tabular')
+  assert cmd.succeeded
+
+def test_sensu_namespace(host):
+  cmd = host.run('sensuctl namespace list')
+  assert cmd.succeeded
+  assert 'production' in cmd.stdout
+  assert 'dev' in cmd.stdout
+
+def test_sensu_user(host):
+  cmd = host.run('sensuctl user list')
+  assert cmd.succeeded
+  assert re.search('johndoe.*\\s+devops,users\\s+.*true', cmd.stdout)
+
+def test_sensu_entity(host):
+  cmd = host.run('sensuctl entity info debian10 --format json')
+  assert cmd.succeeded
+  assert '"supersecret": "REDACTED"' in cmd.stdout
+
+def test_sensu_check(host):
+  for namespace in ['production', 'dev']:
+    cmd = host.run('sensuctl asset list --namespace  %s' % namespace)
+    assert cmd.succeeded
+    assert re.search('superasset.*\\s+.*test.sh\\s+cf83e13', cmd.stdout)
+
+    cmd = host.run('sensuctl mutator list --namespace  %s' % namespace)
+    assert cmd.succeeded
+    assert re.search('transform.*\\s+.*/path/value_to_csv', cmd.stdout)
+
+    cmd = host.run('sensuctl handler list --namespace  %s' % namespace)
+    assert cmd.succeeded
+    assert re.search('mail.*\\s+pipe\\s+.*echo test | mail -s coucou\\s+', cmd.stdout)
+
+    cmd = host.run('sensuctl check list --namespace  %s' % namespace)
+    assert cmd.succeeded
+    assert re.search('ping.*\\s+ping -c 1 127.0.0.1\\s+60\\s+.*\\s+linux\\s+', cmd.stdout)
+
+    cmd = host.run('sensuctl filter list --namespace  %s' % namespace)
+    assert cmd.succeeded
+    assert re.search('state_changed.*\\s+allow\\s+\\(event.check.occurrences == 1\\)', cmd.stdout)
+
+    cmd = host.run('sensuctl hook list --namespace  %s' % namespace)
+    assert cmd.succeeded
+    assert re.search('restart-apache.*\\s+/etc/init.d/apache2 restart\\s+10\\s+false', cmd.stdout)

tasks/agent.yml

@@ -1,12 +1,11 @@
 ---
 - name: install sensu-agent packages
-  apt:
+  package:
     name: '{{ packages }}'
   vars:
     packages:
       - sensu-go-agent
       - sensu-plugins-ruby
-      - monitoring-plugins-basic
   register: result
   retries: 3
   delay: 1

tasks/backend-dependencies-debian.yml

@@ -0,0 +1,11 @@
+---
+- name: install backend dependencies
+  package:
+    name:
+      - python-requests
+      - python3-requests
+  register: result
+  retries: 3
+  delay: 1
+  until: result is success
+  tags: sensu

tasks/backend-dependencies-redhat.yml

@@ -0,0 +1,27 @@
+---
+- name: uninstall bad dependencies
+  package:
+    name: '{{ packages }}'
+    state: absent
+  vars:
+    packages:
+      - python-urllib3
+      - python-requests
+  register: result
+  retries: 1
+  delay: 1
+  until: result is success
+  tags: sensu
+
+- name: install backend dependencies
+  pip:
+    name: '{{ packages }}'
+  vars:
+    packages:
+      - urllib3
+      - requests
+  register: result
+  retries: 3
+  delay: 1
+  until: result is success
+  tags: sensu

tasks/backend.yml

@@ -1,6 +1,8 @@
 ---
+- include_tasks: 'backend-dependencies-{{ ansible_os_family|lower }}.yml'
+
 - name: install sensu-backend packages
-  apt:
+  package:
     name: '{{ packages }}'
   vars:
     packages:
@@ -35,18 +37,22 @@
     delay: 5
   tags: sensu
 
-- name: manage users
+- name: init backend
-  sensugo_user:
+  command:
-    name: '{{ item.name }}'
+    cmd: sensu-backend init
-    groups: '{{ item.groups }}'
+    creates: /etc/sensu/.backend-init
-    password: '{{ item.password }}'
+  environment:
-    state: '{{ item.state|default("present") }}'
+    SENSU_BACKEND_CLUSTER_ADMIN_USERNAME: '{{ sensu_api_user }}'
-    api_url: '{{ sensu_api_url }}'
+    SENSU_BACKEND_CLUSTER_ADMIN_PASSWORD: '{{ sensu_api_password }}'
-    api_user: '{{ sensu_api_user }}'
+  tags: sensu
-    api_password: '{{ sensu_api_password }}'
+
-  loop: '{{ sensu_users }}'
+- name: hold init
-  run_once: true
+  copy:
-  no_log: true
+    content: ''
+    dest: /etc/sensu/.backend-init
+    owner: root
+    group: root
+    mode: 0600
   tags: sensu
 
 - name: manage cluster roles
@@ -58,8 +64,24 @@
     api_user: '{{ sensu_api_user }}'
     api_password: '{{ sensu_api_password }}'
   loop: '{{ sensu_cluster_roles }}'
+  loop_control:
+    label: '{{ item.name }}'
+  run_once: true
+  tags: sensu
+
+- name: manage users
+  sensugo_user:
+    name: '{{ item.name }}'
+    groups: '{{ item.groups }}'
+    password: '{{ item.password }}'
+    state: '{{ item.state|default("present") }}'
+    api_url: '{{ sensu_api_url }}'
+    api_user: '{{ sensu_api_user }}'
+    api_password: '{{ sensu_api_password }}'
+  loop: '{{ sensu_users }}'
+  loop_control:
+    label: '{{ item.name }}'
   run_once: true
-  no_log: true
   tags: sensu
 
 - name: manage namespaces
@@ -70,14 +92,15 @@
     api_user: '{{ sensu_api_user }}'
     api_password: '{{ sensu_api_password }}'
   loop: '{{ sensu_namespaces }}'
+  loop_control:
+    label: '{{ item.name }}'
   run_once: true
-  no_log: true
   tags: sensu
 
 - name: manage assets
   sensugo_asset:
     name: '{{ item.name }}'
-    namespace: '{{ item.namespace|default("default") }}'
+    namespaces: '{{ item.namespaces|default(["default"]) }}'
     url: '{{ item.url }}'
     sha512: '{{ item.sha512 }}'
     filters: '{{ item.filters|default([]) }}'
@@ -85,14 +108,15 @@
     api_user: '{{ sensu_api_user }}'
     api_password: '{{ sensu_api_password }}'
   loop: '{{ sensu_assets }}'
+  loop_control:
+    label: '{{ item.name }}'
   run_once: true
-  no_log: true
   tags: sensu
 
 - name: manage filters
   sensugo_filter:
     name: '{{ item.name }}'
-    namespace: '{{ item.namespace|default("default") }}'
+    namespaces: '{{ item.namespaces|default(["default"]) }}'
     action: '{{ item.action|default("allow") }}'
     expressions: '{{ item.expressions }}'
     runtime_assets: '{{ item.runtime_assets|default([]) }}'
@@ -101,14 +125,30 @@
     api_user: '{{ sensu_api_user }}'
     api_password: '{{ sensu_api_password }}'
   loop: '{{ sensu_filters }}'
+  loop_control:
+    label: '{{ item.name }}'
+  run_once: true
+  tags: sensu
+
+- name: manage mutators
+  sensugo_mutator:
+    name: '{{ item.name }}'
+    namespaces: '{{ item.namespaces|default(["default"]) }}'
+    command: '{{ item.command }}'
+    options: '{{ item.options|default({}) }}'
+    api_url: '{{ sensu_api_url }}'
+    api_user: '{{ sensu_api_user }}'
+    api_password: '{{ sensu_api_password }}'
+  loop: '{{ sensu_mutators }}'
+  loop_control:
+    label: '{{ item.name }}'
   run_once: true
-  no_log: true
   tags: sensu
 
 - name: manage handlers
   sensugo_handler:
     name: '{{ item.name }}'
-    namespace: '{{ item.namespace|default("default") }}'
+    namespaces: '{{ item.namespaces|default(["default"]) }}'
     type: '{{ item.type|default("pipe") }}'
     command: '{{ item.command }}'
     filters: '{{ item.filters|default([]) }}'
@@ -117,14 +157,31 @@
     api_user: '{{ sensu_api_user }}'
     api_password: '{{ sensu_api_password }}'
   loop: '{{ sensu_handlers }}'
+  loop_control:
+    label: '{{ item.name }}'
+  run_once: true
+  tags: sensu
+
+- name: manage hooks
+  sensugo_hook:
+    name: '{{ item.name }}'
+    namespaces: '{{ item.namespaces|default(["default"]) }}'
+    command: '{{ item.command }}'
+    timeout: '{{ item.timeout|default(10) }}'
+    api_url: '{{ sensu_api_url }}'
+    api_user: '{{ sensu_api_user }}'
+    api_password: '{{ sensu_api_password }}'
+  loop: '{{ sensu_hooks }}'
+  loop_control:
+    label: '{{ item.name }}'
   run_once: true
-  no_log: true
   tags: sensu
 
 - name: manage checks
   sensugo_check:
     name: '{{ item.name }}'
-    namespace: '{{ item.namespace|default("default") }}'
+    namespaces: '{{ item.namespaces|default(["default"]) }}'
+    labels: '{{ item.labels|default({}) }}'
     command: '{{ item.command }}'
     handlers: '{{ item.handlers|default([]) }}'
     subscriptions: '{{ item.subscriptions }}'
@@ -135,6 +192,7 @@
     api_user: '{{ sensu_api_user }}'
     api_password: '{{ sensu_api_password }}'
   loop: '{{ sensu_checks }}'
+  loop_control:
+    label: '{{ item.name }}'
   run_once: true
-  no_log: true
   tags: sensu

tasks/main.yml

@@ -1,8 +1,8 @@
 ---
-- import_tasks: repository.yml
+- include_tasks: 'repository-{{ ansible_os_family|lower }}.yml'
 
 - import_tasks: agent.yml
-  when: sensu_agent
+  when: sensu_agent|bool
 
 - import_tasks: backend.yml
-  when: sensu_backend
+  when: sensu_backend|bool

tasks/repository-debian.yml

@@ -1,6 +1,6 @@
 ---
 - name: install dependencies packages
-  apt:
+  package:
     name: '{{ packages }}'
   vars:
     packages:
@@ -8,6 +8,7 @@
       - ca-certificates
       - gnupg2
       - software-properties-common
+      - build-essential
   register: result
   retries: 3
   delay: 1

tasks/repository-redhat.yml

@@ -0,0 +1,13 @@
+---
+- name: add sensu repository
+  yum_repository:
+    name: sensu-{{ item }}
+    description: Sensu {{ item }} repository
+    gpgkey: 'https://packagecloud.io/sensu/{{ item }}/gpgkey'
+    gpgcheck: false
+    repo_gpgcheck: true
+    baseurl: 'https://packagecloud.io/sensu/{{ item }}/el/$releasever/$basearch'
+  loop:
+    - stable
+    - community
+  tags: sensu

test/integration/default/serverspec/default_spec.rb

@@ -1,78 +0,0 @@
-require 'serverspec'
-
-set :backend, :exec
-
-puts
-puts '================================'
-puts %x(ansible --version)
-puts '================================'
-
-%w[
-  sensu-go-agent
-  sensu-go-cli
-  sensu-go-backend
-  monitoring-plugins-basic
-].each do |package|
-  describe package(package) do
-    it { should be_installed }
-  end
-end
-
-%w[
-  sensu-agent
-  sensu-backend
-].each do |service|
-  describe service(service) do
-    it { should be_enabled }
-    it { should be_running }
-    it { should be_running.under('systemd') }
-  end
-end
-
-[3000, 8080, 8081].each do |port|
-  describe port(port) do
-    it { should be_listening.with('tcp6') }
-  end
-end
-
-describe command(
-  'sensuctl configure -n --password "P@ssw0rd!" ' \
-  '--url http://127.0.0.1:8080 --username admin --format tabular'
-) do
-  its(:exit_status) { should eq 0 }
-end
-
-describe command('sensuctl namespace list') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should match 'supernamespace' }
-end
-
-describe command('sensuctl user list') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should match(/johndoe.*\s+devops,users\s+.*true/) }
-end
-
-describe command('sensuctl asset list') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should match(/superasset.*\s+.*test.sh\s+cf83e13/) }
-end
-
-describe command('sensuctl handler list') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should match(/mail.*\s+pipe\s+.*echo test \| mail -s coucou\s+/) }
-end
-
-describe command('sensuctl filter list') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should match(/state_changed.*\s+allow\s+event\.check\.occurrences == 1/) }
-end
-
-describe command('sensuctl cluster-role list') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should match(/view.*\s+1/) }
-end
-
-describe command('sensuctl check list') do
-  its(:exit_status) { should eq 0 }
-  its(:stdout) { should match(/ping.*\s+ping -c 1 127.0.0.1\s+60\s+.*\s+linux\s+/) }
-end

test/integration/inventory

@@ -1,2 +0,0 @@
-[default]
-localhost