check_etcd

#!/bin/bash
# vim: set ts=4 sw=4 noet:

# MIT License
#
# Copyright (c) 2018 Ahmed Bessifi
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

ETCD_ENDPOINTS=${ETCDCTL_ENDPOINTS:-https://127.0.0.1:2379}
ETCD_PEER_CERT="${ETCDCTL_CERT:-}"
ETCD_PEER_KEY="${ETCDCTL_KEY:-}"
ETCD_PEER_CACERT="${ETCDCTL_CACERT:-}"
ETCD_USER="${ETCDCTL_USER:-}"
ETCD_PASSWORD="${ETCDCTL_PASSWORD:-}"
ETCD_INSECURE_TRANSPORT=${ETCDCTL_INSECURE_TRANSPORT:-true}
ETCD_SKIP_TLS_VERIFY=${ETCDCTL_SKIP_TLS_VERIFY:-false}

NAGIOS_WARNING=""
NAGIOS_CRITICAL=""

OUTPUT_MSG="UNKNOWN"
EXIT_CODE=3

# PATH FIX for NRPE
LOCAL_PATH="$HOME/go/bin:/usr/bin:/usr/local/bin:/bin:/sbin/:/usr/sbin/:$PATH"

usage(){

    echo \
"
NAME:
	check_etcd - Nagios Module for Check ETCD Database

USAGE:
	$0 [flags]

COMMANDS:
    health                             Get Etcd cluster health
    alpr                               Get Average Latency Per Request

OPTIONS:
    --endpoint=[127.0.0.1:2379]		     gRPC endpoints
    --cacert=\"\"                      verify certificates of TLS-enabled secure servers using this CA bundle
    --cert=\"\"                        identify secure client using this TLS certificate file
    --key=\"\"                         identify secure client using this TLS key file
    --user=\"\"                        username[:password] for authentication (prompt if password is not supplied)
    --password=\"\"                    password for authentication (if this option is used, --user option shouldn't include password)
    --insecure-transport[=true]		     disable transport security for client connections
    --insecure-skip-tls-verify[=false] skip server certificate verification (CAUTION: this option should be enabled only for testing purposes)
-w, --warning                          nagios warning threshold
-c, --critical                         nagios cricial threshold
ENV VARS:
    ETCDCTL_ENDPOINTS
    ETCDCTL_CERT
    ETCDCTL_KEY
    ETCDCTL_CACERT
"
    exit 3
}

get_endpoint_host(){
  echo $(echo "${ETCD_ENDPOINTS}"|sed -E 's/^\s*.*:\/\///g')
}


setup(){
  # Create a tmp file to save the `etcdctl` output there
  TMP_FILE=$(mktemp /tmp/.check-etcd.XXXXXX)
}

teardown(){
  # Remove tmp file before exit
  rm -f $TMP_FILE
}

# Get Average Latency Per Request with linearized consistency.
# Linearizable read requests go through a quorum of cluster members for consensus to fetch the most recent data.
get-alpr(){

  # The Average Latency Per Request threshold are as follow:
  # OK: average_latency_per_request < 0.1s
  # WARNING: 0.1s <= average_latency_per_request < 1s
  # CRITICAL: average_latency_per_request >= 1s

  average_latency_per_request=$(PATH=$LOCAL_PATH benchmark --cert ${ETCD_PEER_CERT} --key ${ETCD_PEER_KEY} --cacert ${ETCD_PEER_CACERT} --endpoints $(get_endpoint_host) --conns=1 --clients=1 range /dummy --consistency=l --total=1 | awk '/.*Average/  { print $2 }')

  if [ $(echo "$average_latency_per_request < ${NAGIOS_WARNING:-0.1}" | bc -l) -eq 1 ]; then
    OUTPUT_MSG="OK - Average Latency Per Request: ${average_latency_per_request} secs"
    EXIT_CODE=0
  elif [ $(echo "($average_latency_per_request >= ${NAGIOS_WARNING:-0.1}) && ($average_latency_per_request < ${NAGIOS_CRITICAL:-1})" | bc -l) -eq 1 ]; then
    OUTPUT_MSG="WARNING - Average Latency Per Request: ${average_latency_per_request} secs"
    EXIT_CODE=1
  else
    OUTPUT_MSG="CRITICAL - Average Latency Per Request: ${average_latency_per_request} secs"
    EXIT_CODE=2
  fi

}

# Check the status.
# We assume that the server is listening to the standard port 2379 and the TLS certs and key are named as follow.
get-health(){
    PATH=$LOCAL_PATH \
    ETCDCTL_ENDPOINTS=${ETCD_ENDPOINTS} \
    ETCDCTL_CERT="${ETCD_PEER_CERT}" \
    ETCDCTL_KEY="${ETCD_PEER_KEY}" \
    ETCDCTL_CACERT="${ETCD_PEER_CACERT}" \
      etcdctl \
          --user=${ETCD_USER} \
          --password=${ETCD_PASSWORD} \
          --insecure-transport=${ETCD_INSECURE_TRANSPORT} \
          --insecure-skip-tls-verify=${ETCD_SKIP_TLS_VERIFY} \
          endpoint health > $TMP_FILE

  # Get the check command return code
  etcd_check_cluster_rc=$?

  # Prepare output message according to the cluster state
  if [ $(grep -Fc ' is healthy' $TMP_FILE) -eq 1 ] && [ $etcd_check_cluster_rc -eq 0  ]; then
    OUTPUT_MSG="OK - ETCD state: healthy"
    EXIT_CODE=0
  else
    OUTPUT_MSG="CRITICAL - ETCD state: unhealthy"
    EXIT_CODE=2
  fi
}

#
# main()
#
# Exit with error if no args
if [ $# -eq 0 ]; then
  usage
  exit 3
fi

COMMAND_NAME=$1

shift
while [[ "$#" -gt 0 ]]; do
    case "$1" in
        --endpoint)
            shift
            ETCD_ENDPOINTS=${1}
            ;;
        --cacert)
            shift
            ETCD_PEER_CACERT=${1}
            ;;
        --key)
            shift
            ETCD_PEER_KEY=${1}
            ;;
        --cert)
            shift
            ETCD_PEER_CERT=${1}
            ;;
        --user)
            shift
            ETCD_USER=${1}
            ;;
        --password)
            shift
            ETCD_PASSWORD=${1}
            ;;
        --insecure-transport)
            shift
            ETCD_INSECURE_TRANSPORT=${1}
            ;;
        --insecure-skip-tls-verify)
            shift
            ETCD_SKIP_TLS_VERIFY=${1}
            ;;
        
        -w \
       | --warning )
            shift
            NAGIOS_WARNING=${1}
            ;;
        -c \
       | --critical)
            shift
            NAGIOS_CRITICAL=${1}
            ;;
        *)
            echo "Invalid command line flag $1" >&2
            exit 1
            ;;
    esac
    shift
done

setup

if [ $COMMAND_NAME == "health" ]; then
  get-health
elif [ $COMMAND_NAME == "alpr" ]; then
  get-alpr
fi

teardown

echo $OUTPUT_MSG
exit $EXIT_CODE