diff --git a/roles/alertmanager/README.md b/roles/alertmanager/README.md new file mode 100644 index 0000000..a8a57da --- /dev/null +++ b/roles/alertmanager/README.md @@ -0,0 +1,53 @@ +genlab.alertmanager +========= + +The [Alertmanager](https://github.com/prometheus/alertmanager) handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integration such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts. + +You'll need to manually specify the paths to your template files in the main Alertmanager configuration file (`alertmanager.yml`) on the target machine. The configuration file must have a `.yml` suffix, and template files must use a `.tmpl` suffix. + +Requirements +------------ + +None + +Role Variables +-------------- + +``` +alertmanager_version: 0.28.1 # version of Alertmanager (AM) +config_dir: "/etc/alertmanager/conf" # where to place AM configs +storage_dir: "/var/lib/alertmanager" # path to AM storage +alertmanager_dir: "/etc/alertmanager" # where to install AM on target +alertmanager_user: "alertmanager" # system user name +alertmanager_group: "alertmanager" # system group name +config_source_dir: "./alertmanager" # path to config files on source + +# Optional +template_source_dir: "./templates" # path to template files on source +``` + +Dependencies +------------ + +None + +Example Playbook +---------------- + +```yaml +roles: + - role: genlab.template + config_source_dir: alertmanager + alertmanager_version: 0.28.1 + +``` + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/alertmanager/defaults/main.yml b/roles/alertmanager/defaults/main.yml new file mode 100644 index 0000000..88707b3 --- /dev/null +++ b/roles/alertmanager/defaults/main.yml @@ -0,0 +1,7 @@ +--- +alertmanager_version: 0.28.1 +config_dir: "/etc/alertmanager/conf" +storage_dir: "/var/lib/alertmanager" +alertmanager_dir: "/etc/alertmanager" +alertmanager_user: alertmanager +alertmanager_group: alertmanager diff --git a/roles/alertmanager/handlers/main.yml b/roles/alertmanager/handlers/main.yml new file mode 100644 index 0000000..4a0e813 --- /dev/null +++ b/roles/alertmanager/handlers/main.yml @@ -0,0 +1,7 @@ +--- +- name: "(Re)start and enable Alertmanager" + ansible.builtin.systemd_service: + name: alertmanager.service + state: restarted + enabled: true + daemon_reload: true diff --git a/roles/alertmanager/meta/main.yml b/roles/alertmanager/meta/main.yml new file mode 100644 index 0000000..942b852 --- /dev/null +++ b/roles/alertmanager/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: "alertmanager" + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "" + license: "MIT" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: [ "focal", "jammy", "noble" ] + + galaxy_tags: [ ] + +dependencies: [] diff --git a/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml new file mode 100644 index 0000000..7c3bff0 --- /dev/null +++ b/roles/alertmanager/molecule/default/alertmanager/alertmanager.yml @@ -0,0 +1,36 @@ +global: + # SMTP configuration for email notifications (if needed) + smtp_smarthost: 'mailserver.example.com:587' + smtp_from: 'alertmanager@example.com' + smtp_auth_username: 'alertmanager' + smtp_auth_password: 'your_password' + + # Other global settings like resolve_timeout, http_config, etc. + +route: + # Default receiver for alerts + receiver: 'default-receiver' + + # Labels used for grouping alerts + group_by: ['alertname', 'instance', 'severity'] + + # Timing settings (group_wait, group_interval, repeat_interval) + # You can have nested 'routes' for more complex routing logic + +receivers: + - name: 'default-receiver' + email_configs: + - to: 'ops-team@example.com' + +inhibit_rules: + # Rules to suppress alerts based on other alerts + # Example: + - source_match: + severity: 'critical' + target_match: + severity: 'warning' + # Suppress 'warning' alerts if a 'critical' alert is also firing + +templates: + # Paths to template files for customizing notifications + - '/etc/alertmanager/templates/*.tmpl' \ No newline at end of file diff --git a/roles/alertmanager/molecule/default/converge.yml b/roles/alertmanager/molecule/default/converge.yml new file mode 100644 index 0000000..3f7be92 --- /dev/null +++ b/roles/alertmanager/molecule/default/converge.yml @@ -0,0 +1,6 @@ +--- +- name: Converge + hosts: all + roles: + - role: genlab.alertmanager + config_source_dir: alertmanager diff --git a/roles/alertmanager/molecule/default/molecule.yml b/roles/alertmanager/molecule/default/molecule.yml new file mode 100644 index 0000000..d82158e --- /dev/null +++ b/roles/alertmanager/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2404}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/alertmanager/molecule/default/verify.yml b/roles/alertmanager/molecule/default/verify.yml new file mode 100644 index 0000000..0836d76 --- /dev/null +++ b/roles/alertmanager/molecule/default/verify.yml @@ -0,0 +1,55 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + + tasks: + + - name: "Include default vars" + ansible.builtin.include_vars: + dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults/" + extensions: [ 'yml' ] + + - name: "Check if Alertmanager is installed" + changed_when: false + ansible.builtin.command: "alertmanager --version" + register: alertmanager_installed_version + + - name: "Check Alertmanager version" + ansible.builtin.assert: + that: "alertmanager_installed_version.stdout is regex('{{ alertmanager_version }}')" + success_msg: "Alertmanager version {{ alertmanager_version }} is installed and working" + fail_msg: "Alertmanager version {{ alertmanager_version }} is not installed or not working correctly" + + # kics-scan ignore-block + - name: "Check if Alertmanager is reachable" + ansible.builtin.uri: + url: "http://localhost:9093/-/healthy" + return_content: true + status_code: 200 + method: GET + body_format: json + register: alertmanager_health + + - name: "Assert Alertmanager health status" + ansible.builtin.assert: + that: "alertmanager_health.content == 'OK'" + success_msg: "Alertmanager is healthy" + fail_msg: "Alertmanager is not healthy" + + # kics-scan ignore-block + - name: "Check if Alertmanager is ready" + ansible.builtin.uri: + url: "http://localhost:9093/-/ready" + return_content: true + status_code: 200 + method: GET + body_format: json + register: alertmanager_ready + + - name: "Assert Alertmanager readiness status" + ansible.builtin.assert: + that: "alertmanager_ready.content == 'OK'" + success_msg: "Alertmanager is ready" + fail_msg: "Alertmanager is not ready" diff --git a/roles/alertmanager/tasks/configuration.yml b/roles/alertmanager/tasks/configuration.yml new file mode 100644 index 0000000..4932c8e --- /dev/null +++ b/roles/alertmanager/tasks/configuration.yml @@ -0,0 +1,24 @@ +--- + +- name: "Copy config file" + notify: "(Re)start and enable Alertmanager" + ansible.builtin.template: + src: "{{ item }}" + dest: "{{ config_dir }}/{{ item | basename }}" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0660" + with_fileglob: + - "{{ config_source_dir }}/*.yml" + +- name: "Copy templates if existed" + notify: "(Re)start and enable Alertmanager" + when: template_source_dir is defined + ansible.builtin.copy: + src: "{{ item }}" + dest: "{{ config_dir }}/{{ item | basename }}" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0660" + with_fileglob: + - "{{ template_source_dir }}/*.tmpl" diff --git a/roles/alertmanager/tasks/install.yml b/roles/alertmanager/tasks/install.yml new file mode 100644 index 0000000..f97a99e --- /dev/null +++ b/roles/alertmanager/tasks/install.yml @@ -0,0 +1,85 @@ +--- +- name: "Create Alertmanager system group" + ansible.builtin.group: + name: "{{ alertmanager_user }}" + system: true + state: present + +- name: "Create Alertmanager system user" + ansible.builtin.user: + name: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + system: true + shell: "/sbin/nologin" + create_home: false + state: present + +- name: "Install Alertmanager from binary" + block: + - name: "Check Alertmanager version" + changed_when: false + ansible.builtin.command: + cmd: "alertmanager --version" + register: alertmanager_ver + + - name: "Assert version correctness" + ansible.builtin.assert: + that: "alertmanager_ver.stdout is regex('{{ alertmanager_version }}')" + success_msg: "alertmanager version {{ alertmanager_version }} is installed and working" + fail_msg: "alertmanager version {{ alertmanager_version }} is not installed or not working correctly" + + rescue: + - name: "Create Alertmanager directories '{{ item }}'" + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0755" + with_items: + - "{{ config_dir }}" + - "{{ alertmanager_dir }}" + - "{{ storage_dir }}" + + - name: "Download Alertmanager binary" + ansible.builtin.get_url: + url: "https://github.com/prometheus/alertmanager/releases/download/v{{ alertmanager_version }}/\ + alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + dest: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0644" + + - name: "Unpack Alertmanager binaries" + notify: "(Re)start and enable Alertmanager" + ansible.builtin.unarchive: + src: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + dest: "{{ alertmanager_dir }}" + creates: "{{ alertmanager_dir }}/alertmanager-{{ alertmanager_version }}.linux-amd64" + remote_src: true + + - name: "Cleanup downloaded file" + ansible.builtin.file: + path: "/tmp/alertmanager-{{ alertmanager_version }}.linux-amd64.tar.gz" + state: absent + + - name: "Move official alertmanager and amtool binaries" + ansible.builtin.copy: + src: "{{ alertmanager_dir }}/alertmanager-{{ alertmanager_version }}.linux-amd64/{{ item }}" + dest: "/usr/local/bin/{{ item }}" + mode: "0755" + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + remote_src: true + with_items: + - alertmanager + - amtool + + +- name: "Create systemd service unit" + ansible.builtin.template: + src: alertmanager.service.j2 + dest: /etc/systemd/system/alertmanager.service + owner: "{{ alertmanager_user }}" + group: "{{ alertmanager_group }}" + mode: "0660" diff --git a/roles/alertmanager/tasks/main.yml b/roles/alertmanager/tasks/main.yml new file mode 100644 index 0000000..6bd62b2 --- /dev/null +++ b/roles/alertmanager/tasks/main.yml @@ -0,0 +1,9 @@ +--- +- name: "Run installation tasks" + ansible.builtin.include_tasks: install.yml + +- name: "Run configuration tasks" + ansible.builtin.include_tasks: configuration.yml + +- name: "Flush handlers" + ansible.builtin.meta: "flush_handlers" diff --git a/roles/alertmanager/templates/alertmanager.service.j2 b/roles/alertmanager/templates/alertmanager.service.j2 new file mode 100644 index 0000000..e4ee45a --- /dev/null +++ b/roles/alertmanager/templates/alertmanager.service.j2 @@ -0,0 +1,27 @@ +[Unit] +Description=Alertmanager Service +After=network.target +Documentation="https://prometheus.io/docs/alerting/latest/alertmanager/" + +[Service] +User={{ alertmanager_user }} +Group={{ alertmanager_group }} +Type=simple +ExecStart=/usr/local/bin/alertmanager \ + --config.file={{ config_dir }}/alertmanager.yml \ + --storage.path={{ storage_dir }} +Restart=on-failure + +# Security hardening +ReadWritePaths={{ storage_dir }} +ProtectSystem=strict +NoNewPrivileges=true +PrivateTmp=true +ProtectKernelModules=true +ProtectControlGroups=true +ProtectKernelTunables=true +ProtectClock=yes +RestrictSUIDSGID=true + +[Install] +WantedBy=multi-user.target \ No newline at end of file diff --git a/roles/alertmanager/vars/main.yml b/roles/alertmanager/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/alertmanager/vars/main.yml @@ -0,0 +1 @@ +---