NRPE Server returns Nagios is not allowed if it is running using fan-networking

[Pedro Guimarães]

Scenario:

Nagios deployed on top of LXD using fan-networking (Nagios host IP: 10.66.0.15 in this deployment)
Host running on OpenStack, with both fan-252 and tenant interfaces well defined

Fan-network in itself seems to be working since Nagios can ssh into host; host can ssh into Nagios with no problem.

I can see on Host's nrpe-server service:

$ sudo systemctl status nagios-nrpe-server.service
● nagios-nrpe-server.service - Nagios Remote Plugin Executor
   Loaded: loaded (/lib/systemd/system/nagios-nrpe-server.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2019-07-31 21:02:39 UTC; 16h ago
     Docs: http://www.nagios.org/documentation
 Main PID: 30943 (nrpe)
    Tasks: 1 (limit: 4915)
   CGroup: /system.slice/nagios-nrpe-server.service
           └─30943 /usr/sbin/nrpe -c /etc/nagios/nrpe.cfg -f

Aug 01 13:06:33 juju-d3ac24-kubernetes-1 nrpe[32611]: Host 10.66.0.15 is not allowed to talk to us!
Aug 01 13:06:48 juju-d3ac24-kubernetes-1 nrpe[618]: Host 10.66.0.15 is not allowed to talk to us!
Aug 01 13:07:50 juju-d3ac24-kubernetes-1 nrpe[2320]: Host 10.66.0.15 is not allowed to talk to us!
Aug 01 13:08:05 juju-d3ac24-kubernetes-1 nrpe[2356]: Host 10.66.0.15 is not allowed to talk to us!
Aug 01 13:09:14 juju-d3ac24-kubernetes-1 nrpe[7278]: Host 10.66.0.15 is not allowed to talk to us!
Aug 01 13:10:23 juju-d3ac24-kubernetes-1 nrpe[7989]: Host 10.66.0.15 is not allowed to talk to us!
Aug 01 13:10:58 juju-d3ac24-kubernetes-1 nrpe[8219]: Host 10.66.0.15 is not allowed to talk to us!
Aug 01 13:11:32 juju-d3ac24-kubernetes-1 nrpe[9389]: Host 10.66.0.15 is not allowed to talk to us!
Aug 01 13:11:33 juju-d3ac24-kubernetes-1 nrpe[9406]: Host 10.66.0.15 is not allowed to talk to us!
Aug 01 13:11:59 juju-d3ac24-kubernetes-1 nrpe[10866]: Host 10.66.0.15 is not allowed to talk to us!

Which means nrpe-server is not aware that Nagios is reaching out through its own host IP

[Nobuto Murata (nobuto)]

I was hit by this too. I think the fundamental part would be that Juju doesn't offer a convenient way to retrieve those Fan addresses and when to use it.
https://bugs.launchpad.net/juju/+bug/1861277

[Xav Paice (xavpaice)]

See https://bugs.launchpad.net/juju/+bug/1861277

[Xav Paice (xavpaice)]

Looking at the code for this charm, the egress-subnets provided by juju is a single address (on the nagios unit) even though bind-addresses and incress-addresses shows all the IPs. If egress-subnets was able to provide all the possible egress subnets, the nrpe charm would pick these up and add them to the config file.

[Xav Paice (xavpaice)]

Workaround till this is working: juju config nrpe nagios_master=252.46.155.1

[Xav Paice (xavpaice)]

On the Nagios host:
$ juju run --unit nagios/0 'network-get public'
bind-addresses:
- macaddress: fa:16:3e:01:32:39
  interfacename: ens2
  addresses:
  - hostname: ""
    address: 10.48.131.32
    cidr: 10.48.128.0/17
  - hostname: ""
    address: 10.48.131.32
    cidr: 10.48.128.0/17
- macaddress: ae:81:9a:5c:80:ed
  interfacename: fan-252
  addresses:
  - hostname: ""
    address: 252.6.64.1
    cidr: 252.0.0.0/8
egress-subnets:
- 10.48.131.32/32
ingress-addresses:
- 10.48.131.32
- 10.48.131.32
- 252.6.64.1

Relation data from the nrpe unit:
$ u=nrpe/6; r=monitors ; juju run --unit $u "relation-ids $r| xargs -I_@ sh -c 'relation-list -r _@|xargs -I_U sh -c \"relation-get -r _@ - _U |sed s,^,_U:, 2>&1\"'"
nagios/0:egress-subnets: 10.48.131.32/32
nagios/0:ingress-address: 10.48.131.32
nagios/0:private-address: 10.48.131.32

If the egress-subnets included the fanout address as well, nrpe would pick it up and add it to the config file. Both addresses can be used for egress.

[Eric Chen (eric-chen)]

Close this issue because of no update of this issue over 1 year.