Add Makefile

[vaultmon/.git] / vault.go

package main

import (
	"encoding/json"
	"fmt"
	"io/ioutil"
	"net/http"

	log "github.com/sirupsen/logrus"
)

const (
	HealthEndpointURL = "/v1/sys/health"
	LeaderEndpointURL = "/v1/sys/leader"

	// Vault Health Status https://www.vaultproject.io/api/system/health.html
	VaultActive   = http.StatusOK
	VaultStandby  = http.StatusTooManyRequests
	VaultRecovery = 472
	VaultNotReady = http.StatusNotImplemented
	VaultSealed   = http.StatusServiceUnavailable
)

type Vault struct {
	URL              string
	ConnectionStatus string
	ClusterStatus    string
}

type VaultSealedResult struct {
	Sealed bool `json:"sealed"`
}

func (v *Vault) CheckHealth() (bool, error) {
	healthURL := v.URL + HealthEndpointURL
	cnx := NewConnection(healthURL)
	log.Debugf("Vault Connection on %s", healthURL)
	resp, err := cnx.Head()
	if err != nil {
		return false, err
	}
	defer resp.Body.Close()

	log.Debugf("Vault CheckHealth response: %s", resp.Status)

	return isHealthy(resp.StatusCode), nil
}

func (v *Vault) CheckCluster() (bool, error) {
	vaultFilter := make(map[string]string)
	vaultFilter["Name"] = "tag:Cluster"
	vaultFilter["Value"] = "theknowledge"

	provider := newEC2Provider()
	vaultNodeIps, err := provider.GetInstancesPrivateIps(vaultFilter)
	if err != nil {
		return false, err
	}

	for _, nodeIp := range vaultNodeIps {
		healthURL := "https://" + nodeIp + ":8200" + HealthEndpointURL
		if sealed, err := isSealed(healthURL); sealed {
			return false, err
		}
	}

	return true, nil
}

func isHealthy(statusCode int) bool {
	return statusCode == VaultActive || statusCode == VaultStandby
}

func isSealed(healthURL string) (bool, error) {
	cnx := NewConnection(healthURL)
	log.Debugf("Vault isSealed node connection on %s", healthURL)
	resp, err := cnx.Get()
	if err != nil {
		return false, err
	}
	defer resp.Body.Close()

	log.Debugf("Vault isSealed connection response: %s", resp.Status)
	if resp.StatusCode == VaultSealed {
		return true, nil
	}

	buf, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return false, err
	}

	var result VaultSealedResult

	err = json.Unmarshal(buf, &result)
	if err != nil {
		return false, err
	}

	log.Debugf("Vault isSealed JSON result: %+v", result)

	return result.Sealed, nil
}

func (v *Vault) Test() (bool, string) {
	// test health
	result, err := v.CheckHealth()
	if err != nil {
		log.Errorf("Vault CheckHealth error: %s", err)
		v.ConnectionStatus = "KO"
	}

	if result == false {
		v.ConnectionStatus = "KO"
	} else {
		v.ConnectionStatus = "OK"
	}
	log.Debugf("Vault CheckHealth result: %t", result)

	// test cluster
	result, err = v.CheckCluster()
	if err != nil {
		log.Errorf("Vault CheckCluster error: %s", err)
		v.ClusterStatus = "KO"
	}

	if result == false {
		v.ClusterStatus = "KO"
	} else {
		v.ClusterStatus = "OK"
	}
	log.Debugf("Vault CheckCluster result: %t", result)

	return result, fmt.Sprintf("> %s `%s` status *%s*. Cluster status *%s*.", v.Name(), v.URL, v.ConnectionStatus, v.ClusterStatus)
}

func (v *Vault) Name() string {
	return "Vault"
}

func NewVault(url string) CheckProvider {
	return &Vault{URL: url}
}