banshee/cloud-collection/cloud/ovh/https/public-cloud-instances

OVHcloud Public Cloud instances, by the OVHcloud API

Returns the status of each instance of an OVHcloud Public Cloud project, every region at once, read through the OVHcloud API with an application's keys that may only read. Two watches are offered, each one set on the probe.

Versions

Generic: the OVHcloud API is the same in its three places, Europe (eu.api.ovh.com), Canada (ca.api.ovh.com) and the United States (api.us.ovhcloud.com), version 1.0. The address is that of protocol:ovh:endpoint, where the keys were created.

How it works

GET <protocol:ovh:endpoint>/cloud/project/<ovh:project>/instance, signed by ovh.sign: every instance of the project, of every region.

[{"id": "…", "name": "web-1", "region": "GRA11", "status": "ACTIVE", "flavorId": "…", …}]

An instance is named by its name; two instances of one name each keep their own, the second carrying its id: web-1 #….
status is status in lower case: active, build, shutoff, stopped, error, rescue, shelved, shelved_offloaded, suspended, paused, reboot, hard_reboot, resize, migrating… the states of OpenStack, which Public Cloud runs on.
The answer also holds rescuePassword for an instance in rescue mode: the collector never reads it.
An address of the API not written https://<host>/<version> stops the collector misconfigured before anything leaves.
A code 401 (keys wrong, expired or revoked, or the poller's clock off) or 403 (the consumer key not allowed the route) stops the collector misconfigured; a code 400 or 404 (the project unknown) too; any other code but 200 stops it unreachable.

The keys come from protocol:ovh: the application secret never leaves the poller, only the signature it makes; the consumer key goes in a header, to the API only, in HTTPS. The list is not secret.

Prerequisites

An application created on the API of the account's place, and a consumer key whose access rule allows reading and nothing else:

{
  "accessRules": [
    { "method": "GET", "path": "/cloud/project/*" }
  ]
}

The application key goes in protocol:ovh:application-key, its secret in protocol:ovh:application-secret, the consumer key in protocol:ovh:consumer-key, the address of the API in protocol:ovh:endpoint, https://eu.api.ovh.com/1.0. With an IAM policy of OVHcloud instead, the action is publicCloudProject:apiovh:instance/get.

The poller reaches the API in HTTPS, and its clock is right: OVHcloud refuses a signature too far from its own time. The certificates of OVHcloud are issued by public authorities: the profile "Standard" trusts them.

Variables

Name	Label	Says	Default
`ovh:project`	Project	the ID of the Public Cloud project, 32 hexadecimal characters	—

Outputs

Name	Label	Unit	Per instance
`status`	Status	—	yes, per instance

Watches

Name	Title	Kind	Defaults	Checked by default
`not-running`	Instance not running	expected value, on `status`	critical when not `active` for 2 runs: a reboot does not raise	yes
`missing`	Instance missing	expected instances, on `status`	no name given: it raises nothing until names are set on the probe	no

An instance stopped or shelved on purpose is left out by the selection of the probe.

Limits

One project per probe.
Not checked against an OVHcloud account: the route, its fields and its values are those of the schema the OVHcloud API publishes for itself (/1.0/cloud.json: cloud.instance.Instance, cloud.instance.InstanceStatusEnum), which its console shows. The access rule allows every reading under the project, not only its instances: a narrower rule, /cloud/project/*/instance, puts a * inside the path, which is not checked here.