vcenter-health

// The health of a VMware vCenter appliance, by its REST API (GET /api/appliance/health/<component>), which
// vCenter serves under /api from vSphere 7.0 U2: the health level the appliance gives each of its components,
// the one its management interface (port 5480) shows.
// The address of the API is the vCenter's, the host's: https://<host:address>/api/.
need('protocol:http');
$address = need('host:address');
$user = need('protocol:http:user');
$password = need('protocol:http:password');

per('component', 'Components');
output('health', 'text', array('label' => 'Health', 'per' => 'component'));

watch.state('degraded', 'Component degraded', 'health', array(
    'warning'  => array('yellow', 'gray'),
    'critical' => array('orange', 'red'),
));
watch.missing('missing', 'Component missing', 'health', array('enabled' => false));

// Log in: POST /api/session, the account in Basic, answers 201 and the id of the session as a JSON text. The
// answer is not secret by itself, the password having gone in Basic, but the id is: secret.mark keeps it out
// of every value and message, and the cache keeps it encrypted on the poller, 50 minutes at most.
function login($address, $user, $password) {
    $answer = http.post('https://' . $address . '/api/session', '', user=$user, password=$password);
    if ($answer['status'] == 401 || $answer['status'] == 403) {
        fail('misconfigured', 'vCenter refuses the account, code ' . $answer['status']);
    }
    if ($answer['status'] != 201) {
        fail('unreachable', 'vCenter answers the login with code ' . $answer['status'],
            'vCenter serves its REST API under /api from vSphere 7.0 U2.');
    }
    $session = secret.mark(json.read($answer['body']));
    cache.set('session', $session, 3000);
    return $session;
}

// One GET with the session kept in the cache; a session vCenter no longer knows (expired, vCenter restarted)
// answers 401, and the collector logs in again, once.
function api_get($address, $path, $user, $password) {
    if (cache.has('session')) {
        $session = cache.get('session');
    } else {
        $session = login($address, $user, $password);
    }
    $answer = http.get('https://' . $address . $path, headers=array('vmware-api-session-id' => $session));
    if ($answer['status'] == 401) {
        $session = login($address, $user, $password);
        $answer = http.get('https://' . $address . $path, headers=array('vmware-api-session-id' => $session));
    }
    if ($answer['status'] == 403) {
        fail('misconfigured', 'The account may not read ' . $path . ', code 403');
    }
    if ($answer['status'] != 200) {
        fail('unreachable', 'vCenter answers ' . $path . ' with code ' . $answer['status']);
    }
    return json.read($answer['body']);
}

// Each answers a JSON text, one of green, yellow, orange, red, or gray when the appliance does not know.
// "system" sums up the others.
$components = array('system', 'applmgmt', 'load', 'mem', 'swap', 'storage', 'database-storage', 'software-packages');
foreach ($components as $component) {
    value('health', text.lower(api_get($address, '/api/appliance/health/' . $component, $user, $password)), $component);
}