diff --git a/README.md b/README.md index 3e72926..f83323e 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,8 @@ A script to sync the Netbox device inventory to Zabbix. * ZABBIX_PASS="Password" * NETBOX_HOST="https://netbox.local" * NETBOX_TOKEN="secrettoken" +Optional: +* NETBOX_KEY="Private user key" #### Flags | Flag | Option | Description | @@ -17,7 +19,8 @@ A script to sync the Netbox device inventory to Zabbix. | -c | cluster | For clustered devices: only add the primary node of a cluster and use the cluster name as hostname. | | -H | hostgroup | Create non-existing hostgroups in Zabbix. Usefull for a first run to add all required hostgroups. | | -t | tenant | Add the tenant name to the hostgroup format (Tenant/Site/Manufacturer/Role) | -| -v | Verbose | Log with debugging on. | +| -s | secret | Use Netbox secrets if present on device for SNMP parameters +| -v | verbose | Log with debugging on. | #### Logging @@ -30,7 +33,7 @@ In case of omitting the -H flag, manual hostgroup creation is required for devic This is in the format: {Site name}/{Manufacturer name}/{Device role name} And with tenants (-t flag): -{Tenant name}/{Site name}/{Manufacturer name}/{Device role name} +{Site name}/{Tenant name}/{Manufacturer name}/{Device role name} Make sure that the Zabbix user has proper permissions to create hosts. The hostgroups are in a nested format. This means that proper permissions only need to be applied to the site name hostgroup and cascaded to any child hostgroups. @@ -109,6 +112,12 @@ To configure the interface parameters you'll need to use custom context. Custom ``` Note: Not all SNMP data is required for a working configuration. [The following parameters are allowed ](https://www.zabbix.com/documentation/current/manual/api/reference/hostinterface/object#details_tag "The following parameters are allowed ")but are not all required, depending on your environment. +##### Secrets +Instead of having the password in plain-text in the config context, you can also set the password as secret in the Netbox device configuration. +You will need to use the -s option for this. Keep in mind that you will need a Netbox private user key for this functionality. + +This method of setting device SNMP parameters is working, but i would recommend going for a "secret macro" implementation to keep your environment more predictable. Refer to the macro from the config context and set the macro inside of Zabbix to the actual community string / authentication secret etc. + #### Permissions Make sure that the user has proper permissions for device read and modify (modify to set the Zabbix HostID custom field) operations. diff --git a/netbox_zabbix_sync.py b/netbox_zabbix_sync.py index 15bf9ca..bf58d72 100755 --- a/netbox_zabbix_sync.py +++ b/netbox_zabbix_sync.py @@ -6,6 +6,7 @@ import logging import argparse from pynetbox import api from pyzabbix import ZabbixAPI, ZabbixAPIException +from pynetbox.core.query import RequestError as NetboxRequestError # Set logging log_format = logging.Formatter('%(asctime)s - %(name)s - ' @@ -46,7 +47,13 @@ def main(arguments): zabbix_pass = environ.get("ZABBIX_PASS") netbox_host = environ.get("NETBOX_HOST") netbox_token = environ.get("NETBOX_TOKEN") + netbox_key = environ.get("NETBOX_KEY") + if(arguments.secret and not netbox_key): + e = ("You need a private user key to" + " use the Netbox secrets functionality.") + logger.warning(e) + EnvironmentVarError(e) # Set Zabbix API try: zabbix = ZabbixAPI(zabbix_host) @@ -55,7 +62,8 @@ def main(arguments): e = f"Zabbix returned the following error: {str(e)}." logger.error(e) # Set Netbox API - netbox = api(netbox_host, netbox_token, threading=True) + netbox = api(netbox_host, token=netbox_token, + private_key=netbox_key, threading=True) # Get all Zabbix and Netbox data netbox_devices = netbox.dcim.devices.all() zabbix_groups = zabbix.hostgroup.get(output=['name']) @@ -89,6 +97,9 @@ def main(arguments): else: logger.debug(f"{device.name} is not linked to a tenant. " f"Using HG format '{device.hostgroup}'.") + # -s flag: collect secrets from this device + if(arguments.secret): + device.getNetboxSecrets(netbox) # Checks if device is in cleanup state if(device.status != "Active"): if(device.zabbix_id): @@ -163,6 +174,7 @@ class NetworkDevice(): self.zabbix = zabbix self.tenant = nb.tenant self.hostgroup = None + self.secrets = None self.hg_format = [self.nb.site.name, self.nb.device_type.manufacturer.name, self.nb.device_role.name] @@ -237,11 +249,25 @@ class NetworkDevice(): f"Modifying hostname from {self.name} to " + f"{self.nb.virtual_chassis.name}.") self.name = self.nb.virtual_chassis.name + return True else: logger.debug(f"Device {self.name} is non-primary cluster member.") return False + def getNetboxSecrets(self, nbapi): + """ + Get secrets from this Netbox host + """ + try: + self.secrets = nbapi.secrets.secrets.filter(device=self.nb.name) + if(self.secrets): + logger.debug(f"Got {len(self.secrets)} secret(s)" + f" for host {self.name}.") + except NetboxRequestError as e: + e = f"Device {self.name}: unable to get Netbox secrets, error: {e}" + logger.warning(e) + def getZabbixTemplate(self, templates): """ Returns Zabbix template ID @@ -319,7 +345,8 @@ class NetworkDevice(): """ try: # Initiate interface class - interface = ZabbixInterface(self.nb.config_context, self.ip) + interface = ZabbixInterface(self.nb.config_context, + self.ip, self.secrets) # Check if Netbox has device context. # If not fall back to old config. if(interface.get_context()): @@ -489,8 +516,6 @@ class NetworkDevice(): raise InterfaceConfigError(e) # Set interfaceID for Zabbix config updates["interfaceid"] = host["interfaces"][0]['interfaceid'] - logger.debug(f"{self.name}: Updating interface with " - f"config {updates}") try: # API call to Zabbix self.zabbix.hostinterface.update(updates) @@ -513,8 +538,9 @@ class NetworkDevice(): class ZabbixInterface(): - def __init__(self, context, ip): + def __init__(self, context, ip, secrets=None): self.context = context + self.secrets = secrets self.type = None self.ip = ip self.skelet = {"main": "1", "useip": "1", "dns": "", "ip": self.ip} @@ -542,6 +568,15 @@ class ZabbixInterface(): # Checks if SNMP settings are defined in Netbox if("snmp" in self.context["zabbix"]): snmp = self.context["zabbix"]["snmp"] + # Check if matching SNMP Netbox secret is found for host. + supported_secrets = ["community", "authpassphrase", + "privpassphrase"] + # Check if Netbox host has secrets + if(self.secrets): + for secret in self.secrets: + # If secret is supported, add to SNMP details + if(secret.name in supported_secrets): + snmp[secret.name] = secret.plaintext self.interface["details"] = {} # Checks if bulk config has been defined if(snmp.get("bulk")): @@ -610,6 +645,8 @@ if(__name__ == "__main__"): parser.add_argument("-t", "--tenant", action="store_true", help=("Add Tenant name to the Zabbix " "hostgroup name scheme.")) + parser.add_argument("-s", "--secret", action="store_true", + help=("Use Netbox secrets for SNMP interfaces.")) args = parser.parse_args() main(args)