Skip to content
This repository has been archived by the owner. It is now read-only.

Merge develop to master #233

Merged
merged 8 commits into from
Aug 18, 2016
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion FORMULA
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: hubblestack_nova
os: RedHat, CentOS, Debian, Ubuntu
os_family: RedHat, Debian
version: 2016.7.0_RC2
version: 2016.7.1
release: 1
summary: HubbleStack Nova
description: HubbleStack Nova
43 changes: 37 additions & 6 deletions README.rst
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
.. _nova_introduction:

Introduction
============

Expand All @@ -12,13 +14,17 @@ track versioned, packaged updates to Hubble's components.
The second method installs directly from git. It should be considered bleeding
edge and possibly unstable.

.. _nova_installation:

Installation
============

Each of the four HubbleStack components have been packaged for use with Salt's
Package Manager (SPM). Note that all SPM installation commands should be done
on the *Salt Master*.

.. _nova_installation_config:

**Required Configuration**

Salt's Package Manager (SPM) installs files into ``/srv/spm/{salt,pillar}``.
Expand All @@ -34,6 +40,8 @@ Ensure that this path is defined in your Salt Master's ``file_roots``:

.. tip:: Remember to restart the Salt Master after making this change to the configuration.

.. _nova_installation_packages:

Installation (Packages)
-----------------------

Expand All @@ -43,8 +51,8 @@ repo for updates and bugfixes!)

.. code-block:: shell

wget https://spm.hubblestack.io/2016.7.0/hubblestack_nova-2016.7.0-1.spm
spm local install hubblestack_nova-2016.7.0-1.spm
wget https://spm.hubblestack.io/2016.7.1/hubblestack_nova-2016.7.1-1.spm
spm local install hubblestack_nova-2016.7.1-1.spm

You should now be able to sync the new modules to your minion(s) using the
``sync_modules`` Salt utility:
Expand All @@ -53,9 +61,11 @@ You should now be able to sync the new modules to your minion(s) using the

salt \* saltutil.sync_modules

Once these modules are synced you are ready to run a HubbleStack Nova audit.
Once these modules are synced you are ready to run a HubbleStack Nova audit.

Skip to [Usage].
Skip to :ref:`Usage <nova_usage>`.

.. _nova_installation_manual:

Installation (Manual)
---------------------
Expand All @@ -74,13 +84,17 @@ it to the minions.
salt \* saltutil.sync_modules
salt \* hubble.sync

.. _nova_usage:

Skip to :ref:`Usage <nova_usage>`.

Usage
=====

There are four primary functions in the hubble.py module:

1. ``hubble.sync`` will sync the ``hubblestack_nova/`` directory to the minion(s).
2. ``hubble.load`` will load the synced audit modules and their yaml configuration files.
2. ``hubble.load`` will load the synced audit modules and their yaml configuration files.
3. ``hubble.audit`` will audit the minion(s) using the YAML profile(s) you provide as comma-separated arguments
4. ``hubble.top`` will audit the minion(s) using the ``top.nova`` configuration.

Expand Down Expand Up @@ -110,6 +124,7 @@ Here are some example calls:
# with "CIS"
salt \* hubble.audit foo,bar tags='CIS*'

.. _nova_usage_topfile:

Nova Topfiles
-------------
Expand Down Expand Up @@ -148,6 +163,7 @@ Examples:
salt '*' hubble.top foo/bar/top.nova
salt '*' hubble.top foo/bar.nova verbose=True

.. _nova_usage_control:

Compensating Control Configuration
----------------------------------
Expand Down Expand Up @@ -188,6 +204,7 @@ still run, but if any of the controlled checks fail, they will be removed from
``Failure`` and added to ``Controlled``, and will be treated as a Success for
the purposes of compliance percentage.

.. _nova_usage_schedule:

Schedule
--------
Expand All @@ -200,10 +217,19 @@ In order to run the audits once daily, you can use the following schedule:
nova_day:
function: hubble.top
seconds: 86400
kwargs:
verbose: True
show_profile: True
returner: splunk_nova_return
return_job: False

.. _nova_configuration:

Configuration
=============

.. _nova_under_the_hood:

Under the Hood
==============

Expand All @@ -230,12 +256,16 @@ shown, change to False to disable behaviors):
autosync: True
autoload: True

.. _nova_development:

Development
===========

If you're interested in contributing to this project this section outlines the
structure and requirements for Nova audit module development.

.. _nova_development_anatomy:

Anatomy of a Nova audit module
------------------------------

Expand All @@ -257,7 +287,6 @@ Anatomy of a Nova audit module
All Nova plugins should include the above header, expanding the docstring to
include full documentation


.. code-block:: python

import fnmatch
Expand Down Expand Up @@ -315,6 +344,8 @@ one-key dictionaries in the form of ``{<tag>: <string_description>}``, or a
list of one-key dictionaries in the form of ``{<tag>: <data_dict>}`` (in the
case of ``verbose``).

.. _nova_contribute:

Contribute
==========

Expand Down
26 changes: 23 additions & 3 deletions _modules/hubble.py
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,9 @@ def audit(configs=None,
if configs is None:
return top(verbose=verbose,
show_success=show_success,
show_compliance=show_compliance)
show_compliance=show_compliance,
show_profile=show_profile,
debug=debug)

if __salt__['config.get']('hubblestack:nova:autoload', True):
load()
Expand Down Expand Up @@ -260,7 +262,9 @@ def audit(configs=None,
def top(topfile='top.nova',
verbose=None,
show_success=None,
show_compliance=None):
show_compliance=None,
show_profile=None,
debug=None):
'''
Compile and run all yaml data from the specified nova topfile.

Expand Down Expand Up @@ -313,6 +317,16 @@ def top(topfile='top.nova',
by total checks). Defaults to True. Configurable via
`hubblestack:nova:show_compliance` in minion config/pillar.

show_profile
Whether to add the profile path to the verbose output for audits.
Defaults to False. Configurable via `hubblestack:nova:show_profile`
in minion config/pillar.

debug
Whether to log additional information to help debug nova. Defaults to
False. Configurable via `hubblestack:nova:debug` in minion
config/pillar.

CLI Examples:

.. code-block:: bash
Expand All @@ -332,6 +346,10 @@ def top(topfile='top.nova',
show_success = __salt__['config.get']('hubblestack:nova:show_success', True)
if show_compliance is None:
show_compliance = __salt__['config.get']('hubblestack:nova:show_compliance', True)
if show_profile is None:
show_profile = __salt__['config.get']('hubblestack:nova:show_profile', False)
if debug is None:
debug = __salt__['config.get']('hubblestack:nova:debug', False)

results = {}

Expand Down Expand Up @@ -367,7 +385,9 @@ def top(topfile='top.nova',
verbose=verbose,
show_success=True,
show_compliance=False,
called_from_top=True)
show_profile=show_profile,
called_from_top=True,
debug=debug)

# Merge in the results
for key, val in ret.iteritems():
Expand Down