{"id":46323,"date":"2024-05-24T07:13:39","date_gmt":"2024-05-24T07:13:39","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=46323"},"modified":"2024-05-29T03:05:07","modified_gmt":"2024-05-29T03:05:07","slug":"icinga2-how-to-enable-api-in-icinga","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/icinga2-how-to-enable-api-in-icinga\/","title":{"rendered":"icinga2: How to enable Api in icinga?"},"content":{"rendered":"
$ icinga2 api setup\n$ systemctl restart icinga2\n$ icinga2 feature enable api\n\n\/etc\/icinga2\/zones.conf\n\nobject Endpoint \"self\"<\/span> {\n    host = \"172.31.11.106\"<\/span> \/\/ can be omitted if it's the same system<\/span>\n}\n\n\/etc\/icinga2\/conf.d\/api-users.conf\nobject ApiUser \"api\"<\/span> {\n    password = \"rajesh123\"<\/span>\n    permissions = [ \"*\"<\/span> ]\n    \/\/ Ensure the client_cn is matching if you're using certificate-based authentication<\/span>\n}\n\n\/etc\/icinga2\/zones.conf\nobject Zone \"master\"<\/span> {\n    endpoints = [ \"self\"<\/span> ]\n}\n\n$ systemctl restart icinga2<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
In this example:<\/p>\n\n\n\n
    \n
  • api-user<\/strong> is the username for the API.<\/li>\n\n\n\n
  • secret<\/strong> is the password (you should choose a strong, secure password).<\/li>\n\n\n\n
  • permissions<\/strong> defines what the user is allowed to do:\n
      \n
    • status\/query<\/code> allows the user to query Icinga2 status.<\/li>\n\n\n\n
    • actions\/*<\/code> permits the user to perform all actions like sending custom notifications, rescheduling checks, etc.<\/li>\n\n\n\n
    • objects\/modify\/*<\/code> allows the user to modify objects.<\/li>\n\n\n\n
    • objects\/query\/*<\/code> permits querying all object types.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n
      Here\u2019s how you can define an API user with<\/span> specific permissions:\n\nvi \/etc\/icinga2\/features-enabled\/api.conf\n\nAdd the following configuration block to the file:\n\n\nobject ApiUser \"api-user\"<\/span> {\n  password = \"secret\"<\/span>\n  permissions = [ \"status\/query\"<\/span>, \"actions\/*\"<\/span>, \"objects\/modify\/*\"<\/span>, \"objects\/query\/*\"<\/span> ]\n}<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Available permissions for specific URL endpoints:<\/p>\n\n\n\n
      The permissions field in the ApiUser object specifies what the API user is allowed to do. You can tailor the permissions according to your security and operational requirements. Here are some common permissions:<\/p>\n\n\n\n
        \n
      • *<\/code>: Grants full access.<\/li>\n\n\n\n
      • status\/query<\/code>: Allows querying Icinga2 status.<\/li>\n\n\n\n
      • objects\/query\/*<\/code>: Allows reading all object types.<\/li>\n\n\n\n
      • objects\/query\/Hosts<\/code>: Limits reading to host objects.<\/li>\n\n\n\n
      • objects\/modify\/*<\/code>: Allows modification of all object types.<\/li>\n\n\n\n
      • actions\/*<\/code>: Allows all actions like acknowledging problems or sending notifications.<\/li>\n<\/ul>\n\n\n\n
        Available permissions for specific URL endpoints:<\/p>\n\n\n\n
        Permissions<\/th>URL Endpoint<\/th>Supports filters<\/th>Max body size in MB<\/th><\/tr><\/thead>
        actions\/<action><\/td>\/v1\/actions<\/td>Yes<\/td>1<\/td><\/tr>
        config\/query<\/td>\/v1\/config<\/td>No<\/td>1<\/td><\/tr>
        config\/modify<\/td>\/v1\/config<\/td>No<\/td>512<\/td><\/tr>
        console<\/td>\/v1\/console<\/td>No<\/td>1<\/td><\/tr>
        events\/<type><\/td>\/v1\/events<\/td>No<\/td>1<\/td><\/tr>
        objects\/query\/<type><\/td>\/v1\/objects<\/td>Yes<\/td>1<\/td><\/tr>
        objects\/create\/<type><\/td>\/v1\/objects<\/td>No<\/td>1<\/td><\/tr>
        objects\/modify\/<type><\/td>\/v1\/objects<\/td>Yes<\/td>1<\/td><\/tr>
        objects\/delete\/<type><\/td>\/v1\/objects<\/td>Yes<\/td>1<\/td><\/tr>
        status\/query<\/td>\/v1\/status<\/td>Yes<\/td>1<\/td><\/tr>
        templates\/<type><\/td>\/v1\/templates<\/td>Yes<\/td>1<\/td><\/tr>
        types<\/td>\/v1\/types<\/td>Yes<\/td>1<\/td><\/tr>
        variables<\/td>\/v1\/variables<\/td>Yes<\/td>1<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n
        Test the API\nTest the API setup by making a request using curl or any other HTTP client:\n\ncurl -k -s -u 'api:rajesh123'<\/span> -H 'Accept: application\/json'<\/span> 'https:\/\/localhost:5665\/v1\/status'<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
        \n\n\n
        Query an existing object by sending a POST request with<\/span> X-HTTP-Method-Override: GET as<\/span> request header:\n\ncurl -k -s -S -i -u 'root:icinga'<\/span> -H 'Accept: application\/json'<\/span> \\\n -H 'X-HTTP-Method-Override: GET'<\/span> -X POST \\\n 'https:\/\/localhost:5665\/v1\/objects\/hosts'<\/span>\nDelete an existing object by sending a POST request with<\/span> X-HTTP-Method-Override: DELETE as<\/span> request header:\n\ncurl -k -s -S -i -u 'root:icinga'<\/span> -H 'Accept: application\/json'<\/span> \\\n -H 'X-HTTP-Method-Override: DELETE'<\/span> -X POST \\\n 'https:\/\/localhost:5665\/v1\/objects\/hosts\/example.localdomain'<\/span>\nQuery objects with<\/span> complex filters. For a detailed introduction into filter, please read the following chapter.\n\ncurl -k -s -S -i -u 'root:icinga'<\/span> -H 'Accept: application\/json'<\/span> \\\n -H 'X-HTTP-Method-Override: GET'<\/span> -X POST \\\n 'https:\/\/localhost:5665\/v1\/objects\/services'<\/span> \\\n -d '{ \"filter\": \"service.state==2 && match(\\\"ping*\\\",service.name)\" }'<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>","protected":false},"excerpt":{"rendered":"
        In this example: Available permissions for specific URL endpoints: The permissions field in the ApiUser object specifies what the API user is allowed to do. You can tailor the permissions… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[8217],"tags":[],"class_list":["post-46323","post","type-post","status-publish","format-standard","hentry","category-icinga"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/46323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=46323"}],"version-history":[{"count":4,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/46323\/revisions"}],"predecessor-version":[{"id":46345,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/46323\/revisions\/46345"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=46323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=46323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=46323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}