Skip to content

Commit a25e9b1

Browse files
ArcturianWarrior999ArcturianWarrior999
authored
Merge branch 'Checkmk:master' into master
2 parents fc1ba95 + fbfc1b0 commit a25e9b1

916 files changed

Lines changed: 35647 additions & 9524 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.bazelrc‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,12 @@ common:ci --remote_upload_local_results=true
111111

112112
common:ci --@cmk//distro=UNSET
113113

114+
# Ship optimized, stripped binaries from CI.
115+
# Scoped per-target via select() so only the shipped binaries are affected
116+
# See bazel/cmk/optimize and bazel/cmk/strip.
117+
common:ci --@cmk//optimize=True
118+
common:ci --@cmk//strip=True
119+
114120
# For better performance - passes an argument `--skipLibCheck` to *every* spawn of tsc
115121
common --@aspect_rules_ts//ts:skipLibCheck=always
116122
# For more correct typechecks - honor the setting of `skipLibCheck` in the tsconfig.json file

‎.claude/settings.json‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,16 @@
8181
"Bash(jenkins_build_data.py *)",
8282
"Bash(/home/*/.claude/plugins/cache/checkmk-marketplace/checkmk-core/*/skills/gerrit/bin/gerrit-change-log *)",
8383
"Bash(/home/*/.claude/plugins/cache/checkmk-marketplace/checkmk-core/*/skills/jenkins/bin/jenkins_build_data.py *)",
84+
"Bash(jj log *)",
85+
"Bash(jj log)",
86+
"Bash(jj diff *)",
87+
"Bash(jj diff)",
88+
"Bash(jj st *)",
89+
"Bash(jj st)",
90+
"Bash(jj status *)",
91+
"Bash(jj status)",
92+
"Bash(jj show *)",
93+
"Bash(jj show)",
8494
"Bash(mkdir -p /tmp/jenkins-artifacts)",
8595
"Bash(mkdir /tmp/jenkins-artifacts)",
8696
"Bash(tar -xf /tmp/jenkins-artifacts/*)",
@@ -94,7 +104,6 @@
94104
"ask": ["Bash(find *--exec*)", "Bash(git remote *)", "Bash(git config *)"],
95105
"deny": [
96106
"Edit(.werks/first_free)",
97-
"Write(.werks/first_free)",
98107
"Bash(* > .werks/first_free*)",
99108
"Bash(* >> .werks/first_free*)",
100109
"Bash(sed -i * .werks/first_free*)",

‎.werks/16920.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
[//]: # (werk v2)
2+
# Aerohive HiveManager NG: new ExtremeCloud IQ special agent
3+
4+
key | value
5+
---------- | ---
6+
date | 2026-06-12T07:07:23.532625+00:00
7+
version | 3.0.0b1
8+
class | feature
9+
edition | cre
10+
component | checks
11+
level | 2
12+
compatible | yes
13+
14+
The special agent for Aerohive HiveManager NG used the legacy Aerohive Developer
15+
API (base URL `https://[rdc-id].aerohive.com/xapi/`, endpoint
16+
`GET /xapi/v1/monitor/devices`).
17+
18+
Extreme Networks announced in field notice FN-2026-526 that the legacy Aerohive
19+
Developer API will be permanently shut down on July 12, 2026. After that date all
20+
requests to the legacy endpoints fail, so the old special agent stops delivering
21+
data.
22+
23+
This werk adds a new special agent "Extreme Networks ExtremeCloud IQ" that talks
24+
to the ExtremeCloud IQ API (XAPI) instead:
25+
26+
* The device list is retrieved from `GET /devices` (base URL
27+
`https://api.extremecloudiq.com`) instead of the legacy
28+
`/xapi/v1/monitor/devices` endpoint.
29+
* Authentication uses the ExtremeCloud IQ username and password: the agent
30+
obtains a bearer token from `POST /login` and releases it again with
31+
`POST /logout`. The obsolete `ownerId` query parameter and the legacy
32+
`X-AH-API-CLIENT-ID`, `X-AH-API-CLIENT-SECRET` and
33+
`X-AH-API-CLIENT-REDIRECT-URI` headers are no longer sent.
34+
35+
The new agent produces the same section as before, so the discovered services
36+
("Client <hostname>") stay unchanged.
37+
38+
The existing "Aerohive HiveManager NG" special agent and its rules are left
39+
untouched, so your configuration stays valid. Because the authentication scheme
40+
changed completely, the old rules cannot be migrated automatically: you have to
41+
create new "Extreme Networks ExtremeCloud IQ" rules by hand.
42+
43+
* The URL is prefilled with the ExtremeCloud IQ API endpoint
44+
`https://api.extremecloudiq.com` and normally does not need to be changed.
45+
* Enter the ExtremeCloud IQ username and password.
46+
47+
`cmk-update-config` prints a warning if it still finds legacy "Aerohive
48+
HiveManager NG" rules, reminding you to migrate them. Once you have recreated
49+
your rules with the new special agent, you can delete the obsolete ones.
50+
51+
The legacy "Aerohive HiveManager NG" special agent no longer receives data once
52+
the Aerohive Developer API is shut down and is only kept for compatibility. It is
53+
planned to be removed in a future release, so please migrate any remaining rules.

‎.werks/16926.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
[//]: # (werk v3)
2+
# Raritan PDU residual current: fix crash when only a critical threshold is reported
3+
4+
key | value
5+
---------- | ---
6+
date | 2026-07-21T12:56:00.977993+00:00
7+
version | 3.0.0b1
8+
class | fix
9+
edition | community
10+
component | checks
11+
level | 1
12+
compatible | yes
13+
14+
Raritan PDUs report residual current thresholds independently: by default a
15+
device may send only a critical level (e.g. 0.030 A) and no warning level.
16+
17+
Previously the *Residual Current* service crashed in this situation because the
18+
missing warning threshold was passed on as an unusable value.
19+
20+
The check now handles a partially configured threshold set. If only one of the
21+
warning or critical levels is present, the reported level is used for both, so
22+
that an alert is still raised instead of the check failing.
23+

‎.werks/16927.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
[//]: # (werk v3)
2+
# lnx_bonding failing with 'head: *: No such file or directory' if no bonding interface is configured
3+
4+
key | value
5+
---------- | ---
6+
date | 2026-07-22T07:20:07.799324+00:00
7+
version | 3.0.0b1
8+
class | fix
9+
edition | community
10+
component | checks
11+
level | 1
12+
compatible | yes
13+
14+
The Linux and OpenWrt agents collect bonding information by reading the files
15+
in <tt>/proc/net/bonding</tt>. This directory exists whenever the bonding
16+
kernel module is loaded, even if no bonding interface is actually configured.
17+
18+
In that case the directory is empty, and the agent tried to run
19+
<tt>head</tt> on an unmatched shell glob. This wrote an error such as
20+
<tt>head: ./*: No such file or directory</tt> to the agent output.
21+
22+
The agents now only read the bonding files when at least one bonding
23+
interface is present, so no spurious error is emitted.
24+

‎.werks/18495.md‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,17 @@ class | fix
99
edition | community
1010
component | checks
1111
level | 1
12-
compatible | yes
12+
compatible | no
13+
14+
This Werk may change the state of existing `storcli_pdisks` services that use
15+
storcli2 to gather their data.
1316

1417
[Werk #15353](https://checkmk.com/werk/15353) introduced support for storcli2,
15-
but assumed the `state` information of v1 can be read in the `state` information
16-
of the output of v2 which seems not to be true. `status` of v2 holds the
17-
information about the health of the disks, `state` holds the configuration state
18-
of the disk.
18+
but incorrectly assumed that the `state` information of v1 could be read from
19+
the `state` field of the v2 output. This turned out not to be the case: in v2,
20+
`status` holds the information about the health of the disks, while `state`
21+
holds the configuration state of the disk.
1922

20-
With this Werk the configuration is extended to also include the newly
21-
introduced status information.
23+
With this werk, the check is extended to evaluate the `status` information and
24+
the rule configuration is extended to also include the newly introduced status
25+
information.

‎.werks/18498.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
[//]: # (werk v3)
2+
# netstat: map UNCONN to CLOSED
3+
4+
key | value
5+
---------- | ---
6+
date | 2026-07-21T11:00:13.361436+00:00
7+
version | 3.0.0b1
8+
class | fix
9+
edition | community
10+
component | checks
11+
level | 1
12+
compatible | yes
13+
14+
iproute2 ss may report `UNCONN` as connection status. This is now mapped to
15+
`CLOSED`. Before this change it caused an crash with `KeyError ('UNCONN')`

‎.werks/19478.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[//]: # (werk v2)
2+
# LDAP group to user custom attributes or roles now agnostic between DN and CN
3+
4+
key | value
5+
---------- | ---
6+
date | 2026-07-02T15:49:39+00:00
7+
version | 3.0.0b1
8+
class | fix
9+
edition | cre
10+
component | wato
11+
level | 1
12+
compatible | yes
13+
14+
Before this werk when configuring an LDAP connector to assign roles or custom attributes to users based on their LDAP groups
15+
checkmk would limit user attributes to groups identified via Common Names and roles to groups identified by Distinguished Names.
16+
17+
As of this werk, Checkmk will now allow groups to be identified by either Common Names or Distinguished Names.

‎.werks/19479.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[//]: # (werk v3)
2+
# LDAP connections will no longer hang when a connection is made but not complete
3+
4+
key | value
5+
---------- | ---
6+
date | 2026-07-15T13:33:27.953669+00:00
7+
version | 3.0.0b1
8+
class | fix
9+
edition | community
10+
component | wato
11+
level | 1
12+
compatible | yes
13+
14+
As of this werk Checkmk will correctly apply the timeout defined in *Setup > Users > LDAP >
15+
connections > Edit LDAP connection: > Response timeout* when performing an authentication request
16+
to an LDAP server.
17+
18+
This should allow Checkmk to correctly make use of failover LDAP servers and prevent the site from
19+
being locked into faulty connections.

‎.werks/19542.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
[//]: # (werk v3)
2+
# Establish relay trust explicitly via the site certificate fingerprint
3+
4+
key | value
5+
---------- | ---
6+
date | 2026-07-14T09:33:09.144244+00:00
7+
version | 3.0.0b1
8+
class | feature
9+
edition | ultimate
10+
component | relay
11+
level | 2
12+
compatible | yes
13+
14+
When a relay registers with a Checkmk site, it connects to the site's agent
15+
receiver over TLS. Until now the relay accepted whatever certificate the site
16+
presented during registration (trust on first use), with no way to confirm out
17+
of band that it was really talking to the intended site, leaving registration
18+
open to a man-in-the-middle.
19+
20+
Relay registration now supports establishing that trust explicitly.
21+
`cmk-relay register` accepts a new `--cert-fingerprint` option that checks the
22+
presented certificate against a known SHA-256 fingerprint and stops
23+
registration if it does not match. The fingerprint is delivered through a
24+
trusted channel: the relay setup in the Setup GUI computes it from the site
25+
certificate and includes it in the generated Linux installation command, so
26+
these installs pin the certificate automatically with nothing extra to
27+
configure.
28+
29+
`--cert-fingerprint` is mutually exclusive with the existing `--trust-cert`
30+
option, which keeps the previous "accept the presented certificate" behavior
31+
for cases where a fingerprint cannot be used (for example, when a
32+
TLS-terminating proxy in front of the site presents a different certificate).
33+
The interactive confirmation prompt, which shows the certificate fingerprint
34+
before accepting it, is unchanged.

0 commit comments

Comments
 (0)