Multi-tenancy, Icingaweb on satellites?

Hi folks,

I’m trying to setup a multi-tenant environment where every customer has it’s own zone and satellite. This works already: I define roles for the customers and filter for hostgroups etc. in the roles so that they only see their own stuff after login.

So right now:
master (icinga2, icingaweb2, director) --> satellite (icinga2 with satellite config) --> nodes (icinga2 with agent config)

But ATM they would have to log in on the master in order to see their hosts and services. I thought it would not be possible to install Icingaweb on the satellite(s), because the database is always a single point of truth. But I just read some threads about this being possible and now I’m confused.

How should I configure this and with which components where?

Only thing I know is that the Director should only be installed once. If I install Apache2+Icingaweb2 with an own database on the satellite nodes, can I achieve this? How will the database be populated/updated in this case?

It also should be noted that I don’t really seek a multi-tenant configuration in terms of customers being able to create/update their own setup but rather being able to see what our central master instance monitors in their infrastructure. So a “read-only web-ui” satellite is probably enough. This is important because this way there is no need for a satellite to write back to the master (with API / Livestatus / automation-tools).

Thanks in advance.

You just need to install MySQL or PostgreSQL, icingaweb2 and enable ido on your satelite(s). Icinga on the satelite(s) will populate the database locally. If your are using perfdata then its components needs to be installed in the same way.

This will result in:

  • Central managed environment at your master
  • No need for your customer to login to the master
  • No need for special roles, filters etc.
  • Customer use their local icingaweb even if the master or the connection to the master is down
  • Customer see only their hosts and services

Hi Roland,

fantastic. Thanks. I did this exactly how you told me and it works. Now I’m even more confused :smiley:

I thought I have to replicate the database to the satellite somehow (RO slave, sqlproxy) or use the master’s db from the satellite.

I don’t really get it how it exactly works but I see that it just does. Out-of-the-box and with zero hassle.

Probably this comment of yours explains it a bit:

When a satellite records a check result locally it is also send to the master. As of this the satellites can be fully used locally, complete (consolidated) overview and managing at the master.

So the node is configured as a satellite but it’s smart enough to store everything locally before also sending the results to the master.

Icinga is probably the best and most amazing open-source project I’ve ever seen.

Thanks a lot,
Rp