Rules

Define conditional logic that runs on a schedule and triggers actions when the condition is met

  4 minute read  

A rule lets Cloud Management Platform (CMP) administrators check the state of the environment and act on what they find. Use rules to enforce policy with corrective actions, respond to changes as they happen, or run health checks and tell the right people what needs attention.

How a rule works

A rule is a logical statement in two parts:

  • Condition (the “if”). One action that tests something and reports whether it found anything.
  • Actions (the “then”). One or more actions that run when the condition is met.

Both parts are CMP actions of type CloudBolt Plug-in. The condition is written a little differently from other plugins; see Write a condition plugin.

When rules run

A rule runs on its schedule only when two things are switched on: the rule, and the Execute all Rules recurring job that evaluates every enabled rule.

Execute all Rules runs at 1:00 AM by default, in the time zone set on the CMP appliance. See Schedule format.

You can also run a rule on demand from Admin > Rules, one at a time or in bulk. On-demand runs do not depend on the recurring job.

Built-in rules

CMP ships with the rules below. Go to Admin > Rules to view them and switch them on or off. Because rules are built from actions, you can read and edit their source at Admin > All Actions.

Rule What it does Default state
Email CB Admin when license warning for thresholds Emails the CMP administrator when the license is close to expiring, or when too much of its server allowance is in use. Enabled
Notify admins when a newer version of CloudBolt is available Checks the latest general availability release and saves the result, so an alert can appear on the Admin page. Enabled
Fetch and Cache Available AWS AMIs Fetches AMIs for every imported region on each AWS resource handler. Enabled
Fetch and Cache Available Azure Images Fetches Azure images using a CloudBolt-supplied allowlist, which you can replace with your own. Enabled
Fetch and Cache Available GCP Images Fetches images for every imported project on each GCP resource handler. Enabled
Fetch and Cache Available VMWare Templates Fetches VMware templates using a CloudBolt-supplied allowlist, which you can replace with your own. Enabled
Email group admins when quota usage over threshold Emails everyone whose role in a group carries the group.manage_subgroup_quotas permission when that group’s quota usage passes a threshold. Disabled
Email owners of AWS VMs Missing Required Tags Checks AWS instances for a set of required tags and emails the owner of any server that is missing one. Disabled
Clean up Old Snapshots Finds and destroys old snapshots that can degrade performance. Disabled
Expire Resources Finds deployed resources whose expiration date has passed and runs the configured expiration actions. Disabled

Several of these rules start with threshold values you can change on the rule itself:

  • Email CB Admin when license warning for thresholds. 30 days before expiration, and 75% of the licensed servers in use.
  • Email group admins when quota usage over threshold. 80% of the quota.
  • Clean up Old Snapshots. Snapshots older than 30 days.
  • Expire Resources. Resources that passed their expiration date more than 30 days ago.

Write a condition plugin

A condition is a CloudBolt plugin, so everything that applies to CloudBolt plugins applies. Two things differ from every other plugin:

  • The entry point is check(), not run().
  • It returns a four-tuple rather than a three-tuple. The extra member is a parameters dictionary that decides whether the rule’s actions run.

check(job, logger) receives a CMP job object and a standard Python logger, and returns (status, output, errors, params). The rules that ship with CMP return ("SUCCESS", "", "", params).

The fourth member governs what happens next:

  • Return None as params and the condition counts as unmet. The job ends, and the rule’s actions do not run.
  • Return a populated dictionary and the actions run, each as its own job, each receiving that dictionary through its job parameters.