Icinga2 distributed monitoring - Endpoint running all the services in it's zone

I'm trying to setup a distributed icinga monitoring of multuple clients.

I have set up the zones as needed i.e:

1) On the master node it looks like this

object Zone "edge-dev" { 
  parent="master"
  endpoints=[ 
    "edge-dev-docker",
    "edge-dev-aws"
  ]
}

object Endpoint "edge-dev-docker" {}
object Endpoint "edge-dev-aws" {}
object Endpoint "icinga.master" {}

object Zone "master" {
  endpoints = [ "icinga.master" ]
}

constants.conf:

...
const NodeName = "icinga.master"

const ZoneName = "icinga.master"
...

2) On each client node:

object Endpoint "icinga.master" {
    host = "icinga.master"
    port = "5665"
}

object Zone "master" {
    endpoints = [ "icinga.master" ]
}

object Zone "global-templates" {
    global = true
}

object Zone "director-global" {
    global = true
}

object Endpoint NodeName {}

object Zone ZoneName {
    endpoints = [ NodeName ]
    parent = "master"
}

and constants.conf:

const NodeName = "edge-dev-docker"

const ZoneName = "edge-dev"

and

const NodeName = "edge-dev-aws"

const ZoneName = "edge-dev"

for each node

Now, I'm trying to setup some monitoring on the squid process on each client node:

curl -k -s -u user:pass -H 'Accept: application/json' -X PUT 'https://$ICINGA_HOST:$ICINGA_PORT/v1/objects/checkcommands/check_process' -d '{ "templates": [ "plugin-check-command" ], "attrs": { "command": [ "/usr/lib/nagios/plugins/check_procs" ], "arguments": { "--ereg-argument-array": "$process_regex$", "-c": "$range$" }, "vars.process_regex": "", "vars.range": "1:1", "zone": "edge-dev" } }'  | python -m json.tool

curl -k -s -u user:pass -H 'Accept: application/json' -X PUT 'https://$ICINGA_HOST:$ICINGA_PORT/v1/objects/hosts/edge-dev-ip-docker' -d '{ "templates": [ "generic-host" ], "attrs": { "address": "ip-docker", "check_command": "ssh", "vars.os" : "Linux", "zone": "edge-dev" } }' | python -m json.tool

curl -k -s -u user:pass -H 'Accept: application/json' -X PUT 'https://$ICINGA_HOST:$ICINGA_PORT/v1/objects/hosts/edge-dev-ip-aws' -d '{ "templates": [ "generic-host" ], "attrs": { "address": "ip-aws", "check_command": "ssh", "vars.os" : "Linux", "zone": "edge-dev" } }' | python -m json.tool

curl -k -s -u user:pass -H 'Accept: application/json' -X PUT 'https://$ICINGA_HOST:$ICINGA_PORT/v1/objects/services/edge-dev-ip-aws!edge-dev-ip-aws-squid' -d '{ "templates": [ "generic-service" ], "attrs": { "check_command": "check_process", "vars.process_regex": "'/usr/sbin/squid'", "vars.range": "1:2", "check_interval": 30,"retry_interval": 30, "max_check_attempts": 3, "zone": "edge-dev" } }'  | python -m json.tool

curl -k -s -u user:pass -H 'Accept: application/json' -X PUT 'https://$ICINGA_HOST:$ICINGA_PORT/v1/objects/services/edge-dev-ip-docker!edge-dev-ip-docker-squid' -d '{ "templates": [ "generic-service" ], "attrs": { "check_command": "check_process", "vars.process_regex": "'/usr/sbin/squid'", "vars.range": "1:2", "check_interval": 30,"retry_interval": 30, "max_check_attempts": 3, "zone": "edge-dev" } }'  | python -m json.tool

All the objects get propagated well to the client nodes. The problem is, that now each client executes both of the services (even the ones that are not "his", i.e. the host which "owns" the service is not the only one running it).

To make the problem clearer- now both edge-dev-ip-aws host and edge-dev-ip-docker host run both of the services edge-dev-ip-docker!edge-dev-ip-docker-squid and edge-dev-ip-aws!edge-dev-ip-docker-aws

How can I make each one run only it's own services?

Any help or hint would be appreciated :)

Solution

Your zones.conf should be the same across all the servers. Something like

object Endpoint "icinga.master" {
        host = "<IP>"
}
object Endpoint "edge-dev-docker" {
        host = "<IP>"
}
object Endpoint "edge-dev-aws" {
        host = "<IP>"
}
object Zone "icinga.master" {
        endpoints = [ "icinga.master" ]
}
object Zone "edge-dev" {
        endpoints = [ "edge-dev-docker", "edge-dev-aws" ]
        parent = "icinga.master"
}
/*
 * Global zone for templates
 */
object Zone "global-templates" {
        global = true
}
object Zone "director-global" {
        global = true
}

Since both edge-dev-docker, edge-dev-aws are in the same cluster they'll both be able to do the checks. So if edge-dev-aws isn't functioning edge-dev-docker will do it. If you want them each separate, they'll need their own zones like:

object Endpoint "icinga.master" {
        host = "<IP>"
}
object Endpoint "edge-dev-docker" {
        host = "<IP>"
}
object Endpoint "edge-dev-aws" {
        host = "<IP>"
}
object Zone "icinga.master" {
        endpoints = [ "icinga.master" ]
}
object Zone "edge-dev-docker" {
        endpoints = [ "edge-dev-docker" ]
        parent = "icinga.master"
}
object Zone "edge-dev-aws" {
        endpoints = [ "edge-dev-aws" ]
        parent = "icinga.master"
}
/*
 * Global zone for templates
 */
object Zone "global-templates" {
        global = true
}
object Zone "director-global" {
        global = true
}