new plugin for Azure NetApp Pools & Pool volumes by rmorandell-pgum · Pull Request #6171 · centreon/centreon-plugins

rmorandell-pgum · 2026-05-06T08:33:10Z

Community contributors

Description

NetApps documentation

Modes Available:

capacity
discovery
list-volumes
volumes

Capacity

Capacity metrics documentation

Volumes

Volume metrics documentation

I have implemented a process where the available metrics for the resource are first queried via the /providers/microsoft.insights/metricDefinitions endpoint.

for API
https://learn.microsoft.com/en-us/rest/api/monitor/metric-definitions/list?view=rest-monitor-2023-10-01&tabs=HTTP

for CLI
https://learn.microsoft.com/en-us/cli/azure/monitor/metrics?view=azure-cli-latest#az-monitor-metrics-list-definitions

This also allows you to determine the primaryAggregationType and use it if it has not been overridden with --aggregation.

Not all metrics are always available for all regions or features. That is why this is a good dynamic solution.

Fixes # (issue)
If you are fixing a github Issue already existing, mention it here.

Type of change

Patch fixing an issue (non-breaking change)
New functionality (non-breaking change)
Functionality enhancement or optimization (non-breaking change)
Breaking change (patch or feature) that might cause side effects breaking part of the Software

How this pull request can be tested ?

pool-capacity.debug.txt
volumes.debug.txt

Checklist

I have followed the coding style guidelines provided by Centreon
I have commented my code, especially hard-to-understand areas of the PR.
I have rebased my development branch on the base branch (develop).
I have provide data or shown output displaying the result of this code in the plugin area concerned.

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 4	Resolved Issues: 0

🚀 New Features

Added Azure NetApp Pool plugin with discovery and modes.
Introduced list-volumes mode to list and filter NetApp volumes.

⚡ Enhancements

Implemented capacity and volumes metrics mappings and counters.
Updated azcli and api custom modules to support metrics queries.

^{More info}

aikido-pr-checks · 2026-05-06T08:33:50Z

+
+    return if (defined($self->{option_results}->{command_options}) && $self->{option_results}->{command_options} ne '');
+
+    my $cmd_options = "monitor metrics list-definitions --resource '$options{resource}' --only-show-errors --output json";


azure_list_resource_metrics_set_cmd builds a shell command by concatenating --resource and other option values into cmd_options; this allows command injection. Use safe argument passing or proper escaping.

Details

✨ AI Reasoning
A command string is being assembled by concatenating user-controllable option values directly into a shell-invoked command. This allows arbitrary shell metacharacters or injection to be included by an attacker, leading to command injection when executed. The problematic change constructs a command line with resource, resource_group and other fields interpolated without escaping or using a safe exec-array API.

🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-06T08:33:51Z

+
+    return if (defined($self->{option_results}->{command_options}) && $self->{option_results}->{command_options} ne '');
+
+    my $cmd_options = "netappfiles volume list --account-name '$options{account_name}' --pool-name '$options{pool_name}' --resource-group '$options{resource_group}'";


azure_list_netapp_volumes_set_cmd builds a shell command by concatenating --account-name, --pool-name and --resource-group option values into cmd_options; this allows command injection. Use safe argument passing or proper escaping.

Details

✨ AI Reasoning
A command string is being assembled by concatenating user-controllable option values directly into a shell-invoked command. This allows arbitrary shell metacharacters or injection to be included by an attacker, leading to command injection when executed. The problematic change constructs a command line with account_name, pool_name and resource_group interpolated without escaping or using a safe exec-array API.

🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-06T08:33:53Z

+sub azure_list_netapp_volumes_set_url {
+    my ($self, %options) = @_;
+
+    my $url = $self->{management_endpoint} . "/subscriptions/" . $self->{subscription} . "/resourcegroups/" .


azure_list_netapp_volumes_set_url concatenates resource_group, account_name and pool_name directly into the URL path without encoding or validation; this may allow crafted input to manipulate the request URL.

Details

✨ AI Reasoning
The new API helper composes an HTTP URL by concatenating resource_group, account_name and pool_name directly into the path. These values originate from options and are included without escaping/encoding. This can cause malformed requests or allow an attacker to control request paths.

🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-13T08:55:31Z

+    return $cmd_options;
+}
+
+sub azure_list_netapp_volumes_metrics {


Method name mismatch: azcli defines azure_list_netapp_volumes_metrics, but callers use azure_list_netapp_volumes. This causes runtime failure with --custommode=azcli.

Suggested change

sub azure_list_netapp_volumes_metrics {

sub azure_list_netapp_volumes {

Details

✨ AI Reasoning
1) The new list-volumes mode asks the custom object for a method named azure_list_netapp_volumes.
2) The API custom implementation provides that method, but the CLI custom implementation introduces a differently named method instead.
3) With the CLI custom mode selected, that call cannot be resolved, so execution fails before data retrieval.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-13T08:55:33Z

+sub azure_list_resource_metrics_set_url {
+    my ($self, %options) = @_;
+
+    my $url = $self->{management_endpoint};


azure_list_resource_metrics_set_url concatenates $options{resource} directly into the request URL without encoding; untrusted resource values can manipulate the constructed HTTP path.

Details

✨ AI Reasoning
The management API URL is constructed by appending '/' . $options{resource} into the base management endpoint string. If $options{resource} is supplied externally, it may contain unexpected characters or sequences that change the resulting HTTP request (path traversal, injection into the URL). No encoding or validation is applied before concatenation.

🔧 How do I fix it?
Use parameterized queries with placeholders, array-based command execution (no shell interpretation), or properly escaped arguments using vetted libraries. Avoid dynamic queries/commands built with user input concatenation.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-05-13T08:55:54Z

+                defined($metric_results{$resource_name}->{$metric_label_name}->{lc($aggregation)}) ?
+                    $metric_results{$resource_name}->{$metric_label_name}->{lc($aggregation)} :


Metric value lookup uses $metric_label_name instead of $metric_name after checking $metric_name. This mismatched key path drops real data and stores 0 for metrics.

Suggested change

defined($metric_results{$resource_name}->{$metric_label_name}->{lc($aggregation)}) ?

$metric_results{$resource_name}->{$metric_label_name}->{lc($aggregation)} :

defined($metric_results{$resource_name}->{$metric_name}->{lc($aggregation)}) ?

$metric_results{$resource_name}->{$metric_name}->{lc($aggregation)} :

Details

✨ AI Reasoning
1) Metric retrieval stores results by normalized metric name.
2) The selection loop correctly checks availability using that normalized key.
3) The final assignment then reads from a different key derived from the display label.
4) This contradiction makes collected values effectively unreachable and produces incorrect zero values.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.}
_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

rmorandell-pgum and others added 5 commits April 30, 2026 17:46

NetApp pool

1b45b0e

new centreon constants & is_excluded()

02f2c89

separat path & name

b4d5226

build resource path when --resource & --resourcegroup as options

50bd133

Merge branch 'centreon:develop' into cloud-azure-netapp

8e4473b

rmorandell-pgum requested a review from a team as a code owner May 6, 2026 08:33

rmorandell-pgum requested review from Evan-Adam and removed request for a team May 6, 2026 08:33

github-actions Bot added the external label May 6, 2026

aikido-pr-checks Bot reviewed May 6, 2026

View reviewed changes

lucie-tirand added new in-backlog contribution labels May 6, 2026

refactor variable name

671af67

aikido-pr-checks Bot reviewed May 13, 2026

View reviewed changes

rmorandell-pgum added 2 commits May 27, 2026 14:42

refactor help & list-volumes

500287d

refactor help

20b9db0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new plugin for Azure NetApp Pools & Pool volumes#6171

new plugin for Azure NetApp Pools & Pool volumes#6171
rmorandell-pgum wants to merge 8 commits into
centreon:developfrom
i-Vertix:cloud-azure-netapp

rmorandell-pgum commented May 6, 2026 •

edited by lucie-tirand

Loading

Uh oh!

aikido-pr-checks Bot May 6, 2026

Uh oh!

aikido-pr-checks Bot May 6, 2026

Uh oh!

aikido-pr-checks Bot May 6, 2026

Uh oh!

aikido-pr-checks Bot May 13, 2026 •

edited

Loading

Uh oh!

aikido-pr-checks Bot May 13, 2026

Uh oh!

aikido-pr-checks Bot May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		return if (defined($self->{option_results}->{command_options}) && $self->{option_results}->{command_options} ne '');

		my $cmd_options = "monitor metrics list-definitions --resource '$options{resource}' --only-show-errors --output json";


		return if (defined($self->{option_results}->{command_options}) && $self->{option_results}->{command_options} ne '');

		my $cmd_options = "netappfiles volume list --account-name '$options{account_name}' --pool-name '$options{pool_name}' --resource-group '$options{resource_group}'";

	sub azure_list_netapp_volumes_metrics {
	sub azure_list_netapp_volumes {

		defined($metric_results{$resource_name}->{$metric_label_name}->{lc($aggregation)}) ?
		$metric_results{$resource_name}->{$metric_label_name}->{lc($aggregation)} :

Conversation

rmorandell-pgum commented May 6, 2026 • edited by lucie-tirand Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Community contributors

Description

Type of change

How this pull request can be tested ?

Checklist

Summary by Aikido

Uh oh!

aikido-pr-checks Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 13, 2026

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rmorandell-pgum commented May 6, 2026 •

edited by lucie-tirand

Loading

aikido-pr-checks Bot May 13, 2026 •

edited

Loading