Cloud.ru

Status: available · package wg-flow-plugin-cloudru 0.1.0 · provider cloudru · category cloud.

The plugin reads one Cloud.ru Evolution project. Inventory receives virtual machines, disks, subnets, client VPCs, public IPs, security groups, and network load balancers. The secret stays in the agent YAML.

The agent exchanges an access key (Key ID and Key Secret) for an IAM token and sends Authorization: Bearer. The token lasts one hour; the agent requests a new one. A service-account access key or a personal access key both work.

One source is one project. Copy the project id from the console. The key needs permission to read that project.

The plugin only reads the API. Cloud.ru Advanced is not covered.

Bare Metal, images, backups, placement groups, SNAT gateways, Managed Kubernetes, managed databases, Object Storage, and DNS are not read in 0.1.0. Console URLs are not copied into inventory. Technical subnets, service VPCs, and already deleted load balancers are skipped. A 403 or 404 from the VPC or load balancer API leaves that list empty and does not fail the source. Any other list error fails the whole source, so a partial snapshot is not sent.

Install

The agent must be connected to the API.

docker compose exec agent wg-flow-agent plugin install cloudru
# or
wg-flow-agent plugin install cloudru

Then the local UI → Connections → cloudru, or YAML.

Create the key in the Cloud.ru console: a service account access key, or a personal access key in the profile. The Key Secret is shown once. The exchange is described in the Cloud.ru docs.

What lands in inventory

Evolution object	resource_type	Notes
Virtual machine	instance	provider_resource_id = instance:{id}. running → active, stopped → stopped, error* → error, transitional states → pending. Region is the zone (ru.AZ-1). A direct public IP or a floating IP → metadata.primary_ipv4, private addresses → metadata.private_ips. vCPU, memory, and guaranteed share → cpu_cores, mem_gb, core_fraction (1:1 → 100, 1:3 → 30, 1:10 → 10). When disks are collected in the same run, the boot disk size is written to disk_gb
Disk	storage	disk:{id}. available, in_use, and reserved → active. Size is already in gigabytes: metadata.disk_gb and metadata.size_gb
Subnet	network	subnet:{id}, metadata.product = subnet. CIDR in metadata.ip_ranges. Types technical and zone_technical are skipped
VPC	network	network:{id}, metadata.product = network. Service VPCs are skipped
Public IP	network	address:{id}. metadata.product = public_ip. Address in metadata.primary_ipv4
Security group	firewall	firewall:{id}. Metadata keeps rule_count only, not the rules
Network load balancer	load_balancer	nlb:{id}. NLB_STATUS_RUNNING → active, NLB_STATUS_SUSPENDED → stopped. A deleted balancer is skipped

There is no separate ip type, so a public address is a network.

Each collect section can be turned off. A disabled section is not requested and is absent from the next successful sync, so inventory marks those rows inactive. disk_gb on a machine appears only when disk collection is on.

Several projects mean several sources. provider_account is your label.

YAML

plugins:
  cloudru:
    enabled: true
    sources:
      - id: prod
        provider_account: "cloudru-prod"
        sync_interval_seconds: 300
        project_id: "496e40f7-cc4b-4fa4-b42a-8cd2c9360716"
        key_id: "…"
        secret: "…"
        collect_instances: true
        collect_disks: true
        collect_networks: true
        collect_addresses: true
        collect_firewalls: true
        collect_load_balancers: true

Source fields

Field	Required	Description
id	yes	Log key (cloudru/prod)
provider_account	yes	Project label in inventory
project_id	yes	Project UUID
key_id	yes	Access key Key ID
secret	yes	Key Secret
collect_*	no	Default true
sync_interval_seconds	no	Minimum 300

Check

wg-flow-agent status
wg-flow-agent dry-run

JSON shows provider: cloudru. Health obtains an IAM token and lists virtual machines with limit=1. The key and token are not written to inventory.

Common errors

Symptom	What to check
401	Key ID and Key Secret belong to the same access key. An API key (Authorization: Api-Key) is not accepted
403 on the project	The service account can read this project_id
Empty VM list	collect_instances is on and the machines are in this Evolution project, not Advanced
No disk_gb on a machine	collect_disks is off, so disk size was not requested
No VPCs or load balancers	No access to that API — the source still succeeds
Disks disappear after sync	collect_disks was turned off; inventory retires rows that were not sent