Merge lp:~dparv/charm-haproxy/add_nrpe_ssl_certificate_check into lp:charm-haproxy

[Diko Parvanov]

Added NRPE check for certificate expiration

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Haw Loeung (hloeung)]

LGTM

review: Approve (+1)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 152

=== modified file 'config.yaml'
--- config.yaml	2021-11-04 16:24:19 +0000
+++ config.yaml	2022-10-25 08:06:22 +0000
@@ -290,3 +290,15 @@
         to configured backends. In "active-active" mode, each unit will proxy the
         traffic directly to the backends. The "active-passive" mode gives a better
         control of the maximum connection that will be opened to a backend server.
+  tls_warn_days:
+    type: int
+    default: 30
+    description: |
+      Number of days left for the TLS certificate to expire before warning in 
+      the nagios NRPE check.
+  tls_crit_days:
+    type: int
+    default: 14
+    description: |
+      Number of days left for the TLS certificate to expire before alerting
+      Critical in the NRPE check.

=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2021-12-02 15:12:00 +0000
+++ hooks/hooks.py	2022-10-25 08:06:22 +0000
@@ -1203,6 +1203,23 @@
         install_nrpe_scripts()
         for check_args in checks_args:
             nrpe_compat.add_check(*check_args)
+        ssl_cert = config_data.get("ssl_cert")
+        if ssl_cert:
+            cmd_params = ["/usr/lib/nagios/plugins/check_http"]
+            host, port = ('127.0.0.1', '443')
+            cmd_params.append(" -H {} -p {}".format(host, port))
+            cmd_params.append(" -u /")
+            cmd_params.append(
+                " -C {},{}".format(
+                    config_data.get("tls_warn_days") or 30,
+                    config_data.get("tls_crit_days") or 14,
+                )
+            )
+            nrpe_compat.add_check(
+                shortname="https_cert",
+                description="Certificate expiry check for local unit",
+                check_cmd=" ".join(cmd_params),
+            )
     else:
         for check_args in checks_args:
             if os.path.isfile(nrpe_scripts_dest + '/' + check_args[2]):