Merge ~hloeung/content-cache-charm:nagios-monitoring into content-cache-charm:master

[Haw Loeung]

Remove TLS1.0 and TLS1.1 checks, they're confusing with negate - LP:1879608

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Paul Collins (pjdc)]

review: Approve (lgtm)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 45a438f459cbe0a26f787ed84135db814f6b6bac

diff --git a/reactive/content_cache.py b/reactive/content_cache.py
index dfca6a7..576980f 100644
--- a/reactive/content_cache.py
+++ b/reactive/content_cache.py
@@ -165,7 +165,7 @@ def configure_nginx(conf_path=None):
         conf['enable_prometheus_metrics'] = enable_prometheus_metrics
 
         if ngx_conf.write_site(site, ngx_conf.render(conf)):
-            hookenv.log('Wrote out new configs for site: {}'.format(site))
+            hookenv.log('Wrote out new configs for site: {}:{}'.format(site, conf['listen_port']))
             changed = True
 
     if configure_nginx_metrics(ngx_conf, enable_prometheus_metrics):
@@ -363,31 +363,6 @@ def configure_nagios():
 
             nagios_name = '{}-{}'.format(site, location)
 
-            if tls:
-                # Negative Listen/frontend checks to alert on obsolete TLS versions
-                for tlsrev in ('1', '1.1'):
-                    check_name = utils.generate_nagios_check_name(
-                        nagios_name, 'site', 'no_tls_{}'.format(tlsrev.replace('.', '_'))
-                    )
-                    cmd = (
-                        '/usr/lib/nagios/plugins/negate'
-                        ' /usr/lib/nagios/plugins/check_http -I 127.0.0.1 -H {site_name}'
-                        ' -p {port} --ssl={tls} --sni -j {method} -u {path}{token}'.format(
-                            site_name=site_name,
-                            port=frontend_port,
-                            method=method,
-                            url=url,
-                            path=path,
-                            token=token,
-                            tls=tlsrev,
-                        )
-                    )
-                    nrpe_setup.add_check(
-                        shortname=check_name,
-                        description='{} confirm obsolete TLS v{} denied'.format(site, tlsrev),
-                        check_cmd=cmd,
-                    )
-
             # Listen / frontend check
             check_name = utils.generate_nagios_check_name(nagios_name, 'site', 'listen')
             cmd = (
diff --git a/tests/unit/test_content_cache.py b/tests/unit/test_content_cache.py
index 746a427..9b1d6cf 100644
--- a/tests/unit/test_content_cache.py
+++ b/tests/unit/test_content_cache.py
@@ -549,18 +549,6 @@ site1.local:
 
         want = [
             mock.call(
-                shortname='site_site2_local_no_tls_1',
-                description='site2.local confirm obsolete TLS v1 denied',
-                check_cmd='/usr/lib/nagios/plugins/negate /usr/lib/nagios/plugins/check_http -I 127.0.0.1'
-                ' -H site2.local -p 443 --ssl=1 --sni -j GET -u /check/',
-            ),
-            mock.call(
-                shortname='site_site2_local_no_tls_1_1',
-                description='site2.local confirm obsolete TLS v1.1 denied',
-                check_cmd='/usr/lib/nagios/plugins/negate /usr/lib/nagios/plugins/check_http -I 127.0.0.1'
-                ' -H site2.local -p 443 --ssl=1.1 --sni -j GET -u /check/',
-            ),
-            mock.call(
                 shortname='site_site2_local_listen',
                 description='site2.local site listen check',
                 check_cmd='/usr/lib/nagios/plugins/check_http -I 127.0.0.1 -H site2.local -p 443 --ssl=1.2 --sni'
@@ -577,18 +565,6 @@ site1.local:
                 check_cmd='/usr/lib/nagios/plugins/check_http -I 127.0.0.1 -H site2.local -p 8081 -j GET -u /check/',
             ),
             mock.call(
-                shortname='site_site2_local_my_local_content_no_tls_1',
-                description='site2.local confirm obsolete TLS v1 denied',
-                check_cmd='/usr/lib/nagios/plugins/negate /usr/lib/nagios/plugins/check_http -I 127.0.0.1'
-                ' -H site2.local -p 443 --ssl=1 --sni -j HEAD -u /my-local-content/',
-            ),
-            mock.call(
-                shortname='site_site2_local_my_local_content_no_tls_1_1',
-                description='site2.local confirm obsolete TLS v1.1 denied',
-                check_cmd='/usr/lib/nagios/plugins/negate /usr/lib/nagios/plugins/check_http -I 127.0.0.1'
-                ' -H site2.local -p 443 --ssl=1.1 --sni -j HEAD -u /my-local-content/',
-            ),
-            mock.call(
                 shortname='site_site2_local_my_local_content_listen',
                 description='site2.local site listen check',
                 check_cmd='/usr/lib/nagios/plugins/check_http -I 127.0.0.1 -H site2.local -p 443 --ssl=1.2'
@@ -601,18 +577,6 @@ site1.local:
                 ' -u /my-local-content/',
             ),
             mock.call(
-                shortname='site_site2_local_my_local_content2_no_tls_1',
-                description='site2.local confirm obsolete TLS v1 denied',
-                check_cmd='/usr/lib/nagios/plugins/negate /usr/lib/nagios/plugins/check_http -I 127.0.0.1'
-                ' -H site2.local -p 443 --ssl=1 --sni -j HEAD -u /my-local-content2/',
-            ),
-            mock.call(
-                shortname='site_site2_local_my_local_content2_no_tls_1_1',
-                description='site2.local confirm obsolete TLS v1.1 denied',
-                check_cmd='/usr/lib/nagios/plugins/negate /usr/lib/nagios/plugins/check_http -I 127.0.0.1'
-                ' -H site2.local -p 443 --ssl=1.1 --sni -j HEAD -u /my-local-content2/',
-            ),
-            mock.call(
                 shortname='site_site2_local_my_local_content2_listen',
                 description='site2.local site listen check',
                 check_cmd='/usr/lib/nagios/plugins/check_http -I 127.0.0.1 -H site2.local -p 443 --ssl=1.2 --sni'