Merge lp:~pjdc/charms/trusty/postgresql/nagios-additional-servicegroups into lp:charms/trusty/postgresql

[Paul Collins]

1) Add config item nagios_additional_servicegroups, and use it.

2) When manual_replication is in use, update_nrpe_checks() may not be able to create the "nagios" role, e.g. if this postgres is replicating from another instance. Alter this function to not fail on role creation when manual_replication=true, and also alter pg_hba.conf.tmpl to let the administrator permit passwordless monitoring via the "nagios" role by adding a suitable line to extra_pg_auth.

[Stuart Bishop (stub)]

We should probably just allow nagios@localhost to authenticate without a password. The account will still need to be created manually on the master when using manual replication, but it means we don't also need to sync the nagios user's password around. But no need to block this branch on that refactoring.

The changes look good. Ta.

review: Approve

=== modified file 'config.yaml'
--- config.yaml	2014-12-04 17:47:43 +0000
+++ config.yaml	2015-02-05 04:09:03 +0000
@@ -369,6 +369,15 @@
             juju-postgresql-0
         If you're running multiple environments with the same services in them
         this allows you to differentiate between them.
+  nagios_additional_servicegroups:
+    default: ""
+    type: string
+    description: |
+        Used by the nrpe-external-master subordinate charm.
+        A comma-separated list of servicegroups to include along with
+        nagios_context when generating nagios service check configs.
+        This is useful for nagios installations where servicegroups
+        are used to apply special treatment to particular checks.
   pgdg:
     description: |
         Enable the PostgreSQL Global Development Group APT repository

=== modified file 'hooks/hooks.py'
--- hooks/hooks.py	2015-01-13 16:14:28 +0000
+++ hooks/hooks.py	2015-02-05 04:09:03 +0000
@@ -2487,12 +2487,21 @@
     except Exception:
         hookenv.log("Nagios user not set up.", hookenv.DEBUG)
         return
-    nagios_password = create_user('nagios')
-    pg_pass_entry = '*:*:*:nagios:%s' % (nagios_password)
-    with open('/var/lib/nagios/.pgpass', 'w') as target:
-        os.fchown(target.fileno(), nagios_uid, nagios_gid)
-        os.fchmod(target.fileno(), 0400)
-        target.write(pg_pass_entry)
+
+    try:
+        nagios_password = create_user('nagios')
+        pg_pass_entry = '*:*:*:nagios:%s' % (nagios_password)
+        with open('/var/lib/nagios/.pgpass', 'w') as target:
+            os.fchown(target.fileno(), nagios_uid, nagios_gid)
+            os.fchmod(target.fileno(), 0400)
+            target.write(pg_pass_entry)
+    except psycopg2.InternalError:
+        if config_data['manual_replication']:
+            log("update_nrpe_checks(): manual_replication: "
+                "ignoring psycopg2.InternalError caught creating 'nagios' "
+                "postgres role; assuming we're already replicating")
+        else:
+            raise
 
     unit_name = hookenv.local_unit().replace('/', '-')
     nagios_hostname = "%s-%s" % (config_data['nagios_context'], unit_name)
@@ -2508,9 +2517,16 @@
             os.remove(os.path.join('/var/lib/nagios/export/', f))
 
     # --- exported service configuration file
+    servicegroups = [config_data['nagios_context']]
+    additional_servicegroups = config_data['nagios_additional_servicegroups']
+    if additional_servicegroups != '':
+        servicegroups.extend(
+            servicegroup.strip() for servicegroup
+            in additional_servicegroups.split(',')
+        )
     templ_vars = {
         'nagios_hostname': nagios_hostname,
-        'nagios_servicegroup': config_data['nagios_context'],
+        'nagios_servicegroup': ', '.join(servicegroups),
     }
     template = render_template('nrpe_service.tmpl', templ_vars)
     with open(nrpe_service_file, 'w') as nrpe_service_config:

=== modified file 'hooks/test_hooks.py'
--- hooks/test_hooks.py	2014-05-29 13:08:35 +0000
+++ hooks/test_hooks.py	2015-02-05 04:09:03 +0000
@@ -115,6 +115,7 @@
             "backup_schedule": "13 4 * * *",
             "backup_retention_count": 7,
             "nagios_context": "juju",
+            "nagios_additional_servicegroups": "on-call-services",
             "pgdg": False,
             "install_sources": "",
             "install_keys": "",

=== modified file 'templates/pg_hba.conf.tmpl'
--- templates/pg_hba.conf.tmpl	2014-05-19 18:13:35 +0000
+++ templates/pg_hba.conf.tmpl	2015-02-05 04:09:03 +0000
@@ -5,7 +5,6 @@
 # Database administrative login by UNIX sockets
 local   all         root,postgres                     ident map=superusers
 local   replication root,postgres                     ident map=superusers
-local   all         nagios                            md5
 
 {% if extra_pg_auth is defined and extra_pg_auth|count > 0 -%}
 # extra_pg_auth
@@ -14,6 +13,10 @@
 {% endfor -%}
 {% endif -%}
 
+# monitoring (this is below extra_pg_auth to allow for
+# specialized scenarios involving manual_replication=true)
+local   all         nagios                            md5
+
 {% if access_list is defined -%}
 {% for unit in access_list -%}
 # {{unit['relation-id']}} from {{unit['unit']}}