Merge ~raychan96/charm-openstack-service-checks:bug_2003327 into charm-openstack-service-checks:master

[Chi Wai CHAN]

The command update-ca-certificates should be used with --fresh to re-generate all symbolic links in /etc/ssl/certs. This can prevent mis-configuration of "trusted_ssl_ca", for example missing symlink to a .pem file because "trusted_ssl_ca" does not contain exactly one certificate or CRL, to be fixed by reconfiguration. Also updated the description for "trusted_ssl_ca" to clarify how to use it.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:1ce52bbb504f16da76e15ea7100b8a711fc82e4f
https://jenkins.canonical.com/bootstack/job/lp-charm-openstack-service-checks-ci/1/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/109/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/38/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-openstack-service-checks-ci/1//rebuild

review: Needs Fixing (continuous-integration)

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

FAILED: Continuous integration, rev:74ed23c665d0234e9b278c8e22e279e72ecb9d34
https://jenkins.canonical.com/bootstack/job/lp-charm-openstack-service-checks-ci/2/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/110/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/39/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-openstack-service-checks-ci/2//rebuild

review: Needs Fixing (continuous-integration)

[Chi Wai CHAN (raychan96)]

Failing because of https://github.com/canonical/snap-mysqld-exporter/issues/4

[JamesLin (jneo8)]

LGTM. Wait for functional test pass.

review: Approve

[🤖 prod-jenkaas-bootstack (prod-jenkaas-bootstack)]

PASSED: Continuous integration, rev:74ed23c665d0234e9b278c8e22e279e72ecb9d34
https://jenkins.canonical.com/bootstack/job/lp-charm-openstack-service-checks-ci/6/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/bootstack/job/lp-charm-test-functest/126/
    None: https://jenkins.canonical.com/bootstack/job/lp-update-mp/54/

Click here to trigger a rebuild:
https://jenkins.canonical.com/bootstack/job/lp-charm-openstack-service-checks-ci/6//rebuild

review: Approve (continuous-integration)

[Eric Chen (eric-chen)]

LGTM

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision b9c9b559fe92cb352145348dbbdcb14b9ee03bff

diff --git a/src/README.md b/src/README.md
index ab52a54..09361a1 100644
--- a/src/README.md
+++ b/src/README.md
@@ -48,7 +48,7 @@ use of the following config items.
 ### Course Grain
 
   * `check-octavia`: `true` or `false` can enable or disable checks
-  
+
 ### Fine Grain
 
   * `octavia-loadbalancers-ignored`
@@ -57,7 +57,7 @@ use of the following config items.
   * `octavia-image-ignored`
 
 Each of these config items adds an ignore-list of keywords. Each keyword in
-the ignore list will be blocked when it appears in the output of the check. 
+the ignore list will be blocked when it appears in the output of the check.
 
 #### Examples
 
@@ -180,6 +180,9 @@ juju run-action  --wait vault/0 get-root-ca --format json \
     juju config openstack-service-checks trusted_ssl_ca={}
 ```
 
+If you are using configuration options provided by the charm such as cinder, you
+will need to provide the root CA certificate to the `trusted_ssl_ca`.
+
 # Contact information
 
 Please contact Canonical's BootStack team via the "Submit a bug" link.
diff --git a/src/config.yaml b/src/config.yaml
index ffff1c3..3fb426a 100644
--- a/src/config.yaml
+++ b/src/config.yaml
@@ -41,7 +41,7 @@ options:
     type: boolean
     description: |
       Switch to turn on or off check for horizon connectivity and login.
-      A website relation with openstack-dashboard(horizon) is a prerequisite. 
+      A website relation with openstack-dashboard(horizon) is a prerequisite.
   check-mysql-innodb-cluster:
     default: False
     type: boolean
@@ -143,6 +143,9 @@ options:
     default: ''
     description: |
       base64 encoded SSL ca cert to use for OpenStack API client connections.
+      Note that it should only contain exactly one certificate, presumably the
+      root certificate. For more information, you can refer to the man page of
+      `update-ca-certificates` and `openssl rehash`.
   skip-disabled:
     type: boolean
     default: false
diff --git a/src/reactive/openstack_service_checks.py b/src/reactive/openstack_service_checks.py
index e572128..d145f1f 100644
--- a/src/reactive/openstack_service_checks.py
+++ b/src/reactive/openstack_service_checks.py
@@ -204,7 +204,7 @@ def render_config():
         try:
             with open(CERT_FILE, "w") as fd:
                 fd.write(cert_content)
-            subprocess.call(["/usr/sbin/update-ca-certificates"])
+            subprocess.call(["/usr/sbin/update-ca-certificates", "--fresh"])
 
         except subprocess.CalledProcessError as error:
             hookenv.log(