Reflect state of Amphora certificates in status

[John Lettman]

We are occasionally running into an issue where Amphora certificates expire without observability. As a result, the discovery of expired certificates usually occurs when Amphorae begin failing.

I suspect it may be helpful to call attention to expired or soon-to-expired certificates, which could be a periodic check that sets a "blocked" status when the certificates are nearing expiration. The change could alleviate the need for external integrations, such as Nagios.

[Paul Goins (vultaire)]

I agree that we need a check here; I just hit this on a cloud myself.

I do think that, while juju status messages can help, we really need something which integrates with LMA tools, be it an NRPE check on certificate expiration, a Prometheus metric regarding days until expiration, or some other method which can be used for triggering alerts prior to expiration.

[Giuseppe Petralia (peppepetra)]

I think the nrpe checks for the octavia certs were merged in

https://review.opendev.org/c/openstack/charm-octavia/+/740991

fixed in https://bugs.launchpad.net/charm-octavia/+bug/1885815

Maybe we need a backport to stable/ussuri ?

[Alex Kavanagh (ajkavanagh)]

FYI The patch mentioned in #2 is in the yoga and zed (and forthcoming 2023.1 (antelope)) tracks.