Extend NRPE checks for reporting soon-to-expire certificates to Nagios

[Aurelien Lourot]

The idea came out of lp:1914708. There seems to be an easy way to extend the existing NRPE (Nagios remote plugin executor) checks of each charm to get alerts when certificates are about to expire.

Taking charm-neutron-api as an example, but this applies to all charms that report to Nagios and expose an HTTPS API. Thus the common logic should be placed in charm-helpers, [1] which is a library used by all charms.

The charm produces an NRPE config [2] that is used to report to the Nagios charm. One of the NRPE checks [3][4][5] makes use of `check_http`, [6] which could also be used to report on certificate expiration times.

[1] https://github.com/juju/charm-helpers
[2] https://github.com/openstack/charm-neutron-api/blob/master/hooks/neutron_api_hooks.py#L714
[3] https://github.com/openstack/charm-neutron-api/blob/master/hooks/neutron_api_hooks.py#L713
[4] https://github.com/juju/charm-helpers/blob/master/charmhelpers/contrib/charmsupport/nrpe.py#L504
[5] https://github.com/juju/charm-helpers/blob/master/charmhelpers/contrib/openstack/files/check_haproxy.sh
[6] https://nagios-plugins.org/doc/man/check_http.html

[James Troup (elmo)]

So, err, we have the openstack-service-checks charm which already does this in one place. It'd be nice if we could avoid taking the number of SSL alerts we get and multiplying them by 3x?