Revert "19473: Azure App Registrations: Add maximum credential v..."

DavidGerva · DavidGerva · commit aa5d8c89d7c8 · 2026-04-23T10:18:32.000+02:00
Revert submission 134124-azure

Reason for revert: Need to change werk text and default params. Better revert and reland sot that also backporting will be easier

Reverted changes: /q/submissionid:134124-azure

Change-Id: Ia4c64acdad0ea17707d151ca0018a9930fd6420a
diff --git a/.werks/19473.md b/.werks/19473.md
diff --git a/packages/cmk-plugins/cmk/plugins/azure_v2/agent_based/azure_app_registration.py b/packages/cmk-plugins/cmk/plugins/azure_v2/agent_based/azure_app_registration.py
@@ -16,7 +16,7 @@
     CheckPlugin,
     CheckResult,
     DiscoveryResult,
-    LevelsT,
+    FixedLevelsT,
     render,
     Result,
     Service,
@@ -27,36 +27,22 @@
 
 THIRTY_DAYS = 30 * 24 * 60 * 60.0
 SEVEN_DAYS = 7 * 24 * 60 * 60.0
-ONE_YEAR = 365 * 24 * 60 * 60.0
-TWO_YEARS = 2 * ONE_YEAR
 
 
-class _CredentialParams(TypedDict, total=False):
-    remaining_validity: LevelsT[float]
-    max_validity: LevelsT[float]
-
-
-class Params(TypedDict, total=False):
-    secrets: _CredentialParams
-    certificates: _CredentialParams
+class Params(TypedDict):
+    expiration_time_secrets: FixedLevelsT[float]
+    expiration_time_certificates: FixedLevelsT[float]
 
 
 DEFAULT_PARAMS = Params(
-    secrets=_CredentialParams(
-        remaining_validity=("fixed", (THIRTY_DAYS, SEVEN_DAYS)),
-        max_validity=("fixed", (ONE_YEAR, TWO_YEARS)),
-    ),
-    certificates=_CredentialParams(
-        remaining_validity=("fixed", (THIRTY_DAYS, SEVEN_DAYS)),
-        max_validity=("fixed", (ONE_YEAR, TWO_YEARS)),
-    ),
+    expiration_time_secrets=("fixed", (THIRTY_DAYS, SEVEN_DAYS)),
+    expiration_time_certificates=("fixed", (THIRTY_DAYS, SEVEN_DAYS)),
 )
 
 
 class Credential(BaseModel):
     appId: str
     appName: str
-    startDateTime: str | None = None
     endDateTime: str
     keyId: str
     customKeyIdentifier: str | None = None
@@ -124,8 +110,7 @@ def discover_certificates(section: Section) -> DiscoveryResult:
 
 def _check_credential_expiration(
     credential: Credential,
-    remaining_validity: LevelsT[float] | None,
-    max_validity: LevelsT[float] | None,
+    params: FixedLevelsT[float],
     credential_type: Literal["Secret", "Certificate"],
 ) -> CheckResult:
     expiration_date = parse_azure_datetime(credential.endDateTime)
@@ -136,51 +121,31 @@ def _check_credential_expiration(
             state=State.CRIT,
             summary=f"{credential_type} expired: {render.timespan(abs(age))} ago",
         )
-    elif remaining_validity is not None:
+    else:
         yield from check_levels(
             age,
-            levels_lower=remaining_validity,
+            levels_lower=params,
             label="Remaining time",
             render_func=render.timespan,
         )
-    else:
-        yield Result(state=State.OK, summary=f"Remaining time: {render.timespan(age)}")
-
-    if (
-        max_validity is not None
-        and credential.startDateTime is not None  # None with old agents output
-        and max_validity[0] != "no_levels"
-    ):
-        start_date = parse_azure_datetime(credential.startDateTime)
-        total_validity = expiration_date.timestamp() - start_date.timestamp()
-        yield from check_levels(
-            total_validity,
-            levels_upper=max_validity,
-            label="Max validity",
-            render_func=render.timespan,
-        )
 
 
 def check_app_registration_secret(item: str, params: Params, section: Section) -> CheckResult:
     if (credential := section.secrets.get(item)) is None:
         return
-    cred_params = params.get("secrets", {})
     yield from _check_credential_expiration(
         credential,
-        remaining_validity=cred_params.get("remaining_validity"),
-        max_validity=cred_params.get("max_validity"),
+        params["expiration_time_secrets"],
         credential_type="Secret",
     )
 
 
 def check_app_registration_certificate(item: str, params: Params, section: Section) -> CheckResult:
     if (credential := section.certificates.get(item)) is None:
         return
-    cred_params = params.get("certificates", {})
     yield from _check_credential_expiration(
         credential,
-        remaining_validity=cred_params.get("remaining_validity"),
-        max_validity=cred_params.get("max_validity"),
+        params["expiration_time_certificates"],
         credential_type="Certificate",
     )
 
diff --git a/packages/cmk-plugins/cmk/plugins/azure_v2/checkman/azure_v2_app_registration b/packages/cmk-plugins/cmk/plugins/azure_v2/checkman/azure_v2_app_registration
@@ -3,19 +3,13 @@ agents: azure_v2
 catalog: cloud/azure
 license: GPLv2
 distribution: check_mk
-description: This check monitors validity of a Microsoft Azure
+description: This check monitors validity of an Microsoft Azure
   app registration secret.
-  The state of the service is CRIT if the secret has expired.
+  The state of the service is CRIT if the secret has
+  expired.
 
-  Two threshold groups can be configured in the rule
-  "Microsoft Azure App Registrations":
-
-  Remaining validity: Alert when the secret is about to expire.
-  The default levels are WARN at 30 days and CRIT at 7 days.
-
-  Maximum allowed validity: Alert when the total lifespan of the secret
-  (from creation to expiry) exceeds a threshold.
-  The default levels are WARN at 1 year and CRIT at 2 years.
+  The levels for remaining time until expiry can be
+  configured in the rule "Azure App Registration".
 
   In order to use this check, you need to configure the Azure special agent.
 
diff --git a/packages/cmk-plugins/cmk/plugins/azure_v2/checkman/azure_v2_app_registration_certificates b/packages/cmk-plugins/cmk/plugins/azure_v2/checkman/azure_v2_app_registration_certificates
@@ -1,21 +1,15 @@
-title: Microsoft Azure App Registration Certificate
+title: Microsoft Azure App Registration Certficate
 agents: azure_v2
 catalog: cloud/azure
 license: GPLv2
 distribution: check_mk
-description: This check monitors validity of a Microsoft Azure
+description: This check monitors validity of an Microsoft Azure
   app registration certificate.
-  The state of the service is CRIT if the certificate has expired.
+  The state of the service is CRIT if the certificate has
+  expired.
 
-  Two threshold groups can be configured in the rule
-  "Microsoft Azure App Registrations":
-
-  Remaining validity: Alert when the certificate is about to expire.
-  The default levels are WARN at 30 days and CRIT at 7 days.
-
-  Maximum allowed validity: Alert when the total lifespan of the certificate
-  (from creation to expiry) exceeds a threshold. The default levels
-  are WARN at 1 year and CRIT at 2 years.
+  The levels for remaining time until expiry can be
+  configured in the rule "Azure App Registration".
 
   In order to use this check, you need to configure the Azure special agent.
 
diff --git a/packages/cmk-plugins/cmk/plugins/azure_v2/rulesets/azure_app_registration.py b/packages/cmk-plugins/cmk/plugins/azure_v2/rulesets/azure_app_registration.py
@@ -3,8 +3,6 @@
 # This file is part of Checkmk (https://checkmk.com). It is subject to the terms and
 # conditions defined in the file COPYING, which is part of this source code package.
 
-from collections.abc import Mapping
-
 from cmk.rulesets.v1 import Title
 from cmk.rulesets.v1.form_specs import (
     DefaultValue,
@@ -19,78 +17,42 @@
 
 THIRTY_DAYS = 30 * 24 * 60 * 60.0
 SEVEN_DAYS = 7 * 24 * 60 * 60.0
-ONE_YEAR = 365 * 24 * 60 * 60.0
-TWO_YEARS = 2 * ONE_YEAR
-
 
-def _time_span() -> TimeSpan:
-    return TimeSpan(
-        displayed_magnitudes=[
-            TimeMagnitude.DAY,
-            TimeMagnitude.HOUR,
-            TimeMagnitude.MINUTE,
-            TimeMagnitude.SECOND,
-        ]
-    )
 
-
-def _credential_validity_form(is_secret: bool) -> Dictionary:
+def _make_form() -> Dictionary:
     return Dictionary(
-        title=Title("Check secret credentials")
-        if is_secret
-        else Title("Check certificate credentials"),
         elements={
-            "remaining_validity": DictElement(
+            "expiration_time_secrets": DictElement(
                 parameter_form=SimpleLevels(
-                    title=Title("Remaining validity time"),
-                    form_spec_template=_time_span(),
+                    title=Title("Time until secret credentials expiration"),
+                    form_spec_template=TimeSpan(
+                        displayed_magnitudes=[
+                            TimeMagnitude.DAY,
+                            TimeMagnitude.HOUR,
+                            TimeMagnitude.MINUTE,
+                            TimeMagnitude.SECOND,
+                        ]
+                    ),
                     level_direction=LevelDirection.LOWER,
                     prefill_fixed_levels=DefaultValue((THIRTY_DAYS, SEVEN_DAYS)),
-                ),
+                )
             ),
-            "max_validity": DictElement(
+            "expiration_time_certificates": DictElement(
                 parameter_form=SimpleLevels(
-                    title=Title("Maximum allowed validity"),
-                    form_spec_template=_time_span(),
-                    level_direction=LevelDirection.UPPER,
-                    prefill_fixed_levels=DefaultValue((ONE_YEAR, TWO_YEARS)),
-                ),
-            ),
-        },
-    )
-
-
-def _migrate(value: object) -> Mapping[str, object]:
-    if not isinstance(value, dict):
-        raise ValueError(value)
-
-    # Already in new nested format
-    if "secrets" in value or "certificates" in value:
-        return value
-
-    # Migrate from old flat format: expiration_time_secrets / expiration_time_certificates
-    result: dict[str, object] = {}
-    if "expiration_time_secrets" in value:
-        result["secrets"] = {"remaining_validity": value["expiration_time_secrets"]}
-    if "expiration_time_certificates" in value:
-        result["certificates"] = {"remaining_validity": value["expiration_time_certificates"]}
-
-    return result
-
-
-def _make_form() -> Dictionary:
-    return Dictionary(
-        migrate=_migrate,
-        elements={
-            "secrets": DictElement(
-                required=False,
-                parameter_form=_credential_validity_form(is_secret=True),
-            ),
-            "certificates": DictElement(
-                required=False,
-                parameter_form=_credential_validity_form(is_secret=False),
+                    title=Title("Time until certificate credentials expiration"),
+                    form_spec_template=TimeSpan(
+                        displayed_magnitudes=[
+                            TimeMagnitude.DAY,
+                            TimeMagnitude.HOUR,
+                            TimeMagnitude.MINUTE,
+                            TimeMagnitude.SECOND,
+                        ]
+                    ),
+                    level_direction=LevelDirection.LOWER,
+                    prefill_fixed_levels=DefaultValue((THIRTY_DAYS, SEVEN_DAYS)),
+                )
             ),
-        },
+        }
     )
 
 
diff --git a/packages/cmk-plugins/tests/cmk/plugins/azure_v2/agent_based/test_azure_app_registration.py b/packages/cmk-plugins/tests/cmk/plugins/azure_v2/agent_based/test_azure_app_registration.py
