T6934: Add preshared key for zabbix-agent monitoring service

- Allow configure preshared key for zabbix-agent
- Added op mode command for generatre random psk secret
- Removed duplicate xml definition for psk settings


Configure authentication mode:
```
# set service monitoring zabbix-agent authentication mode
Possible completions:
   pre-shared-secret    Use a pre-shared secret key
```

Configure PSK Settings:
```
# set service monitoring zabbix-agent authentication psk
Possible completions:
   id                   ID for authentication
   secret               pre-shared secret key

```

Generate Random PSK:
```
$ generate psk random
Possible completions:
  <Enter>               Execute the current command
  size                  Key size in bytes

```

2 files changed, 67 insertions, 1 deletions

diff --git a/src/conf_mode/service_monitoring_zabbix-agent.py b/src/conf_mode/service_monitoring_zabbix-agent.py
index 98d8a32ca..f17146a8d 100755
--- a/src/conf_mode/service_monitoring_zabbix-agent.py
+++ b/src/conf_mode/service_monitoring_zabbix-agent.py
@@ -18,6 +18,8 @@ import os
 
 from vyos.config import Config
 from vyos.template import render
+from vyos.utils.dict import dict_search
+from vyos.utils.file import write_file
 from vyos.utils.process import call
 from vyos import ConfigError
 from vyos import airbag
@@ -26,6 +28,7 @@ airbag.enable()
 
 service_name = 'zabbix-agent2'
 service_conf = f'/run/zabbix/{service_name}.conf'
+service_psk_file = f'/run/zabbix/{service_name}.psk'
 systemd_override = r'/run/systemd/system/zabbix-agent2.service.d/10-override.conf'
 
 
@@ -49,6 +52,8 @@ def get_config(config=None):
     if 'directory' in config and config['directory'].endswith('/'):
         config['directory'] = config['directory'][:-1]
 
+    config['service_psk_file'] = service_psk_file
+
     return config
 
 
@@ -60,18 +65,34 @@ def verify(config):
     if 'server' not in config:
         raise ConfigError('Server is required!')
 
+    if 'authentication' in config and dict_search("authentication.mode",
+                                                  config) == 'pre_shared_secret':
+        if 'id' not in config['authentication']['psk']:
+            raise ConfigError(
+                'PSK identity is required for pre-shared-secret authentication mode')
+
+        if 'secret' not in config['authentication']['psk']:
+            raise ConfigError(
+                'PSK secret is required for pre-shared-secret authentication mode')
+
 
 def generate(config):
     # bail out early - looks like removal from running config
     if config is None:
         # Remove old config and return
-        config_files = [service_conf, systemd_override]
+        config_files = [service_conf, systemd_override, service_psk_file]
         for file in config_files:
             if os.path.isfile(file):
                 os.unlink(file)
 
         return None
 
+    if not dict_search("authentication.psk.secret", config):
+        if os.path.isfile(service_psk_file):
+            os.unlink(service_psk_file)
+    else:
+        write_file(service_psk_file, config["authentication"]["psk"]["secret"])
+
     # Write configuration file
     render(service_conf, 'zabbix-agent/zabbix-agent.conf.j2', config)
     render(systemd_override, 'zabbix-agent/10-override.conf.j2', config)
diff --git a/src/op_mode/generate_psk.py b/src/op_mode/generate_psk.py
new file mode 100644
index 000000000..d51293712
--- /dev/null
+++ b/src/op_mode/generate_psk.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+import argparse
+
+from vyos.utils.process import cmd
+
+
+def validate_hex_size(value):
+    """Validate that the hex_size is between 32 and 512."""
+    try:
+        value = int(value)
+    except ValueError:
+        raise argparse.ArgumentTypeError("hex_size must be integer.")
+
+    if value < 32 or value > 512:
+        raise argparse.ArgumentTypeError("hex_size must be between 32 and 512.")
+    return value
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--hex_size",
+        type=validate_hex_size,
+        help='PKS value size in hex format. Default is 32 bytes.',
+        default=32,
+
+        required=False,
+    )
+    args = parser.parse_args()
+
+    print(cmd(f'openssl rand -hex {args.hex_size}'))
\ No newline at end of file