add certificate expiration alert (#174)

* add certificate expiration alert * set the days as configurable in values yaml file * change the description
gardener · Jul 20, 2023 · e8223ff · e8223ff
1 parent 6e345ff
commit e8223ff
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/charts/internal/shoot-cert-management-seed/templates/configmap-observability.yaml b/charts/internal/shoot-cert-management-seed/templates/configmap-observability.yaml
@@ -30,6 +30,23 @@ data:
         regex: ^(cert_management_.+)$
         action: keep
 
+  alerting_rules: |
+    cert-controller-manager.rules.yaml: |
+      groups:
+      - name: cert-controller-manager.rules
+        rules:
+        - alert: SslCertificateWillExpireSoon
+          expr:  (cert_management_cert_object_expire-time())/86400 <= {{ .Values.configuration.certExpirationAlertDays }}
+          for: 30m
+          labels:
+            service: cert-controller-manager
+            severity: critical
+            type: seed
+            visibility: operator
+          annotations:
+            description: Certificate in namespace {{ .Release.Namespace }} will be expired less than {{ .Values.configuration.certExpirationAlertDays }} days.
+            summary: SSL certificate will expire less than {{ .Values.configuration.certExpirationAlertDays }} days
+
   dashboard_operators: |
     cert-controller-manager-dashboard.json: |-
 {{- .Files.Get "cert-dashboard.json" | nindent 6 }}

diff --git a/charts/internal/shoot-cert-management-seed/values.yaml b/charts/internal/shoot-cert-management-seed/values.yaml
@@ -76,6 +76,7 @@ configuration:
 #   ...
 #   -----END CERTIFICATE-----
   deactivateAuthorizations: true
+  certExpirationAlertDays: 15
 
 additionalConfiguration:
 - --kubeconfig.disable-deploy-crds