forust
1cbdfc1d6f
- ServiceMonitor for cert-manager (release: prometheus-stack) - Grafana dashboard Cert-manager-Kubernetes (ID 22908, datasource refs fixed) via dashboard sidecar ConfigMap - PrometheusRule: NotReady (crit), expiry <14d (warn) / <7d (crit), ACME 429 rate-limit (warn)
44 lines
1.9 KiB
YAML
44 lines
1.9 KiB
YAML
apiVersion: monitoring.coreos.com/v1
|
|
kind: PrometheusRule
|
|
metadata:
|
|
name: cert-manager
|
|
namespace: prometheus
|
|
labels:
|
|
release: prometheus-stack
|
|
spec:
|
|
groups:
|
|
- name: cert-manager
|
|
rules:
|
|
- alert: CertManagerCertNotReady
|
|
expr: certmanager_certificate_ready_status{condition="False"} == 1
|
|
for: 10m
|
|
labels:
|
|
severity: critical
|
|
annotations:
|
|
summary: "Certificate {{ $labels.exported_namespace }}/{{ $labels.name }} is not ready"
|
|
description: "Certificate has been failing for more than 10 minutes. Check Challenges/Orders in that namespace."
|
|
- alert: CertManagerCertExpirySoon
|
|
expr: certmanager_certificate_expiration_timestamp_seconds - time() < 86400 * 14
|
|
for: 1h
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "Certificate {{ $labels.exported_namespace }}/{{ $labels.name }} expires in less than 14 days"
|
|
description: "Renewal should have happened automatically. Check cert-manager logs if it persists."
|
|
- alert: CertManagerCertExpiryCritical
|
|
expr: certmanager_certificate_expiration_timestamp_seconds - time() < 86400 * 7
|
|
for: 1h
|
|
labels:
|
|
severity: critical
|
|
annotations:
|
|
summary: "Certificate {{ $labels.exported_namespace }}/{{ $labels.name }} expires in less than 7 days"
|
|
description: "Manual intervention likely needed: cmctl status certificate {{ $labels.name }} -n {{ $labels.exported_namespace }}."
|
|
- alert: CertManagerHittingRateLimits
|
|
expr: sum by (exported_namespace) (rate(certmanager_http_acme_client_request_count{status=~"429.*"}[10m])) > 0
|
|
for: 15m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "cert-manager is hitting ACME rate limits"
|
|
description: "Back off manual issuance retries and check failed Orders/Challenges."
|