[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign jakexks for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Hi @1mamute. Thanks for your PR.

I'm waiting for a cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

/ok-to-test

The issue #7040 was made by me and I decided to open the PR because I saw it was a minor change.

Show me the solution in the form of a prometheus query / grafana dashboard using the new labels in this PR.

We have a scenario where we issue certificates for Ingress TLS termination with an external CA and an internal private CA.
The internal private CA certificate issuing is managed entirely by cert-manager and they don't need monitoring since its all automated. External certificates are generated manually and deployed on K8s as TLS secrets.

I want to create a Grafana table with our external certificates' expiration dates so we have a unified place to visualize them and create alerts.

I queried kube_ingress_tls{} and it gave me the secret_name of all the TLS configured hosts for each ingress.

Then, I wanted to filter out the cert-manager's certificates, since they don't need monitoring and I queried certmanager_certificate_expiration_timestamp_seconds{} to get the certificates managed by cert-manager.

Now, I could use the CRD name to filter out the results of kube_ingress_tls{} using the tls_host label, but I didn't felt confident enough that the CRD name would match exactly the tls_hosts on the kube_ingress_tls{} query.

• What if the CRD name has dashes instead of dots (example-com instead of example.com)?
• What if the TLS host is a different DNS subdomain name than of the CRD name (www.example.com instead of example.com)?

If the certmanager_certificate_expiration_timestamp_seconds{} and the other queries had the secret_name label, I could simply filter out each secret_name that exists in both queries, thus eliminating all of the cert-manager's managed ones.

kube_ingress_tls
- on(secret_name) group_left()
  certmanager_certificate_expiration_timestamp_seconds

I think this is more reliable than comparing to the Certificate's CRD name since the secret_name on the ingress would be the same on the cert-manager Certificate CRD.

Sorry, I couldn't think of any other examples besides this scenario I'm in.

Also, the secret_name is a required field in the Certificate CRD. Maybe other people could find it useful to have this information. I guess the only issue would be the additional data sent to Prometheus.