cert-manager

The cert-manager integration requires CXDOT Collector 1.4.0 or greater. cert-manager manages TLS certificates in Kubernetes. Use the cert-manager integration with the Chronosphere XDOT Collector to collect certificate and controller metrics from cert-manager controllers running in your environment. The cert-manager integration supports cert-manager 1.21.1 or greater.

​

Supported telemetry types

The cert-manager integration supports these telemetry types:

​

Prerequisites

The cert-manager integration has the following prerequisites:

• Enable the cert-manager Prometheus metrics endpoint.
• Make the /metrics endpoint on port 9402 reachable from the collector.

​

Configure

To configure the cert-manager integration, follow these steps:

1. For controller pods that listen on port 9402, use the app.kubernetes.io/name: cert-manager and app.kubernetes.io/component: controller labels on the pod template. For instances that require a different metrics URL, provide the URL through autodiscovery annotations. For more information, see autodiscovery.
2. Optional: Configure static targets for managed clusters or custom installations that the labels don’t identify. For example, add the following to the values.yaml for your Chronosphere XDOT Helm chart:
   config:
     integrations:
       cert_manager:
         endpoints:
           - endpoint: 10.0.0.5:9402
   

​

Validate

To validate the cert-manager integration, follow these steps:

1. In the Live Telemetry Analyzer, filter for cxdot.integration.name=cert_manager. Confirm that the cert-manager metric names appear.
2. In Metrics Explorer, run the following query:
   max by ("certmanager.name", "k8s.namespace.name", "certmanager.condition") ({"certmanager.certificate.ready"})
   
   Confirm that the query returns the expected time series for each certificate.

For more information about diagnosing a failing integration, see Troubleshooting.

​

Configuration reference

Configure one cert-manager integration instance with the following settings. In Helm values, place these settings under config.integrations.cert_manager. In a Collector configuration file, place them under cxdot.integrations.cert_manager.

​

Optional settings

• enabled Type: boolean. Optional. Default: true. Whether to enable this cert-manager integration instance. If true, the Collector runs the instance. If false, the Collector doesn’t run it.
• endpoints Type: array of object. Optional. Static cert-manager targets. A nonempty list disables automatic discovery for this integration instance, and the Collector collects metrics from only the listed targets. Specify each target as host:port. The Collector requests http://<host>:<port>/metrics.
• endpoints[].endpoint Type: string. Required. cert-manager target in host:port format.
• collection_interval Type: duration. Optional. Default: 60s. How often the Collector collects metrics from each cert-manager target.
• timeout Type: duration. Optional. Default: 60s. Maximum time allowed to collect metrics from one cert-manager target. The value must not exceed collection_interval.