A Kubernetes-native utility that monitors TLS certificate expiry and exposes metrics to Prometheus.
Certificate Expiry Monitor is a utility that continuously checks TLS certificates on Kubernetes pods and ingresses, exposing their expiry status as Prometheus metrics. It solves the problem of unexpected certificate expirations by providing real-time monitoring and alerting capabilities. The tool automatically discovers services in your cluster and tracks certificate validity to prevent downtime.
DevOps engineers and SREs managing Kubernetes clusters who need to monitor TLS certificate expiration across multiple services. It's particularly useful for teams using Prometheus for observability who want to integrate certificate health into their existing monitoring dashboards.
Developers choose this tool because it's purpose-built for Kubernetes environments with native integration, automatic service discovery, and lightweight operation. Unlike manual checking or generic monitoring solutions, it provides specialized certificate metrics with Kubernetes context (namespaces, pods, domains) ready for Prometheus alerting.
Utility that exposes the expiry of TLS certificates as Prometheus metrics
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses Kubernetes APIs to automatically discover pods and ingresses across namespaces with label selectors, reducing manual configuration for dynamic clusters.
Exposes detailed gauges and counters for certificate status and expiry times via a /metrics endpoint, enabling seamless integration with Prometheus alerting and dashboards.
Supports regex-based exclusions with the -ignoredDomains flag, allowing precise filtering of domains to monitor, as documented in the command-line options.
Runs as a minimal container with adjustable polling frequency and health endpoints, balancing resource efficiency with real-time monitoring needs.
The -insecure flag defaults to true, skipping TLS verification, which could lead to security oversights if not explicitly disabled in production.
It only tracks certificate expiry and does not handle renewal or issuance, requiring additional tools like cert-manager for complete certificate lifecycle management.
Tightly coupled to Kubernetes and Prometheus, making it unsuitable for hybrid or alternative monitoring environments without significant workarounds.