feat(metrics): add issuer/signing_algorithm tags + destinations metric for Lemur dashboard by evan-datadog · Pull Request #334 · DataDog/lemur

evan-datadog · 2026-07-08T23:26:45Z

Summary

Three related changes on this branch:

1. Metric tag enrichment (`lemur/certificates/service.py`)

Adds issuer, signing_algorithm, and has_been_replaced tags to
lemur.certificates.days_until_expiration, and emits lemur.certificates.by_destination
gauge (1 per cert-destination pair).

Tag / Metric	Purpose
`issuer`	Break down by issuing CA
`signing_algorithm`	Break down by key type
`has_been_replaced`	`true` when cert has a non-self-referential successor — lets dashboards filter out superseded certs without a separate tag (CLOUDR-2049)
`lemur.certificates.by_destination`	1 gauge per cert-destination pair; group by `destination`

Dashboard (nqu-dbc-mtt) panels:

Panel	Query
By issuer	`sum:lemur.certificates.days_until_expiration{*} by {issuer}`
By algorithm	`sum:lemur.certificates.days_until_expiration{*} by {signing_algorithm}`
By destination	`sum:lemur.certificates.by_destination{*} by {destination}`
Active only	`...{has_been_replaced:false}`

2. CA-extensible DCV expiry Celery task (RDNA-1000)

Daily check_dcv_expiration task discovers CA plugins implementing get_dcv_expiration_data()
and emits lemur.dcv.days_until_expiration. DigiCert is the first implementation.

Metric	Type	Tags
`lemur.dcv.days_until_expiration`	gauge	`domain`, `ca`, `validation_type`, `org_id`

Note: Celery beat schedule entry must be added to k8s-resources chart/config/lemur.conf.py separately.

Test plan

DigiCert DCV tests pass (new_callable=MagicMock + plain dict config; Python 3.12 LocalProxy compat)
has_been_replaced tag validated in unit test
lemur.certificates.by_destination visible in DD after staging deploy
k8s-resources PR to add check_dcv_expiration to beat schedule

Tickets: NIT-26-07, RDNA-1000, CLOUDR-2049
Workspace: evan-lemur

🤖 Generated with Claude Code

Enrich lemur.certificates.days_until_expiration with two low-cardinality tags (issuer, signing_algorithm) and emit a new lemur.certificates.by_destination gauge (1 per cert-destination pair) to enable replication of the Issuers, Signing Algorithms, and Destinations panels from the Lemur UI /#!/dashboard. Tag cardinality: issuer ~5-10, signing_algorithm ~3-5 values. Destinations loaded via joinedload to avoid N+1 queries. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> Workspace: evan-lemur

Copilot

Pull request overview

Adds additional certificate metrics/tagging to support reproducing the Lemur /#!/dashboard panels in Datadog, including issuer/signing-algorithm breakdowns and a destinations breakdown.

Changes:

Adds issuer and signing_algorithm tags to certificates.days_until_expiration.
Emits a new certificates.by_destination gauge (1 per cert-destination pair).
Updates the expiration-metrics query to eager-load Certificate.destinations to avoid N+1 when emitting destination metrics.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Add check_dcv_expiration Celery task that iterates all registered issuer plugins implementing get_dcv_expiration_data() and emits lemur.dcv.days_until_expiration gauge per domain. - IssuerPlugin base: optional get_dcv_expiration_data() hook (default: []) - DigiCert plugin: first implementation via GET /v2/domain (paginated) - Metric tags: domain, ca, validation_type, org_id - Config: DIGICERT_DCV_CHECK_ENABLED (default True) - Schedule entry added to local/src/lemur.conf.py as commented reference (production schedule goes in k8s-resources chart/config/lemur.conf.py) Other CAs add DCV monitoring by overriding get_dcv_expiration_data() -- no changes to the Celery task required. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

datadog-prod-us1-3 · 2026-07-09T00:56:18Z

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 1 Pipeline job failed

DataDog/lemur | test

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 2badfde | Docs | Datadog PR Page | Give us feedback!}

…n_data Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

@patch

Calling check_dcv_expiration.run() bypasses ContextTask.__call__ which requires a real Flask app context; .run() calls the function directly. Adding the app fixture ensures the Flask context is active when lemur.common.celery is first imported by the @patch decorators. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

…fix warn - Remove cert_id from certificates.by_destination tags (cardinality) - Default issuer/signing_algorithm to "unknown" when null - Replace deprecated logger.warn with logger.warning Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

…V tests DigiCertIssuerPlugin.__init__ accesses current_app.config["DIGICERT_API_KEY"] via __getitem__, not .get(). The previous Mock(side_effect=...) pattern only patched .get(), leaving __getitem__ returning a MagicMock. That MagicMock ended up as the X-DC-DEVKEY session header value, which requests rejects with InvalidHeader when the request is prepared. Switching to a plain dict satisfies .get(), [], and `in` checks alike. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

…thon 3.12 mock compat service.py: include replaced certificates in expiry metrics query and add has_been_replaced tag so dashboards can distinguish them. test_certificates.py: add test for has_been_replaced tag in metrics. test_dcv_celery.py: use new_callable=MagicMock on current_app patch to avoid Python 3.12 LocalProxy hasattr issue; drop unused app fixture. test_digicert.py: add MagicMock import; use new_callable=MagicMock on DCV test patches for the same Python 3.12 compatibility reason. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

- service.py: simplify has_been_replaced to bool(certificate.replaced); add joinedload(Certificate.replaced) to avoid N+1 queries - celery.py: add exc_info=True + capture_exception() to per-plugin and per-entry error paths; re-raise SoftTimeLimitExceeded before Exception in both inner blocks; use datetime.now(timezone.utc) (3.12 compat); remove redundant local 'import datetime' - plugin.py: guard DIGICERT_URL=None with an actionable ValueError - lemur.conf.py: remove dead DIGICERT_DCV_CHECK_INTERVAL constant Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

maperu · 2026-07-10T16:06:31Z

    """
    query = (
        database.db.session.query(Certificate)
+        .options(selectinload(Certificate.destinations))


you need to import that one too

evan-datadog · 2026-07-10T16:17:32Z

🤖 Splitting this into two independent PRs so the DCV work and the dashboard-metrics work can be reviewed/merged on their own timelines:

feat(celery): CA-extensible check_dcv_expiration task (RDNA-1000) #335 — DCV expiry Celery task (RDNA-1000)
feat(metrics): add issuer/signing_algorithm tags + destinations metric for Lemur dashboard #336 — issuer/signing_algorithm tags + destinations metric (NIT-26-07, CLOUDR-2049)

Closing this one in favor of those two.

…c-tags Merges issuer/signing_algorithm normalization maps, _normalize_issuer, _normalize_signing_algorithm, DCV celery task, and all associated fixes from the closed PR #334 branch into PR #336. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: local

evan-datadog requested review from a team as code owners July 8, 2026 23:26

evan-datadog requested a review from Copilot July 9, 2026 00:30

Copilot started reviewing on behalf of evan-datadog July 9, 2026 00:31 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Comment thread lemur/certificates/service.py

Comment thread lemur/certificates/service.py Outdated

Comment thread lemur/certificates/service.py Outdated

Comment thread lemur/certificates/service.py

evan-datadog added 5 commits July 9, 2026 01:15

fix(lint): wrap long docstring line in IssuerPlugin.get_dcv_expiratio…

27a936d

…n_data Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

fix(lint): remove unused call import in test_dcv_celery

4334dba

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Workspace: evan-lemur

evan-datadog commented Jul 9, 2026

View reviewed changes

Comment thread local/src/lemur.conf.py

evan-datadog added 2 commits July 9, 2026 21:00

evan-datadog requested a review from Copilot July 10, 2026 14:46

Copilot started reviewing on behalf of evan-datadog July 10, 2026 14:47 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread lemur/common/celery.py

Comment thread lemur/certificates/service.py

Comment thread lemur/tests/test_dcv_celery.py

Comment thread lemur/tests/test_certificates.py

evan-datadog and others added 3 commits July 10, 2026 11:44

Change loading strategy for certificate relationships

b78e1ad

Update metrics namespace for DCV expiration checks

b6b89d6

Apply suggestions from code review

6248cd6

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

maperu reviewed Jul 10, 2026

View reviewed changes

Replace joinedload with selectinload in service.py

2badfde

This was referenced Jul 10, 2026

feat(celery): CA-extensible check_dcv_expiration task (RDNA-1000) #335

Open

feat(metrics): add issuer/signing_algorithm tags + destinations metric for Lemur dashboard #336

Open

evan-datadog closed this Jul 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(metrics): add issuer/signing_algorithm tags + destinations metric for Lemur dashboard#334

feat(metrics): add issuer/signing_algorithm tags + destinations metric for Lemur dashboard#334
evan-datadog wants to merge 13 commits into
masterfrom
evan/NIT-26-07/enrich-expiry-metric-tags

evan-datadog commented Jul 8, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

datadog-prod-us1-3 Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

maperu Jul 10, 2026

Uh oh!

evan-datadog commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

evan-datadog commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

1. Metric tag enrichment (lemur/certificates/service.py)

2. CA-extensible DCV expiry Celery task (RDNA-1000)

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

datadog-prod-us1-3 Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

maperu Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

evan-datadog commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

evan-datadog commented Jul 8, 2026 •

edited

Loading

1. Metric tag enrichment (`lemur/certificates/service.py`)

datadog-prod-us1-3 Bot commented Jul 9, 2026 •

edited

Loading