Prometheus metric for certificate ready condition

[seleznev]

Is your feature request related to a problem? Please describe.

cert-manager exposes only one Certificate kind related metric (certmanager_certificate_expiration_timestamp_seconds) right now and it is not enough for proper monitoring. For example, it would be great to known when new certificate hang on signing for some reason.

Describe the solution you'd like

kube-state-metrics exposes some similar metrics, for example kube_pod_status_ready. I suggest to add something like this to cert-manager.

Environment details (if applicable):

• cert-manager v0.7.2

/kind feature

[munnerz]

Exposing more information through metrics is definitely something we want to do.

Could you elaborate some more on the types of metrics you'd like to see, and how you'd expect us to set these metrics/the values that we use?

[seleznev]

Could you elaborate some more on the types of metrics you'd like to see, and how you'd expect us to set these metrics/the values that we use?

Personally, I prefer to see metrics consistent with another Kubernetes resources metrics (exposed by kube-state-metrics). So, I suggest to add metric like this:

# HELP certmanager_certificate_status_ready Describes whether the certificate is ready to use.
# TYPE certmanager_certificate_status_ready gauge
certmanager_certificate_status_ready{condition="false",name="something",namespace="default"} 0
certmanager_certificate_status_ready{condition="true",name="something",namespace="default"} 1
certmanager_certificate_status_ready{condition="unknown",name="something",namespace="default"} 0

But any another way to let users known about certificate that has not ready=True status is ok. :)

A simple patch to illustrate: https://github.com/seleznev/cert-manager/commit/1e08ec33a625b75f3a5293f99a36583d2dc44637 (no pull request because I didn't tested it with master and we should wait #1681 to be merged anyway).

[cheukwing]

/assign
/lifecycle active

[Hackmeat]

hi,
i have a question about this metric, right now i get all 3 conditions back from cert manager for every single certificate. Is there a way to only get the one showing the right status?