Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds Prometheus alerting for webhook certificate expiry/rotation in the controlplane-operations Helm chart, and bumps the chart/plugin bundle version to publish the new rules.
Changes:
- Bumped chart and PluginDefinition versions from
1.1.9to1.1.10. - Added two new Prometheus alerts for webhook certificate near-expiry and about-to-expire conditions.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| charts/controlplane-operations/plugindefinition.yaml | Bumps PluginDefinition and referenced chart version to 1.1.10. |
| charts/controlplane-operations/Chart.yaml | Bumps Helm chart version to 1.1.10. |
| charts/controlplane-operations/alerts/controlplane-remote.yaml | Adds two new Prometheus alert rules for webhook certificate expiry thresholds. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
One question when a root / intermediary CA is used to issue certificates for webhook and they get rotated, cert-manager fails to rotate the issued certs. Have you guys solved this problem somehow? |
we generate and rotate a self-signed cert that is also CA completely by ourselfs and we mount it on the disk for the webhook server to automatically fetch/update: https://github.com/SAP-cloud-infrastructure/webhook-injector/blob/fd8a075a009300e5baa6b56917ea63751aa5b6f6/pkg/certificates/generator.go#L65 so basically just 1 certificate and with rotation also works fine without downtime, I haven't tested it, but Fabus did. there is also an e2e tests for it. |
Signed-off-by: Vladimir Videlov <vladimir.videlov@sap.com>
Signed-off-by: Vladimir Videlov <vladimir.videlov@sap.com>
videlov
force-pushed
the
alert-webhook-cert-expire
branch
from
988f597 to
23bc86f
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| expr: | | ||
| (webhook_injector_certificate_expiry_time_seconds - time()) < (90 * 24 * 3600 * 0.2) | ||
| for: {{ dig "WebhookCertificateNearExpiry" "for" "5m" .Values.prometheusRules }} |
No description provided.