Add cert monitor manifest

cert-manager/cert-monitor.yaml

@@ -0,0 +1,116 @@
+# This is the certificate expiration monitor
+# It creates a Pod containing:
+# * A Prometheus server, which:
+#   * scrapes the metrics from cert-manager
+#   * converts the metric to something "alertable" (days until expiration) with rules
+# * GKE Stack Driver Exporter - https://github.com/Stackdriver/stackdriver-prometheus-sidecar
+#   * Reads the WAL from Prometheus Server Data directory
+#   * Send the metric to Stack Driver
+# Because the metric is generated by Prometheus Recordin Rules, it does not contain
+# the metadata from metrics, so we need to 'tell' the stackdriver exporter what kind
+# of metric is that
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: exporterconfig
+  namespace: cert-manager
+data:
+  prometheus.yaml: |
+    global:
+      scrape_interval:     600s # 10 minutes is enough for cert monitoring
+      evaluation_interval: 600s
+    rule_files:
+      - "cert_rules.yaml"
+    scrape_configs:
+      - job_name: certmanager
+        static_configs:
+        - targets: ['cert-manager.cert-manager:9402']
+        metric_relabel_configs: # We need to rename the 'namespace' label to not conflict with GCE labels
+        - source_labels: ['namespace']
+          target_label: 'k8s_ns'
+  cert_rules.yaml: |
+    groups:
+    - name: certificate_rules
+      rules: # Generate a new metric called certificate_expire_remaining_days with the ammount of days until a cert expires
+      - record: certificate_expire_remaining_days 
+        expr: (certmanager_certificate_expiration_timestamp_seconds - time())/86400
+  sdexporter.yaml: |
+    static_metadata:
+    - metric: certificate_expire_remaining_days # We need to tell the Stack Driver exporter this metric exists and it's format, as this was generated by prometheus recording rules
+      type: gauge 
+      value_type: double 
+      help: Seconds until a certificate days
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: prom-certmanager
+  name: prom-certmanager
+  namespace: cert-manager
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: prom-certmanager
+  template:
+    metadata:
+      labels:
+        app: prom-certmanager
+    spec:
+      containers:
+      - image: prom/prometheus:v2.24.1
+        name: prometheus
+        args:
+        - --storage.tsdb.path=/data
+        - --config.file=/etc/prometheus/prometheus.yaml
+        volumeMounts:
+        - mountPath: /etc/prometheus
+          name: exporterconfig
+        - mountPath: /data
+          name: promdata
+        resources: 
+          limits:
+            memory: "1Gi" # Prometheus might be resource hungry
+            cpu: "100m" # And CPU hungry!
+      - name: sidecar
+        image: gcr.io/stackdriver-prometheus/stackdriver-prometheus-sidecar:0.8.2
+        imagePullPolicy: Always
+        args:
+        - --stackdriver.project-id=kubernetes-public
+        - --stackdriver.generic.location=us-central1
+        - --stackdriver.generic.namespace=cert-manager
+        - --prometheus.api-address=http://127.0.0.1:9090
+        - --prometheus.wal-directory=/data/wal
+        - --include=certificate_expire_remaining_days # We just want to export this metric, otherwise it will generate extra costs
+        - --config-file=/etc/stackdriver/sdexporter.yaml
+        ports:
+        - name: sidecar
+          containerPort: 9091
+        volumeMounts:
+        - mountPath: /etc/stackdriver
+          name: exporterconfig
+        - name: promdata
+          mountPath: /data
+        resources: 
+          limits:
+            memory: "256Mi" 
+            cpu: "10m"
+      securityContext:
+        fsGroup: 2000 
+        runAsGroup: 2000
+        runAsUser: 1000
+      volumes:
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: prometheus.yaml
+            path: prometheus.yaml
+          - key: cert_rules.yaml
+            path: cert_rules.yaml
+          - key: sdexporter.yaml
+            path: sdexporter.yaml
+          name: exporterconfig
+        name: exporterconfig
+      - name: promdata
+        emptyDir: {}