metricas

cert-manager.md

Certificate Lifecycle Metrics (HIGHLY useful)

certmanager_certificate_expiration_timestamp_seconds When cert-manager thinks the cert will expire.
Best for alerting.

📈 Use to alert if cert expires in < X days.

certmanager_certificate_not_after_timestamp_seconds

Timestamp from the actual certificate (NotAfter field).
Use to verify that cert-manager's expected expiration matches reality.

certmanager_certificate_not_before_timestamp_seconds

When the certificate becomes valid (NotBefore).
Mostly for audit/debug; not usually needed for alerts.

certmanager_certificate_renewal_timestamp_seconds

When cert-manager plans to renew the certificate.
Can be helpful to detect certs stuck/not renewing.

📈 Optional alert: If renewal time is in the past and cert is still close to expiring.

certmanager_certificate_ready_status

Value: 1 = Ready, 0 = Not Ready Critical for alerting on failed issuance or renewal.
Use for alert if cert is stuck in Not Ready state.

Clock & Controller Metrics (for cert-manager health)

certmanager_clock_time_seconds

Cert-manager's internal time.
Rarely used directly — can be compared to Prometheus time() if debugging time skew.

certmanager_controller_sync_call_count

How often each controller (eg: certificates, orders) runs its sync logic.
Use this for debugging performance issues.

certmanager_controller_sync_error_count

Total errors encountered by each controller.
📈 Can alert on non-zero error rates or sudden increases.

ACME (Let's Encrypt) Request Metrics

certmanager_http_acme_client_request_count

Total requests to the ACME server (e.g., Let's Encrypt).
Can be used to monitor request volume or detect excessive retries/failures.

certmanager_http_acme_client_request_duration_seconds

Histogram of how long ACME requests take.
Use for latency dashboards, or alert if requests take unusually long.