API certificate verification module Kubernetes (X.509 Certificate Exporter)

The Kubernetes components use multiple certificates to authenticate and securely communicate with each other. Expiring Kubernetes certificates are a common source of failure.

The Kubernetes API certificate verification module based on X.509 Certificate Exporter provides monitoring of certificate expiration dates (secrets) in the Kubernetes cluster and on cluster nodes. The module controls certificates:

  • ETCD server and client;
  • Kubernetes CA;
  • kube-apiserver;
  • kubelet;
  • kubeconfig files, which are used by various components for authentication to the API server;
  • PEM files.

The module is not a critical service for the operation of the Shturval platform.

Monitoring certificate expiration dates

Certificate expiration data is sent as metrics to Monitoring Engine Management Component (VM Agent). Based on metrics:

  • In the graphical interface of the Shturval platform, you can view certificate validity periods in the cluster.
  • A dashboard for monitoring the status of certificates is available in Grafana.

Module in GUI

To manage a service in a cluster, go to the Installed Services page of the Services and Repositories section. Find API Certificate Validator Kubernetes (shturval-cert-expiration) and click Manage.

If there is no such service in the cluster, go to the Available charts page of the Services and repositories section. On the shturval tab, select the shturval-cert-expiration chart and click Install.

Select the required chart version. After selecting the chart version, the available Configuration parameters for the service (values) will be displayed on the right side of the screen. If necessary, write parameters in the Service Specification block as customvalues.

For the service to work correctly, the Local metrics collection module component (shturval-monitoring-crds) must be installed and enabled in the cluster.

← Assign a role for debugging
Telegram →