Skip to content

Add metric to monitor cert expiry time #2592

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
annanay25 wants to merge 2 commits into from
Closed

Add metric to monitor cert expiry time #2592

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d07b5fa
Add metric to monitor cert expiry time
annanay25 May 14, 2020
4c171df
Update CHANGELOG
annanay25 May 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@
* `cortex_storegateway_blocks_last_successful_sync_timestamp_seconds`
* [ENHANCEMENT] Experimental TSDB: added the flag `-experimental.tsdb.wal-compression-enabled` to allow to enable TSDB WAL compression. #2585
* [ENHANCEMENT] Experimental TSDB: Querier and store-gateway components can now use so-called "caching bucket", which can currently cache fetched chunks into shared memcached server. #2572
* [ENHANCEMENT] Added new metric to monitor TLS client cert expiry time. #2592
* [BUGFIX] Ruler: Ensure temporary rule files with special characters are properly mapped and cleaned up. #2506
* [BUGFIX] Fixes #2411, Ensure requests are properly routed to the prometheus api embedded in the query if `-server.path-prefix` is set. #2372
* [BUGFIX] Experimental TSDB: fixed chunk data corruption when querying back series using the experimental blocks storage. #2400
Expand Down
16 changes: 16 additions & 0 deletions pkg/util/tls/tls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,19 @@ import (
"io/ioutil"

"github.com/pkg/errors"
"github.com/prometheus/client_golang/prometheus"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
)

var (
tlsCertNotAfterTimestamp = prometheus.NewGaugeVec(prometheus.GaugeOpts{
Namespace: "cortex",
Name: "tls_cert_not_after_timestamp",
Help: "Timestamp of expiry for the TLS certificate",
}, []string{"filename"})
)

// ClientConfig is the config for client TLS.
type ClientConfig struct {
CertPath string `yaml:"tls_cert_path"`
Expand Down Expand Up @@ -41,6 +50,13 @@ func (cfg *ClientConfig) GetTLSConfig() (*tls.Config, error) {
caCertPool = x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)
if len(clientCert.Certificate) > 0 && caCertPool != nil {
prometheus.MustRegister(tlsCertNotAfterTimestamp)
Copy link
Contributor

@pstibrany pstibrany May 14, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use new promauto package and give it a registrerer.

Copy link
Contributor

@pracucci pracucci May 14, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not even correct register it here, because if the GetTLSConfig() is called twice, it will panic because of a double registration. You can just use promauto.NewGaugeVec() above, even if we should stop using the global prometheus registerer, but if you really want this metric then using the global registry is the easiest option given the current design.

var x509Cert *x509.Certificate
var err error
if x509Cert, err = x509.ParseCertificate(clientCert.Certificate[0]); err != nil {
return nil, errors.Wrap(err, "error parsing TLS certificate")
}
tlsCertNotAfterTimestamp.WithLabelValues(cfg.CertPath).Set(float64(x509Cert.NotAfter.Unix()))
return &tls.Config{
InsecureSkipVerify: true,
Certificates: []tls.Certificate{clientCert},
Expand Down