groups:
  - name: x509-certificate-exporter.rules
    rules:
      - alert: X509ExporterReadErrors
        annotations:
          description:
            Over the last 15 minutes, this x509-certificate-exporter instance
            has experienced errors reading certificate files or querying the Kubernetes
            API. This could be caused by a misconfiguration if triggered when the exporter
            starts.
          summary: Increasing read errors for x509-certificate-exporter
        expr: delta(x509_read_errors[15m]) > 0
        for: 5m
        labels:
          severity: warning
      - alert: CertificateError
        annotations:
          description:
            Certificate could not be decoded {{if $labels.secret_name }} in
            Kubernetes secret "{{ $labels.secret_namespace }}/{{ $labels.secret_name }}"{{else}}at
            location "{{ $labels.filepath }}"{{end}}
          summary: Certificate cannot be decoded
        expr: x509_cert_error > 0
        for: 15m
        labels:
          severity: warning
      - alert: CertificateRenewal
        annotations:
          description:
            Certificate for "{{ $labels.subject_CN }}" should be renewed {{if
            $labels.secret_name }}in Kubernetes secret "{{ $labels.secret_namespace }}/{{
            $labels.secret_name }}"{{else}}at location "{{ $labels.filepath }}"{{end}}
          summary: Certificate should be renewed
        expr:
          ((x509_cert_not_after{secret_name!="linkerd-identity-issuer", issuer_O="",
          issuer_CN!="webhook.linkerd.cluster.local"} - time()) / 86400) < 28
        for: 15m
        labels:
          severity: warning
      - alert: CertificateExpiration
        annotations:
          description:
            Certificate for "{{ $labels.subject_CN }}" is about to expire {{if
            $labels.secret_name }}in Kubernetes secret "{{ $labels.secret_namespace }}/{{
            $labels.secret_name }}"{{else}}at location "{{ $labels.filepath }}"{{end}}
          summary: Certificate is about to expire
        expr:
          ((x509_cert_not_after{secret_name!="linkerd-identity-issuer", issuer_O="",
          issuer_CN!="webhook.linkerd.cluster.local"} - time()) / 86400) < 14
        for: 15m
        labels:
          severity: critical