OCPBUGS-85777: Add root CA expiration monitoring for cert-manager

[sebrandon1]

Summary

Adds PrometheusRule alerting on root CA certificate expiration via ACM Policy. Fires warning at 90 days and critical at 30 days before expiry. Extends existing CertificatePolicy to also monitor the cert-manager namespace.

Split from #773 — this is the hub-side root CA monitoring only, independent of the hub-spoke trust and kubeconfig guidance work targeted for November.

OCPBUGS-85777

Changes

New resources (reference-crs + kube-compare templates):

• certManagerRootCAExpirationPolicy.yaml — ACM Policy wrapping a PrometheusRule that monitors certmanager_certificate_expiration_timestamp_seconds
• certManagerRootCAExpirationPolicyPlacement.yaml — targets local-cluster
• certManagerRootCAExpirationPolicyPlacementBinding.yaml — binds policy to placement

Modified:

• certManagerCertificatePolicy.yaml — adds cert-manager to monitored namespace list
• metadata.yaml — adds cert-manager-root-ca-monitoring component
• compare_ignore — adds ignore entries for RootCAExpirationPolicy and kustomization
• default_value.yaml — adds cert-manager to CertificatePolicy namespace defaults
• kustomization.yaml — adds three root CA monitoring resources

Testing

Validated on OCP 4.21 hub with cert-manager v1.19.0 (see #773 for full test results).

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign lack for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5f947560-a61c-4a36-8212-882a945c436a

📥 Commits

Reviewing files that changed from the base of the PR and between fb8a1d5 and 27058c6.

📒 Files selected for processing (1)

• telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml

---

📝 Walkthrough

Walkthrough

Adds cert-manager root CA expiration alerting, local-cluster placement and binding resources, Kustomization entries, expanded certificate namespace coverage, and comparison metadata for the new resource set.

Changes

Cert-manager monitoring

Layer / File(s)	Summary
Root CA expiration policy telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml	Adds an enforced ACM policy that creates warning and critical Prometheus alerts for root CA certificate expiration.
Cluster targeting and distribution telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml, telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml, telco-hub/configuration/reference-crs/optional/cert-manager/kustomization.yaml, telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/*	Targets local-cluster=true, binds the policy to the placement, and includes the policy resources in Kustomizations and comparison references.
Certificate scope and comparison metadata telco-hub/configuration/reference-crs/optional/cert-manager/certManagerCertificatePolicy.yaml, telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerCertificatePolicy.yaml, telco-hub/configuration/reference-crs-kube-compare/default_value.yaml, telco-hub/configuration/reference-crs-kube-compare/metadata.yaml, telco-hub/configuration/reference-crs-kube-compare/compare_ignore	Adds the cert-manager namespace to certificate policy selectors and registers the root CA monitoring resource set for comparison.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ACM Policy
  participant ConfigurationPolicy
  participant PrometheusRule
  ACM Policy->>ConfigurationPolicy: enforce root CA monitoring configuration
  ConfigurationPolicy->>PrometheusRule: create expiration alert rules

Loading

Suggested reviewers: fedepaol, imiller0

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding root CA expiration monitoring for cert-manager.
Description check	✅ Passed	The description is clearly related to the changeset and matches the added policies, alerts, and config updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml`:
- Around line 33-35: Update the PrometheusRule metadata in
certManagerRootCAExpirationPolicy so its namespace matches the queried
cert-manager namespace, or configure the required user-workload-monitoring
namespacesWithoutLabelEnforcement exemption for cert-manager-operator and keep
that exemption managed in configuration.

In
`@telco-hub/configuration/reference-crs/optional/cert-manager/kustomization.yaml`:
- Around line 16-18: Update the cert-manager optional Kustomization to include
the required metrics scrape ServiceMonitor and RBAC resources for the cluster
Prometheus User Workload stack, alongside the existing
certManagerRootCAExpirationPolicy resources. If these resources are
intentionally provisioned elsewhere, document that dependency and ensure the
external component reliably installs them.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1061e58f-c7eb-4868-abe7-3bf27943e1bd

📥 Commits

Reviewing files that changed from the base of the PR and between f9edd30 and fb8a1d5.

📒 Files selected for processing (11)

• telco-hub/configuration/reference-crs-kube-compare/compare_ignore
• telco-hub/configuration/reference-crs-kube-compare/default_value.yaml
• telco-hub/configuration/reference-crs-kube-compare/metadata.yaml
• telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerCertificatePolicy.yaml
• telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml
• telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml
• telco-hub/configuration/reference-crs/optional/cert-manager/certManagerCertificatePolicy.yaml
• telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml
• telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml
• telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml
• telco-hub/configuration/reference-crs/optional/cert-manager/kustomization.yaml

[openshift-ci-robot]

@sebrandon1: This pull request references Jira Issue OCPBUGS-85777, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Adds PrometheusRule alerting on root CA certificate expiration via ACM Policy. Fires warning at 90 days and critical at 30 days before expiry. Extends existing CertificatePolicy to also monitor the cert-manager namespace.

Split from #773 — this is the hub-side root CA monitoring only, independent of the hub-spoke trust and kubeconfig guidance work targeted for November.

OCPBUGS-85777

Changes

New resources (reference-crs + kube-compare templates):

• certManagerRootCAExpirationPolicy.yaml — ACM Policy wrapping a PrometheusRule that monitors certmanager_certificate_expiration_timestamp_seconds
• certManagerRootCAExpirationPolicyPlacement.yaml — targets local-cluster
• certManagerRootCAExpirationPolicyPlacementBinding.yaml — binds policy to placement

Modified:

• certManagerCertificatePolicy.yaml — adds cert-manager to monitored namespace list
• metadata.yaml — adds cert-manager-root-ca-monitoring component
• compare_ignore — adds ignore entries for RootCAExpirationPolicy and kustomization
• default_value.yaml — adds cert-manager to CertificatePolicy namespace defaults
• kustomization.yaml — adds three root CA monitoring resources

Testing

Validated on OCP 4.21 hub with cert-manager v1.19.0 (see #773 for full test results).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.