<p>I want to monitor my tls certificates in Kubernetes using Prometheus and get a dashboard in grafana. I want to monitor their expiry and would want to get an alert when the certificates are going to be expired in 30 days. I did a lot of research and I finally found <a href="https://github.com/enix/x509-exporter" rel="noreferrer">https://github.com/enix/x509-exporter</a>. How do I use it? Is there any other efficient way to monitor the expiry of the certificates?</p>

<p><em><strong>DISCLAIMER:</strong> I haven't tried this <a href="https://github.com/enix/x509-exporter" rel="nofollow noreferrer">x509-exporter</a>. Just giving suggestion as per my understanding.</em></p>
<p>The README file seems bit off. The first thing you need to do is create a github issue, no worries I raised one <a href="https://github.com/enix/x509-exporter/issues/5" rel="nofollow noreferrer">here</a>.</p>
<p>I am listing down steps as per my understanding and referring the <a href="https://github.com/enix/x509-exporter#usage" rel="nofollow noreferrer">usage section</a>.</p>
<ul>
<li>Use their <a href="https://hub.docker.com/r/enix/x509-exporter" rel="nofollow noreferrer">official docker image</a> and deploy it as a deployment on k8s.</li>
<li>Check sample k8s yaml files for creating deployment. Also note that the deployment yaml should mount a host directory where all the k8s certificates are stored.</li>
<li>As per <a href="https://kubernetes.io/docs/setup/best-practices/certificates/#where-certificates-are-stored" rel="nofollow noreferrer">documentation</a>, usually the certificates are located at <code>/etc/kubernetes/pki</code>.</li>
<li>The deployment yaml should contain a <a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#define-a-command-and-arguments-when-you-create-a-pod" rel="nofollow noreferrer">command</a> where you point the exporter to the directory where certificates are located with other necessary options. Like this</li>
</ul>
<pre><code>command: [&quot;x509-exporter&quot;]
args: [&quot;-d&quot;, &quot;/etc/kubernetes/pki&quot;, &quot;-p&quot;, &quot;8091&quot;, &quot;--debug&quot;]
</code></pre>
<p><em><strong>Note:</strong> Here I am running exporter in debug mode on port 8091, remember to expose this port.</em></p>
<ul>
<li>In prometheus config, add the x509-exporter endpoint as target to scrape the metrics and plot those by creating graphs in Grafana dashboard.</li>
</ul>
