<p>I need to find the certificate validation for K8S cluster , e.g. to use the alert manager to notify  when the
certificate is about to expire and send sutible notification.</p>

<p>I found this <a href="https://github.com/ribbybibby/ssl_exporter" rel="nofollow noreferrer">repo</a> but not I’m not sure how configure it, what is the target and how to achieve it?</p>

<p><a href="https://github.com/ribbybibby/ssl_exporter" rel="nofollow noreferrer">https://github.com/ribbybibby/ssl_exporter</a></p>

<p>which based on the black-box exporter </p>

<p><a href="https://github.com/prometheus/blackbox_exporter" rel="nofollow noreferrer">https://github.com/prometheus/blackbox_exporter</a></p>

<pre><code>
- job_name: "ssl"
  metrics_path: /probe
  static_configs:
    - targets:
        - 127.0.0.1
  relabel_configs:
    - source_labels: [__address__]
      target_label: __param_target
    - source_labels: [__param_target]
      target_label: instance
    - target_label: __address__
      replacement: 127.0.0.1:9219 # SSL exporter.



</code></pre>

<p>I want to check the current K8S cluster (where Prometheus is deployed) , to see whether the certificate is valid or not.
What should I put there <strong>inside the</strong> <strong>target</strong> to make it work? </p>

<p>Do I need to expose something in cluster ?</p>

<p><strong>update</strong>
This is where out certificate located in the system</p>

<pre><code>      tls:
        mode: SIMPLE
        privateKey: /etc/istio/bide-tls/tls.key
        serverCertificate: /etc/istio/bide-tls/tls.crt

</code></pre>

<p>My scenario is:</p>

<p>Prometheus and the ssl_exporter are in the same cluster, that the certificate which they need to check is in the same cluster also. (see the config above) </p>

JME
<blockquote>
  <p>What should I put there inside the target to make it work? </p>
</blockquote>

<p>I think the <a href="https://github.com/ribbybibby/ssl_exporter/tree/v0.6.0#targets" rel="nofollow noreferrer">"Targets" section of the readme</a> is clear: it contains the endpoints that you wish the monitor to report on:</p>

<pre><code>static_configs:
  - targets:
      - kubernetes.default.svc.cluster.local:443
      - gitlab.com:443
relabel_configs:
  - source_labels: [__address__]
    target_label: __param_target
  - source_labels: [__param_target]
    target_label: instance
  - target_label: __address__
    # rewrite to contact the SSL exporter
    replacement: 127.0.0.1:9219
</code></pre>

<blockquote>
  <p>Do I need to expose something in cluster ?</p>
</blockquote>

<p>Depends on if you want to report on <strong>internal</strong> certificates, or whether the <code>ssl_exporter</code> can reach the endpoints you want. For example, in the snippet above, I used the KubeDNS name <code>kubernetes.default.svc.cluster.local</code> with the assumption that <code>ssl_exporter</code> is running as a Pod within the cluster. If that doesn't apply to you, the you would want to change that endpoint to be <code>k8s.my-cluster-dns.example.com:6443</code> or whatever your kubernetes API is listening upon that your <code>kubectl</code> can reach.</p>

<p>Then, in the same vein, if both prometheus and your ssl_exporter are running inside the cluster, then you would change <code>replacement:</code> to be the <code>Service</code> IP address that is backed by your ssl_exporter Pods. If prometheus is outside the cluster and ssl_monitor is inside the cluster, then you'll want to create a <code>Service</code> of <code>type: NodePort</code> so you can point your prometheus at one (or all?) of the Node IP addresses and the <code>NodePort</code> upon which ssl_exporter is listening</p>

<p>The only time one would use the literal <code>127.0.0.1:9219</code> is if prometheus and the ssl_exporter are running on the same machine or in the same Pod, since that's the only way that 127.0.0.1 is meaningful from prometheus's point of view</p>
