Prometheus Integration

Prometheus Integration with TigerTrust

TigerTrust provides a native Prometheus exporter for cloud-native certificate monitoring.

Exporter Deployment

Deploy the TigerTrust exporter:

yaml
1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  name: tigertrust-exporter
5spec:
6  replicas: 1
7  template:
8    spec:
9      containers:
10      - name: exporter
11        image: tigertrust/prometheus-exporter:latest
12        ports:
13        - containerPort: 9090
14        env:
15        - name: TIGERTRUST_API_KEY
16          valueFrom:
17            secretKeyRef:
18              name: tigertrust-credentials
19              key: api-key

Available Metrics

TigerTrust exports comprehensive certificate metrics:

text
1# Certificate count by status
2tigertrust_certificates_total{status="valid|expiring|expired"}
3
4# Days until expiration
5tigertrust_certificate_expiry_days{common_name, issuer, environment}
6
7# Certificate operations
8tigertrust_certificate_renewals_total{status="success|failure"}
9tigertrust_certificate_discoveries_total{source}
10
11# Policy violations
12tigertrust_policy_violations_total{policy, severity}

Prometheus Configuration

Add TigerTrust to your prometheus.yml:

yaml
1scrape_configs:
2  - job_name: 'tigertrust'
3    static_configs:
4      - targets: ['tigertrust-exporter:9090']
5    relabel_configs:
6      - source_labels: [__address__]
7        target_label: instance
8        replacement: tigertrust

PromQL Queries

Query certificate metrics with PromQL:

promql
1# Certificates expiring within 30 days
2count(tigertrust_certificate_expiry_days < 30)
3
4# Average days to expiration by environment
5avg by (environment) (tigertrust_certificate_expiry_days)
6
7# Renewal success rate
8rate(tigertrust_certificate_renewals_total{status="success"}[1h]) /
9rate(tigertrust_certificate_renewals_total[1h])

AlertManager Rules

Configure certificate alerts:

yaml
1groups:
2- name: certificates
3  rules:
4  - alert: CertificateExpiringSoon
5    expr: tigertrust_certificate_expiry_days < 14
6    for: 1h
7    labels:
8      severity: warning
9    annotations:
10      summary: "Certificate {{ $labels.common_name }} expires in {{ $value }} days"
11
12  - alert: CertificateExpired
13    expr: tigertrust_certificate_expiry_days <= 0
14    labels:
15      severity: critical
16    annotations:
17      summary: "Certificate {{ $labels.common_name }} has expired!"

Kubernetes Service Discovery

Auto-discover certificates in Kubernetes:

yaml
1scrape_configs:
2  - job_name: 'tigertrust-kubernetes'
3    kubernetes_sd_configs:
4      - role: service
5    relabel_configs:
6      - source_labels: [__meta_kubernetes_service_annotation_tigertrust_scrape]
7        action: keep
8        regex: true

Achieve cloud-native certificate monitoring with Prometheus and TigerTrust.