From 870847ad4cb7ec7c509f1bbb98b574974de3a102 Mon Sep 17 00:00:00 2001 From: Leonardo Taccari Date: Sun, 5 Nov 2023 12:23:43 +0100 Subject: [PATCH] Comment NGINXCertificateExpiry alert label matcher (#10613) If a valid certificate is passed via `--default-ssl-certificate` it is probably desiderable that we check its expiration! Add a comment to explain that. --- charts/ingress-nginx/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 51dccaac0..a63690b6a 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -737,6 +737,11 @@ controller: # annotations: # description: bad ingress config - nginx config test failed # summary: uninstall the latest ingress changes to allow config reloads to resume + # # By default a fake self-signed certificate is generated as default and + # # it is fine if it expires. If `--default-ssl-certificate` flag is used + # # and a valid certificate passed please do not filter for `host` label! + # # (i.e. delete `{host!="_"}` so also the default SSL certificate is + # # checked for expiration) # - alert: NGINXCertificateExpiry # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!="_"}) by (host) - time()) < 604800 # for: 1s