🔒 TLS certificate monitor

TLS certificates protect HTTPS connections. This optional monitor warns before a certificate stored in a Kubernetes Secret expires.

Watches for TLS/SSL certificates in kubernetes.io/tls Secrets that are about to expire. This monitor is off by default because it requires an additional RBAC permission (secrets).

How detection works

1. kwatch lists all Secrets of type kubernetes.io/tls in watched namespaces
2. Decodes and parses the tls.crt field (PEM-encoded X.509 certificate)
3. Checks NotAfter against current time
4. If less than threshold days away → alert with normal severity
5. If less than criticalThreshold days away → alert with high severity
6. Runs every 24 hours

Configuration

Parameter	Type	Default	Description
tlsMonitor.enabled	bool	false	Enable TLS certificate monitoring.
tlsMonitor.threshold	int (days)	30	Days before expiry to warn.
tlsMonitor.criticalThreshold	int (days)	3	Days before expiry to raise severity to high.

Required RBAC

The TLS monitor needs secrets access. Enable TLS from kwatch.sh, which updates the managed RBAC safely. For a custom installation, grant the running ServiceAccount these read-only permissions:

- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch"]

Configuration fragment

Add this fragment through kwatch.sh's Configure settings flow, or merge it into the configuration file used by your existing supported installation:

tlsMonitor:
  enabled: true
  threshold: 30
  criticalThreshold: 3

Multiple certificates in one Secret

If a Secret contains multiple certificates (e.g. both RSA and ECDSA), kwatch checks all of them and alerts on the earliest expiry.