fix(base-cluster/monitoring): adjust for short-lived certificates

[cwrau]

Make certificate alerts relative to renewal time, otherwise short-lived
certificates always result in alerts.

Summary by CodeRabbit

• Chores
  • Improved certificate expiration monitoring with renewal-based alert conditions for better accuracy.
  • Enhanced certificate alerts to trigger based on renewal status and expiration timeline metrics.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The certificate expiration PrometheusRule is updated with two new renewal-based alerts that replace simple expiration checks. CertificatePastRenewalTime triggers when renewal hasn't occurred within 30 minutes, while CertificatePastRenewalTimeHalfwayToExpiration triggers at the midpoint between renewal timestamp and expiration timestamp.

Changes

Cohort / File(s)

Summary

Cert-Manager Alert Configuration charts/base-cluster/templates/cert-manager/rules/certificate-expiration.yaml

Renamed and refactored two alerts from simple expiration-based to renewal-based conditions. First alert (CertificatePastRenewalTime) checks if renewal hasn't occurred in 30 minutes. Second alert (CertificatePastRenewalTimeHalfwayToExpiration) uses mathematical calculation to detect certificates at midpoint between last renewal and expiration. Updated descriptions and summary text to reflect renewal-focused monitoring strategy.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Suggested labels

base-cluster

Suggested reviewers

• tasches
• marvinWolff
• teutonet-bot

Poem

🐰 Hop, hop! The certs now renew on time,
No more waiting till the bell doth chime,
Halfway there, we sound the call,
Before expiration takes them all! 🔐

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adjusting certificate alerts to handle short-lived certificates, which aligns with the PR's objective of making alerts renewal-relative.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This pull request adjusts certificate expiration monitoring alerts to work correctly with short-lived certificates by making alert thresholds relative to renewal time instead of fixed time periods.

Changes:

• Replaced time-based expiration alerts (14 days, 7 days) with renewal-based alerts
• First alert now triggers when a certificate hasn't been renewed within 30 minutes of its renewal time
• Second alert now triggers when a certificate is halfway between renewal and expiration without being renewed

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.