Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

NautheraServerCertificateExpiringSoon

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

A certificate a nauthera-server listener serves expires within seven days.

Meaning

nauthera_tls_certificate_expiration_timestamp_seconds for a listener (http for the in-pod HTTPS listener, grpc for the AdminService) is less than the threshold (7 days) away, for an hour. The http certificate is read only at startup, so a certificate cert-manager renewed is not served until the pods restart. The grpc certificate is the one last taken into use at a handshake, which reads the files at most every 30 seconds: the file was not renewed, it was renewed but could not be loaded (grpc_tls_reload_failed in the log), or no client has connected since. A certificate the ingress serves is not measured here.

Impact

Nothing yet. If it expires: for http, every browser and relying party connecting directly to the pods fails TLS, so sign-in and token requests stop. For grpc, the operator and nauthera-cli cannot connect; clients already registered keep working.

Diagnosis

  1. Which listener and replicas: (nauthera_tls_certificate_expiration_timestamp_seconds\{ job="<name>"\} - time()) / 86400.
  2. Has cert-manager renewed it? kubectl -n <ns> get certificates and kubectl -n <ns> describe certificate <certificate> (Ready condition, renewal time, events). The chart renews both 15 days before expiry by default (certManager.httpTLS.renewBefore, certManager.grpcTLS.renewBefore).
  3. What the Secret holds now: kubectl -n &lt;ns&gt; get secret &lt;secret&gt; -o jsonpath='\{.data.tls\.crt\}' | base64 -d | openssl x509 -noout -enddate.
  4. For grpc: kubectl -n &lt;ns&gt; logs &lt;pod&gt; | jq 'select(.msg=="grpc_tls_reload_failed" or .msg=="grpc_tls_reloaded")'.

Mitigation

  • http, Secret already renewed: restart the pods, kubectl -n &lt;ns&gt; rollout restart deploy/&lt;name&gt;, or run a reloader that restarts them when the Secret changes.
  • Not renewed: fix the cert-manager Certificate or issuer (its events say why), then restart for http.
  • grpc, renewed but not loaded: fix what grpc_tls_reload_failed names (a key that does not match, a CA file without certificates); a handshake within 30 seconds loads it.
  • grpc, renewed and no client since: the metric updates at the next connection.

Escalation

Escalate to the identity platform owner if it is not renewed within two days, and to the cert-manager owner if issuance fails. See Certificates.

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.