Answers: <p>The alert is broken, it is fixed in further release version of the mixins, we need to apply on(job) infront of the histogram to fix it. Example: apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0 and on(job) histogram_quantile(0.01, sum by (job, le) (rate(apiserver_client_certificate_expiration_seconds_bucket{job="apiserver"}[5m]))) &lt;  60432131800 and yes, that means your certs are not being tracked...</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-08-21T13:12:45.580Z
Answers: What is the significance of 60432131800 ?
Answers: zaTricky
Answers: CC BY-SA 4.0
Answers: 2020-03-02T12:21:38.953Z
Answers: 2020-03-02T12:21:38.953Z
Answers: anVzdGFub3RoZXJodW1hbg
Body: <p>I had a situation yesterday where my K8S master api cert has expired and I had Prometheus-operator active in the past weeks, but neither the 24 hours, neither the 7 days alert has triggered. I went to the dashboard and made the original querry, I got nothing. I cut it out and mod it to apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 0, I got the result of all nodes, I checked the timers and moded it to apiserver_client_certificate_expiration_seconds_count{job="apiserver"} > 14000000 so I wanted one that is off to be cut and it was, that doesn't help me, but I think there is a problem with the alert, anyone else fought that?
  <a href="https://github.com/kubernetes-monitoring/kubernetes-mixin/tree/master/runbook.md#alert-name-kubeclientcertificateexpiration" rel="nofollow noreferrer">https://github.com/kubernetes-monitoring/kubernetes-mixin/tree/master/runbook.md#alert-name-kubeclientcertificateexpiration</a> 
  If this is supposed to monitor all endpoints that make a request to the api server for their certificates then this failed as I didn't get an alert for the expired certificate.</p>
  
Tags: <kubernetes><prometheus>
Title: Prometheus-operator - detection of expiring certs failing
UserDisplayName: anVzdGFub3RoZXJodW1hbg
ThreadText: # Prometheus-operator - detection of expiring certs failing
  
  (Asked by: username_0 on 2020-02-28)
  
  I had a situation yesterday where my K8S master api cert has expired and I had Prometheus-operator active in the past weeks, but neither the 24 hours, neither the 7 days alert has triggered. I went to the dashboard and made the original querry, I got nothing. I cut it out and mod it to apiserver\_client\_certificate\_expiration\_seconds\_count{job="apiserver"} > 0, I got the result of all nodes, I checked the timers and moded it to apiserver\_client\_certificate\_expiration\_seconds\_count{job="apiserver"} > 14000000 so I wanted one that is off to be cut and it was, that doesn't help me, but I think there is a problem with the alert, anyone else fought that?
  <https://github.com/kubernetes-monitoring/kubernetes-mixin/tree/master/runbook.md#alert-name-kubeclientcertificateexpiration>
  If this is supposed to monitor all endpoints that make a request to the api server for their certificates then this failed as I didn't get an alert for the expired certificate.
  
  **Tags:** kubernetes, prometheus
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2020-03-02. Score: 0 | Accepted answer
  
  The alert is broken, it is fixed in further release version of the mixins, we need to apply on(job) infront of the histogram to fix it. Example: apiserver\_client\_certificate\_expiration\_seconds\_count{job="apiserver"} > 0 and on(job) histogram\_quantile(0.01, sum by (job, le) (rate(apiserver\_client\_certificate\_expiration\_seconds\_bucket{job="apiserver"}[5m]))) < 60432131800 and yes, that means your certs are not being tracked...
  
  > **Comments:**
  > **username_1**: What is the significance of 60432131800 ?  
  
  ---
  
  