vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

export bao client-cert not_before/not_after gauges and alert past 80% of lifetime

Browse source
This commit is contained in:
atlas 2026-10-25 17:41:47 +01:00 • committed by mara
commit 078696aaee
23 changed files with 604 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

18
nix/host-modules/swarm-grafana.nix
View file

@ -1715,6 +1715,24 @@ in
for = "2m";
summary = "the nix store's filesystem on hive {{ $labels.hive }} is over 95% full; garbage-collect now";
})
# The fraction of a store client certificate's validity
# already used, from the `bao.client_cert.*` gauges the
# services export (`swarm-cert-metrics`). Both gauges of a
# series carry identical labels, so the division matches
# one-to-one on all of them without `on()`/`group_left`.
# `last_over_time` rides out the five-minute cadence of
# the one-shot reporter (`swarm-ci-metrics`). Agent leaves
# renew at half their life, so a fraction over 0.8 means
# the renewal has been stuck for days. `hive` and `agent`
# stay in the grouping so the alert names the holder.
(metricThresholdRule {
uid = "hh-bao-client-cert-lifetime";
title = "bao client certificate past 80% of its lifetime";
expr = ''max by ("service.name", cert, hive, agent) ((time() - last_over_time({__name__="bao.client_cert.not_before"}[15m])) / (last_over_time({__name__="bao.client_cert.not_after"}[15m]) - last_over_time({__name__="bao.client_cert.not_before"}[15m])))'';
threshold = 0.8;
for = "10m";
summary = "the store client certificate {{ $labels.cert }} (hive {{ $labels.hive }}, agent {{ $labels.agent }}) is past 80% of its validity";
})
]
# One rule per declared hive rather than one grouped by
# `hive`, so a hive that sends nothing at all still has