Kubernetes cert-manager Certificate Renewal Failure and Expiration Sentinel

id: cert-manager-certificate-not-ready-renewal-sentinel
namespace: company.security

inputs:
  - id: cert_manager_metrics_url
    type: STRING
    defaults: "http://cert-manager.cert-manager:9402/metrics"
    description: Prometheus scrape endpoint for cert-manager controller.

tasks:
  - id: query_cert_ready_status
    type: io.kestra.plugin.scripts.shell.Commands
    commands:
      - |
        curl -s -f "{{ inputs.cert_manager_metrics_url }}" > /tmp/cert_telemetry.txt

        # Scrape certmanager_certificate_ready_status metric where condition="False"
        NOT_READY=$(grep -E 'certmanager_certificate_ready_status\{.*condition="False".*\}' /tmp/cert_telemetry.txt | awk '{sum+=$2} END {print sum+0}')
        echo "::set-output name=not_ready_count::$NOT_READY::"

  - id: evaluate_cert_failures
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.query_cert_ready_status.vars.not_ready_count | int > 0 }}"
    then:
      - id: notify_security_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#security-ops",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 cert-manager TLS Certificate Failure Alert",
                "text": "cert-manager controller detected *{{ outputs.query_cert_ready_status.vars.not_ready_count }} certificate(s) in NOT READY state*! ACME HTTP-01/DNS-01 challenges or Vault issuer requests are failing, risking imminent HTTPS certificate expiration.",
                "footer": "Kestra Security Sentinel • cert-manager"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#security-ops",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ cert-manager Sentinel Failure",
            "text": "Failed to scrape cert-manager metrics endpoint. Verify cert-manager controller health.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "0 * * * *"
    disabled: true