Kubernetes cert-manager ACME Order Failure and Ingress TLS Sentinel

id: kubernetes-tls-cert-manager-order-failure-sentinel
namespace: company.sre

inputs:
  - id: kube_context
    type: STRING
    required: false
    description: Optional Kubernetes context name.
  - id: failure_threshold
    type: INT
    defaults: 0
    description: Maximum acceptable count of failed cert-manager ACME orders or
      non-ready certificates.

tasks:
  - id: audit_cert_manager_status
    type: io.kestra.plugin.scripts.shell.Commands
    containerImage: bitnami/kubectl:latest
    commands:
      - |
        CONTEXT_ARG=""
        if [ -n "{{ inputs.kube_context }}" ]; then
          CONTEXT_ARG="--context={{ inputs.kube_context }}"
        fi

        kubectl $CONTEXT_ARG get certificates.cert-manager.io -A -o json > /tmp/certs.json 2>/dev/null || echo '{"items":[]}' > /tmp/certs.json
        kubectl $CONTEXT_ARG get orders.acme.cert-manager.io -A -o json > /tmp/orders.json 2>/dev/null || echo '{"items":[]}' > /tmp/orders.json

        FAILED_ORDERS=$(jq '[.items[] | select(.status.state == "errored" or .status.state == "invalid")] | length' /tmp/orders.json)
        UNREADY_CERTS=$(jq '[.items[] | select(.status.conditions[]? | select(.type == "Ready" and .status != "True"))] | length' /tmp/certs.json)
        TOTAL_FAILURES=$((FAILED_ORDERS + UNREADY_CERTS))

        DETAILS=$(jq -n --slurpfile certs /tmp/certs.json --slurpfile orders /tmp/orders.json           '{failed_orders: [$orders[0].items[] | select(.status.state == "errored" or .status.state == "invalid") | {namespace: .metadata.namespace, name: .metadata.name, reason: .status.reason}], unready_certificates: [$certs[0].items[] | select(.status.conditions[]? | select(.type == "Ready" and .status != "True")) | {namespace: .metadata.namespace, name: .metadata.name}]}')

        echo "::set-output name=total_failures::$TOTAL_FAILURES::"
        echo "::set-output name=failure_details::$DETAILS::"

  - id: evaluate_cert_health
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.audit_cert_manager_status.vars.total_failures | int >
      inputs.failure_threshold }}"
    then:
      - id: notify_security_ops
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#sec-ops-alerts",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 cert-manager ACME Certificate Issuance Failure Alert",
                "text": "Detected *{{ outputs.audit_cert_manager_status.vars.total_failures }}* failed ACME order(s) or non-ready certificate(s). Failure details: {{ outputs.audit_cert_manager_status.vars.failure_details }}. Impact: Ingress endpoints risk serving expired or self-signed TLS certificates to public clients.",
                "footer": "Kestra SRE Orchestrator • cert-manager Sentinel"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#sec-ops-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ cert-manager Sentinel Execution Error",
            "text": "The cert-manager certificate audit workflow encountered an execution failure. Please verify CRD accessibility and cluster credentials.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/30 * * * *"
    disabled: true