OCPBUGS-85777: Add root CA expiration monitoring for cert-manager

telco-hub/configuration/reference-crs-kube-compare/compare_ignore

@@ -33,6 +33,10 @@ required/gitops/addPluginsPolicy.yaml
 # not include the full policy content due to policy templating.
 required/acm/observabilityRoutePolicy.yaml
 
+# cert-manager config CRs (user-specific, and policies with hub-side templating)
+optional/cert-manager/certManagerRootCAExpirationPolicy.yaml
+optional/cert-manager/kustomization.yaml
+
 required/gitops/extra-manifests-policy.yaml
 # ArgoCD files
 kustomization.yaml

telco-hub/configuration/reference-crs-kube-compare/default_value.yaml

@@ -479,6 +479,7 @@ optional_cert_manager_certManagerCertificatePolicy:
       include:
         - openshift-ingress
         - openshift-config
+        - cert-manager
 
 optional_cert_manager_certManagerSubscription:
 - spec:

telco-hub/configuration/reference-crs-kube-compare/metadata.yaml

@@ -38,6 +38,17 @@ parts:
           - path: optional/cert-manager/certManagerCertificatePolicy.yaml
           - path: optional/cert-manager/certManagerCertificatePolicyPlacement.yaml
           - path: optional/cert-manager/certManagerCertificatePolicyPlacementBinding.yaml
+      - name: cert-manager-root-ca-monitoring
+        description: |-
+          Root CA expiration monitoring via PrometheusRule
+        allOrNoneOf:
+          - path: optional/cert-manager/certManagerRootCAExpirationPolicy.yaml
+            config:
+              ignore-unspecified-fields: true
+              fieldsToOmitRefs:
+                - templates
+          - path: optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml
+          - path: optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml
   - name: optional-storage
     components:
       - name: local-storage-operator

telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerCertificatePolicy.yaml

@@ -19,7 +19,7 @@ spec:
         spec:
           minimumDuration: {{ .spec.minimumDuration | default "720h" }}
           namespaceSelector:
-            include:{{- template "unorderedListAllowExtra" (list .spec.namespaceSelector.include (list "openshift-ingress" "openshift-config") ) }}
+            include:{{- template "unorderedListAllowExtra" (list .spec.namespaceSelector.include (list "openshift-ingress" "openshift-config" "cert-manager") ) }}
           remediationAction: inform
           severity: low
   remediationAction: inform

telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  name: root-ca-expiration-monitor
+  namespace: default
+  annotations:
+    policy.open-cluster-management.io/categories: SC System and Communications Protection
+    policy.open-cluster-management.io/controls: SC-8 Transmission Confidentiality and Integrity
+    policy.open-cluster-management.io/standards: NIST 800-53
+spec:
+  disabled: false
+  remediationAction: enforce

telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: cluster.open-cluster-management.io/v1beta1
+kind: Placement
+metadata:
+  name: root-ca-expiration-placement
+  namespace: default
+  annotations:
+    argocd.argoproj.io/sync-wave: "-11"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  predicates:
+    - requiredClusterSelector:
+        labelSelector:
+          matchExpressions:
+            - key: local-cluster
+              operator: In
+              values:
+                - "true"

telco-hub/configuration/reference-crs-kube-compare/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: PlacementBinding
+metadata:
+  name: root-ca-expiration-placementbinding
+  namespace: default
+  annotations:
+    argocd.argoproj.io/sync-wave: "-11"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+placementRef:
+  name: root-ca-expiration-placement
+  apiGroup: cluster.open-cluster-management.io
+  kind: Placement
+subjects:
+  - name: root-ca-expiration-monitor
+    apiGroup: policy.open-cluster-management.io
+    kind: Policy

telco-hub/configuration/reference-crs/optional/cert-manager/certManagerCertificatePolicy.yaml

@@ -22,6 +22,7 @@ spec:
             include:
               - openshift-ingress
               - openshift-config
+              - cert-manager
           remediationAction: inform
           severity: low
   remediationAction: inform

telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicy.yaml

@@ -0,0 +1,59 @@
+---
+# ACM Policy to create a PrometheusRule that alerts on root CA
+# certificate expiration. Monitors the cert-manager certificate
+# expiration metric and fires warnings at 90 days and critical
+# alerts at 30 days before expiry.
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+  name: root-ca-expiration-monitor
+  namespace: default
+  annotations:
+    policy.open-cluster-management.io/categories: SC System and Communications Protection
+    policy.open-cluster-management.io/controls: SC-8 Transmission Confidentiality and Integrity
+    policy.open-cluster-management.io/standards: NIST 800-53
+    argocd.argoproj.io/sync-wave: "-10"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  disabled: false
+  policy-templates:
+    - objectDefinition:
+        apiVersion: policy.open-cluster-management.io/v1
+        kind: ConfigurationPolicy
+        metadata:
+          name: root-ca-expiration-prometheusrule
+        spec:
+          remediationAction: enforce
+          severity: high
+          object-templates:
+            - complianceType: musthave
+              objectDefinition:
+                apiVersion: monitoring.coreos.com/v1
+                kind: PrometheusRule
+                metadata:
+                  name: cert-manager-root-ca-expiration
+                  namespace: cert-manager-operator
+                spec:
+                  groups:
+                    - name: cert-manager-root-ca
+                      rules:
+                        - alert: CertManagerRootCAExpiringSoon
+                          annotations:
+                            summary: 'Root CA certificate {{`{{ $labels.name }}`}} is expiring soon'
+                            description: 'The root CA certificate {{`{{ $labels.name }}`}} in namespace {{`{{ $labels.namespace }}`}} expires in less than 90 days.'
+                          # Update name="root-ca" if your cert-manager Certificate resource uses a different name
+                          expr: |
+                            certmanager_certificate_expiration_timestamp_seconds{name="root-ca",namespace="cert-manager"} - time() < 90 * 24 * 3600
+                          for: 1h
+                          labels:
+                            severity: warning
+                        - alert: CertManagerRootCAExpirationCritical
+                          annotations:
+                            summary: 'Root CA certificate {{`{{ $labels.name }}`}} is about to expire'
+                            description: 'The root CA certificate {{`{{ $labels.name }}`}} in namespace {{`{{ $labels.namespace }}`}} expires in less than 30 days. Immediate action required.'
+                          expr: |
+                            certmanager_certificate_expiration_timestamp_seconds{name="root-ca",namespace="cert-manager"} - time() < 30 * 24 * 3600
+                          for: 1h
+                          labels:
+                            severity: critical
+  remediationAction: enforce

telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacement.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: cluster.open-cluster-management.io/v1beta1
+kind: Placement
+metadata:
+  name: root-ca-expiration-placement
+  namespace: default
+  annotations:
+    argocd.argoproj.io/sync-wave: "-11"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  predicates:
+    - requiredClusterSelector:
+        labelSelector:
+          matchExpressions:
+            - key: local-cluster
+              operator: In
+              values:
+                - "true"

telco-hub/configuration/reference-crs/optional/cert-manager/certManagerRootCAExpirationPolicyPlacementBinding.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: policy.open-cluster-management.io/v1
+kind: PlacementBinding
+metadata:
+  name: root-ca-expiration-placementbinding
+  namespace: default
+  annotations:
+    argocd.argoproj.io/sync-wave: "-11"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+placementRef:
+  name: root-ca-expiration-placement
+  apiGroup: cluster.open-cluster-management.io
+  kind: Placement
+subjects:
+  - name: root-ca-expiration-monitor
+    apiGroup: policy.open-cluster-management.io
+    kind: Policy

telco-hub/configuration/reference-crs/optional/cert-manager/kustomization.yaml

@@ -13,3 +13,6 @@ resources:
   - certManagerCertificatePolicy.yaml
   - certManagerCertificatePolicyPlacement.yaml
   - certManagerCertificatePolicyPlacementBinding.yaml
+  - certManagerRootCAExpirationPolicy.yaml
+  - certManagerRootCAExpirationPolicyPlacement.yaml
+  - certManagerRootCAExpirationPolicyPlacementBinding.yaml