🧭 Kubernetes TLS certificate expiry alerts
TLS certificates stored in Secrets expire. When one does, clients refuse the connection and everything that uses it fails, often with no change on your side.
🔎 Check it by hand
- Read the expiry date. This decodes the certificate in the Secret and prints its expiry date.
kubectl get secret <name> -n <namespace> -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -enddate
🎯 What kwatch sends
The message reads like this.
Example message
🟠 Secret bank-client-tls in shop (prod-eu-1) has a TLS certificate that expired one hour ago. All of its dependents are failing. Its last run lasted 10s. Clients are rejecting it now. payments is affected as well. To list the keys of the Secret the pods depend on, run kubectl describe secret bank-client-tls -n shop
⭐ Which edition
Pro only: certificate detection is not in Community. Pro is free during early access; see Community vs Pro.
🚀 Install kwatch
One command, and it walks you through it.
/bin/bash -c "$(curl -fsSL https://kwatch.dev/kwatch.sh)"
Community is free forever; Pro is free during early access. See Installation and Community vs Pro.