enix/x509-certificate-exporter repository overview

---

A Prometheus exporter for X.509 certificates, built for Kubernetes first. It watches your cluster's TLS material as native Kubernetes resources — Secrets, ConfigMaps, kubeconfigs, on-disk PKI on the nodes — and turns expirations into actionable Prometheus series. Designed to run inside the cluster it observes, but equally happy as a standalone binary.

---

⁠🔍️ What it watches

• TLS Secrets of any type — kubernetes.io/tls, opaque PEM bundles, full chains — across all namespaces or a curated subset.
• ConfigMaps holding PEM material (ca.crt, custom keys).
• PKCS#12 keystores and truststores, with passphrase pulled from a sibling key in the same Secret, an external file, a cross-namespace Secret reference, or none (tryEmptyPassphrase).
• Kubeconfigs with embedded base64 certificates or PEM file references — every cluster and user block exposed as its own series.
• Files on disk — glob patterns (*, **, ?), atomic symlink swaps detected on the next poll (certbot renewals, kubelet projected ..data/ mounts), and dual deployment: inside the exporter pod or as a node-local DaemonSet for cluster PKI (kubelet, etcd, kube-apiserver).
• PEM chains — every certificate in a multi-cert bundle becomes its own series, so intermediate CAs and trust roots appear alongside leaf certs with no extra configuration.

---

⁠📖 Documentation