Skip to content
Spacelift Flows

Certificate Expiry Monitoring

← Back to gallery

Certificate Expiry Monitoring

ReliabilityJiraKubernetesSlack

This Flow keeps TLS certificates from expiring silently. Every day it walks the cluster's namespaces, reads every kubernetes.io/tls secret, and extracts each certificate's expiry directly from the certificate data — no cert-manager or external inventory required. A certificate entering the 30-day window gets a Jira renewal ticket and a Slack warning; inside the final 7 days it escalates to a critical alert with a new ticket. Each certificate is alerted once per severity, so the daily scan stays quiet until something changes. When a scan finds that an alerted certificate was renewed, the Flow closes the Jira ticket automatically and confirms in Slack, completing the lifecycle without manual bookkeeping. Scan failures are reported to the same channel.

After importing, connect the Flow to your systems: configure the Kubernetes app installation with your API server URL and a token, set the Jira project key on the renewal ticket block, and create a SLACK_CHANNEL_ID secret with the channel to alert. The warning and critical thresholds live in the Classify Certificates expression, and the scan schedule on the Daily Cert Scan block.