apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: cert-manager
  namespace: prometheus
  labels:
    release: prometheus-stack
spec:
  groups:
    - name: cert-manager
      rules:
        - alert: CertManagerCertNotReady
          expr: certmanager_certificate_ready_status{condition="False"} == 1
          for: 10m
          labels:
            severity: critical
          annotations:
            summary: "Certificate {{ $labels.exported_namespace }}/{{ $labels.name }} is not ready"
            description: "Certificate has been failing for more than 10 minutes. Check Challenges/Orders in that namespace."
        - alert: CertManagerCertExpirySoon
          expr: certmanager_certificate_expiration_timestamp_seconds - time() < 86400 * 14
          for: 1h
          labels:
            severity: warning
          annotations:
            summary: "Certificate {{ $labels.exported_namespace }}/{{ $labels.name }} expires in less than 14 days"
            description: "Renewal should have happened automatically. Check cert-manager logs if it persists."
        - alert: CertManagerCertExpiryCritical
          expr: certmanager_certificate_expiration_timestamp_seconds - time() < 86400 * 7
          for: 1h
          labels:
            severity: critical
          annotations:
            summary: "Certificate {{ $labels.exported_namespace }}/{{ $labels.name }} expires in less than 7 days"
            description: "Manual intervention likely needed: cmctl status certificate {{ $labels.name }} -n {{ $labels.exported_namespace }}."
        - alert: CertManagerHittingRateLimits
          expr: sum by (exported_namespace) (rate(certmanager_http_acme_client_request_count{status=~"429.*"}[10m])) > 0
          for: 15m
          labels:
            severity: warning
          annotations:
            summary: "cert-manager is hitting ACME rate limits"
            description: "Back off manual issuance retries and check failed Orders/Challenges."