Identity Cert Expiration prometheus metric only goes up

[tylux]

What is the issue?

the identity_cert_expiration_timestamp_seconds only seems to go up instead of returning a static epoch time, that is if graphed over time it seems to increase to match current time once per day.

Per the docs https://linkerd.io/2.11/reference/proxy-metrics/#identity-metrics here it should be

"A gauge of the time when the proxy’s current mTLS identity certificate will expire (in seconds since the UNIX epoch)."

Because of this I am unsure how to create an alert to monitor when certs expire.

How can it be reproduced?

Open up grafana/prometheus query explorer and look at this metric over a multi-day window

Logs, error output, etc

No logs

output of linkerd check -o short

N/A

Environment

Linkerd Prometheus metrics

Possible solution

No response

Additional context

Perhaps this is fixed in 2.12?

Would you like to work on fixing this bug?

None

[alpeb]

The proxy's identity cert is renewed every 24 hours, so you'll see that metric change once per day. Your alert rule could trigger whenever identity_cert_expiration_timestamp_seconds is lower then the current timestamp (time()).