Как упростить мониторинг сертификатов в Kubernetes с помощью SSL Exporter

apiVersion: v1
kind: ConfigMap
metadata:
  name: ssl-exporter-config
  namespace: my-namespace
data:
  exporter.yml: |-
    default_module: kubernetes
    modules:
      kubernetes:
        prober: kubernetes
        target: my-namespace/*

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ssl-exporter
  namespace: my-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ssl-exporter
  template:
    metadata:
      name: ssl-exporter
      labels:
        app: ssl-exporter
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9219"
        prometheus.io/path: "/probe"
        prometheus.io/scheme: "https"
    spec:
      serviceAccountName: my-serviceaccount
      initContainers:
        - name: ca
          image: alpine
          command:
            - sh
            - -c
            - |
              set -e
              apk add --update ca-certificates
              cp /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /usr/local/share/ca-certificates/kube-ca.crt
              update-ca-certificates
              cp /etc/ssl/certs/* /ssl-certs
          volumeMounts:
            - name: ssl-certs
              mountPath: /ssl-certs
      containers:
        - name: ssl-exporter
          image: ribbybibby/ssl-exporter:latest
          args:
            - --log.level=debug #enabled to check errors, you can leave this flag if not needed.
          ports:
            - name: tcp
              containerPort: 9219
          resources:
            limits:
              cpu: 100m
              memory: 100Mi
            requests:
              cpu: 50m
              memory: 50Mi
          volumeMounts:
            - name: ssl-certs
              mountPath: /etc/ssl/certs
            - name: ssl-exporter-config
              mountPath: /etc/ssl-exporter
          args: ["--config.file=/etc/ssl-exporter/exporter.yml"]
      volumes:
        - name: ssl-certs
          emptyDir: {}
        - name: ssl-exporter-config
          configMap:
            name: ssl-exporter-config

apiVersion: v1
kind: Service
metadata:
  labels:
    name: ssl-exporter
  name: ssl-exporter
  namespace: my-namespace
spec:
  ports:
    - name: ssl-exporter
      protocol: TCP
      port: 9219
      targetPort: 9219
  selector:
    app: ssl-exporter

((ssl_kubernetes_cert_not_after{job=~"$job", instance=~"$instance"} - time())/24/60/60)