Bug 2351287

Summary:	[RFE] Cephadm. Introducing Certmgr[TP]. MVP. Check for Certificate expiration and warn in Ceph status
Product:	[Red Hat Storage] Red Hat Ceph Storage	Reporter:	daniel parkes <dparkes>
Component:	Cephadm	Assignee:	Adam King <adking>
Status:	VERIFIED ---	QA Contact:	Sayalee <saraut>
Severity:	medium	Docs Contact:	Rivka Pollack <rpollack>
Priority:	unspecified
Version:	8.1	CC:	adking, cephqe-warriors, rkachach, rpollack, tserlin
Target Milestone:	---	Keywords:	FutureFeature
Target Release:	8.1	Flags:	adking: needinfo? (rkachach)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ceph-19.2.1-43	Doc Type:	Technology Preview
Doc Text:	.New Cephadm certificate lifecycle management for improved Ceph cluster security With this enhancement, Cephadm now has certificate lifecycle management in the certmgr subsystem. This feature provides a unified mechanism to provision, rotate, and apply TLS certificates for Ceph services, supporting both user-provided and automatically generated cephadm-signed certificates. As part of this feature, certmgr periodically checks the status of all certificates managed by Cephadm and issues health warnings for any that are nearing expiration, misconfigured, or invalid. This improves Ceph cluster security and simplifies certificate management through automation and proactive alerts.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2351689

Description daniel parkes 2025-03-11 06:56:03 UTC

Tech Preview: Introducing Certmgr. MVP. Check for Certificate expiration and warn in Ceph status

Problem
Currently, Cephadm does not have a mechanism to proactively warn users about expiring certificates for ingress services or RGW. This lack of visibility can lead to unexpected downtime or degraded service if certificates expire without renewal. A similar check is already available in Grafana; we must extend this functionality to Ingress and RGW services.

Goal
Introduce a certificate expiration check within Cephadm that monitors certificates used by ingress services and RGW. If a certificate is approaching its expiration date, Ceph status will display a warning. This feature will ensure that users are proactively informed about certificate expiration through the primary health status interface they use to manage their clusters.