Operator metrics

Big picture

Use Prometheus to monitor the Calico Cloud operator.

Value

The Calico Cloud operator exposes Prometheus metrics that give you visibility into the overall health of your Calico Cloud installation. These metrics let you set up alerts for degraded components and expiring TLS certificates before they impact operations.

Before you begin

Operator metrics are enabled by default. The tigera-operator deployment ships with the following environment variables already set:

• METRICS_ENABLED=true
• METRICS_SCHEME=https

Metrics are served on port 9484 over HTTPS and scraped by the built-in Prometheus instance via the tigera-operator-metrics ServiceMonitor.

Metrics reference

Component status

The tigera_operator_component_status metric reports the status of each Calico Cloud component as managed by the operator. This mirrors the information available through kubectl get tigerastatus.

Metric	Labels	Description
tigera_operator_component_status	component, condition	Status of a component. Value is 1 (true) or 0 (false).

Labels:

• component — The Calico Cloud component (e.g. calico, apiserver, monitor, log-collector)
• condition — One of:
  • available — The component is running and healthy
  • degraded — The component is in an error state
  • progressing — The component is being updated or is starting up

Example queries:

• Find all degraded components:

  tigera_operator_component_status{condition="degraded"} == 1

• Check if a specific component is available:

  tigera_operator_component_status{component="calico", condition="available"}

TLS certificate expiry

The tigera_operator_tls_certificate_expiry_timestamp_seconds metric reports the expiry time of each TLS certificate managed by the operator.

Metric	Labels	Description
tigera_operator_tls_certificate_expiry_timestamp_seconds	name, namespace, issuer	Unix timestamp when the certificate expires.

Labels:

• name — The Secret name containing the certificate
• namespace — The namespace of the Secret
• issuer — The certificate issuer (e.g. tigera-operator-signer)

Example queries:

• Certificates expiring within 30 days:

  tigera_operator_tls_certificate_expiry_timestamp_seconds - time() < 30 * 24 * 3600

• Certificates expiring within 7 days:

  tigera_operator_tls_certificate_expiry_timestamp_seconds - time() < 7 * 24 * 3600

Built-in alerts

Calico Cloud installs a PrometheusRule resource named calico with alerting rules that use these metrics. You can view it with:

kubectl -n tigera-prometheus get prometheusrule calico -o yaml

The built-in rules include:

Alert	Condition	Severity
DeniedPacketsRate	Denied packets rate > 50/s	info
TLSCertExpiringWarning	Certificate expires in < 30 days	warning
TLSCertExpiringCritical	Certificate expires in < 7 days	critical
ComponentDegradedWarning	Component degraded for > 15m	warning
ComponentDegradedCritical	Component degraded for > 30m	critical
ComponentProgressingWarning	Component progressing for > 15m	warning
ComponentProgressingCritical	Component progressing for > 30m	critical

The rule also includes two license expiry alerts, LicenseExpiringWarning and LicenseExpiringCritical. Tigera manages licensing for Calico Cloud, so you don't need to act on them.

To route these alerts, see Configure Alertmanager.

Additional resources

• Configure Prometheus
• BYO Prometheus