---
title: "Operator metrics"
description: "Monitor the Calico Cloud operator on connected clusters with Prometheus metrics for component health and TLS certificate expiry."
product: "Calico Cloud"
version: "v24.0.0"
section: "Operations"
canonical_url: "https://docs.tigera.io/calico-cloud/operations/monitor/metrics/operator-metrics"
---

# Operator metrics

## Big picture

Use Prometheus to monitor the Calico Cloud operator.

## Value

The Calico Cloud operator exposes Prometheus metrics that give you visibility into the overall health of your Calico Cloud installation. These metrics let you set up alerts for degraded components and expiring TLS certificates before they impact operations.

## Before you begin

Operator metrics are enabled by default. The `tigera-operator` deployment ships with the following environment variables already set:

- `METRICS_ENABLED=true`
- `METRICS_SCHEME=https`

Metrics are served on port **9484** over HTTPS and scraped by the built-in Prometheus instance via the `tigera-operator-metrics` ServiceMonitor.

## Metrics reference

### Component status

The `tigera_operator_component_status` metric reports the status of each Calico Cloud component as managed by the operator. This mirrors the information available through `kubectl get tigerastatus`.

| Metric                             | Labels                   | Description                                                |
| ---------------------------------- | ------------------------ | ---------------------------------------------------------- |
| `tigera_operator_component_status` | `component`, `condition` | Status of a component. Value is `1` (true) or `0` (false). |

**Labels:**

- `component` — The Calico Cloud component (e.g. `calico`, `apiserver`, `monitor`, `log-collector`)

- `condition` — One of:

  - `available` — The component is running and healthy
  - `degraded` — The component is in an error state
  - `progressing` — The component is being updated or is starting up

**Example queries:**

- Find all degraded components:

  ```text
  tigera_operator_component_status{condition="degraded"} == 1
  ```

- Check if a specific component is available:

  ```text
  tigera_operator_component_status{component="calico", condition="available"}
  ```

### TLS certificate expiry

The `tigera_operator_tls_certificate_expiry_timestamp_seconds` metric reports the expiry time of each TLS certificate managed by the operator.

| Metric                                                     | Labels                        | Description                                  |
| ---------------------------------------------------------- | ----------------------------- | -------------------------------------------- |
| `tigera_operator_tls_certificate_expiry_timestamp_seconds` | `name`, `namespace`, `issuer` | Unix timestamp when the certificate expires. |

**Labels:**

- `name` — The Secret name containing the certificate
- `namespace` — The namespace of the Secret
- `issuer` — The certificate issuer (e.g. `tigera-operator-signer`)

**Example queries:**

- Certificates expiring within 30 days:

  ```text
  tigera_operator_tls_certificate_expiry_timestamp_seconds - time() < 30 * 24 * 3600
  ```

- Certificates expiring within 7 days:

  ```text
  tigera_operator_tls_certificate_expiry_timestamp_seconds - time() < 7 * 24 * 3600
  ```

## Built-in alerts

Calico Cloud installs a PrometheusRule resource named `calico` with alerting rules that use these metrics. You can view it with:

```bash
kubectl -n tigera-prometheus get prometheusrule calico -o yaml
```

The built-in rules include:

| Alert                          | Condition                        | Severity |
| ------------------------------ | -------------------------------- | -------- |
| `DeniedPacketsRate`            | Denied packets rate > 50/s       | info     |
| `TLSCertExpiringWarning`       | Certificate expires in < 30 days | warning  |
| `TLSCertExpiringCritical`      | Certificate expires in < 7 days  | critical |
| `ComponentDegradedWarning`     | Component degraded for > 15m     | warning  |
| `ComponentDegradedCritical`    | Component degraded for > 30m     | critical |
| `ComponentProgressingWarning`  | Component progressing for > 15m  | warning  |
| `ComponentProgressingCritical` | Component progressing for > 30m  | critical |

The rule also includes two license expiry alerts, `LicenseExpiringWarning` and `LicenseExpiringCritical`. Tigera manages licensing for Calico Cloud, so you don't need to act on them.

To route these alerts, see [Configure Alertmanager](https://docs.tigera.io/calico-cloud/operations/monitor/prometheus/alertmanager.md).

## Additional resources

- [Configure Prometheus](https://docs.tigera.io/calico-cloud/operations/monitor/prometheus/configure-prometheus.md)
- [BYO Prometheus](https://docs.tigera.io/calico-cloud/operations/monitor/prometheus/byo-prometheus.md)