Only a few cert-manager metrics are available

[jzeng4]

Describe the bug:

Deploy cert-manager-v1.11.4.

ssh into the cert-manager pod and check the metrics.

kubctl exec -it li-cert-manager-k8s-0-745dc8bc96-9w6nh -n li-cert-manager -- bash
bash-4.2$ curl localhost:9402/metrics

# HELP certmanager_clock_time_seconds DEPRECATED: use clock_time_seconds_gauge instead. The clock time given in seconds (from 1970/01/01 UTC).
# TYPE certmanager_clock_time_seconds counter
certmanager_clock_time_seconds 1.7110418e+09
# HELP certmanager_clock_time_seconds_gauge The clock time given in seconds (from 1970/01/01 UTC).
# TYPE certmanager_clock_time_seconds_gauge gauge
certmanager_clock_time_seconds_gauge 1.7110418e+09
# HELP certmanager_controller_sync_call_count The number of sync() calls made by a controller.
# TYPE certmanager_controller_sync_call_count counter
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-acme"} 25417
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-ca"} 25151
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-selfsigned"} 25344
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-vault"} 25293
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-venafi"} 25273
certmanager_controller_sync_call_count{controller="clusterissuers"} 2

It misses multiple metrics.

Expected behaviour:

It should include the metrics listed here.

Steps to reproduce the bug:

Anything else we need to know?:

Environment details::

• Kubernetes version:
  Client Version: v1.29.1
  Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
  Server Version: v1.23.17
• Cloud-provider/provisioner:
• cert-manager version:
  v.1.11.4
• Install method: e.g. helm/static manifests
  static manifests

/kind bug

[maelvls]

Hey, I've also noticed that the metrics only show when there is at least one Certificate resource in the cluster. Without any certificates, it shows this:

$ kubectl get --raw /api/v1/namespaces/cert-manager/services/cert-manager:9402/proxy/metrics
# HELP certmanager_clock_time_seconds DEPRECATED: use clock_time_seconds_gauge instead. The clock time given in seconds (from 1970/01/01 UTC).
# TYPE certmanager_clock_time_seconds counter
certmanager_clock_time_seconds 1.7114653e+09
# HELP certmanager_clock_time_seconds_gauge The clock time given in seconds (from 1970/01/01 UTC).
# TYPE certmanager_clock_time_seconds_gauge gauge
certmanager_clock_time_seconds_gauge 1.7114653e+09
# HELP certmanager_controller_sync_call_count The number of sync() calls made by a controller.
# TYPE certmanager_controller_sync_call_count counter
certmanager_controller_sync_call_count{controller="certificaterequests-approver"} 4
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-acme"} 4
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-ca"} 4
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-selfsigned"} 4
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-vault"} 4
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-venafi"} 4
certmanager_controller_sync_call_count{controller="certificates-issuing"} 4
certmanager_controller_sync_call_count{controller="certificates-key-manager"} 4
certmanager_controller_sync_call_count{controller="certificates-metrics"} 4
certmanager_controller_sync_call_count{controller="certificates-readiness"} 4
certmanager_controller_sync_call_count{controller="certificates-request-manager"} 4
certmanager_controller_sync_call_count{controller="certificates-revision-manager"} 4
certmanager_controller_sync_call_count{controller="certificates-trigger"} 4
certmanager_controller_sync_call_count{controller="clusterissuers"} 2
certmanager_controller_sync_call_count{controller="issuers"} 3

Then, I add one certificate:

kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: test
spec:
  secretName: test
  issuerRef:
    name: test
    kind: Issuer
  dnsNames:
  - test
EOF

The metrics are now showing:

$ k get --raw /api/v1/namespaces/cert-manager/services/cert-manager:9402/proxy/metrics
# HELP certmanager_certificate_expiration_timestamp_seconds The date after which the certificate expires. Expressed as a Unix Epoch Time.
# TYPE certmanager_certificate_expiration_timestamp_seconds gauge
certmanager_certificate_expiration_timestamp_seconds{issuer_group="",issuer_kind="Issuer",issuer_name="test",name="test",namespace="default"} 0
# HELP certmanager_certificate_ready_status The ready status of the certificate.
# TYPE certmanager_certificate_ready_status gauge
certmanager_certificate_ready_status{condition="False",issuer_group="",issuer_kind="Issuer",issuer_name="test",name="test",namespace="default"} 1
certmanager_certificate_ready_status{condition="True",issuer_group="",issuer_kind="Issuer",issuer_name="test",name="test",namespace="default"} 0
certmanager_certificate_ready_status{condition="Unknown",issuer_group="",issuer_kind="Issuer",issuer_name="test",name="test",namespace="default"} 0
# HELP certmanager_certificate_renewal_timestamp_seconds The number of seconds before expiration time the certificate should renew.
# TYPE certmanager_certificate_renewal_timestamp_seconds gauge
certmanager_certificate_renewal_timestamp_seconds{issuer_group="",issuer_kind="Issuer",issuer_name="test",name="test",namespace="default"} 0
# HELP certmanager_clock_time_seconds DEPRECATED: use clock_time_seconds_gauge instead. The clock time given in seconds (from 1970/01/01 UTC).
# TYPE certmanager_clock_time_seconds counter
certmanager_clock_time_seconds 1.711465478e+09
# HELP certmanager_clock_time_seconds_gauge The clock time given in seconds (from 1970/01/01 UTC).
# TYPE certmanager_clock_time_seconds_gauge gauge
certmanager_clock_time_seconds_gauge 1.711465478e+09
# HELP certmanager_controller_sync_call_count The number of sync() calls made by a controller.
# TYPE certmanager_controller_sync_call_count counter
certmanager_controller_sync_call_count{controller="certificaterequests-approver"} 7
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-acme"} 7
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-ca"} 7
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-selfsigned"} 7
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-vault"} 7
certmanager_controller_sync_call_count{controller="certificaterequests-issuer-venafi"} 7
certmanager_controller_sync_call_count{controller="certificates-issuing"} 11
certmanager_controller_sync_call_count{controller="certificates-key-manager"} 9
certmanager_controller_sync_call_count{controller="certificates-metrics"} 8
certmanager_controller_sync_call_count{controller="certificates-readiness"} 12
certmanager_controller_sync_call_count{controller="certificates-request-manager"} 12
certmanager_controller_sync_call_count{controller="certificates-revision-manager"} 11
certmanager_controller_sync_call_count{controller="certificates-trigger"} 11
certmanager_controller_sync_call_count{controller="clusterissuers"} 2
certmanager_controller_sync_call_count{controller="issuers"} 3