In watch mode the exporter does not remove deleted secrets

[fhitchen]

Very nice tool and dashboard. Thanks.

I don't know if this is expected behaviour, but 24 hours after running with --watch-kube-secrets, I could still see metrics for secrets that no longer existed.

Shouldn't the exporter remove them and no longer generate Prometheus metrics for them?

I wanted to add another label to indicate if the cert was a CA or not as my organization mixes them up which seems to work..

diff --git a/internal/exporter.go b/internal/exporter.go
index e67a29d..d3fb6a1 100644
--- a/internal/exporter.go
+++ b/internal/exporter.go
@@ -250,6 +250,10 @@ func (exporter *Exporter) getLabels(certData *parsedCertificate, ref *certificat
        fillLabelsFromName(&certData.cert.Issuer, "issuer", labels)
        fillLabelsFromName(&certData.cert.Subject, "subject", labels)
 
+       if certData.cert.BasicConstraintsValid && certData.cert.IsCA {
+               labels["is_CA"] = "true"
+       }
+
        if ref.format == certificateFormatYAML {
                kind := strings.Split(certData.yqMatchExpr, ".")[1]
                labels["embedded_kind"] = strings.TrimRight(kind, "s")

But on running a test against the test certs I saw that the bad link pem was getting parsed without error...

$ ./x509-certificate-exporter -d test/
INFO[0000] starting x509-certificate-exporter version 0.0.0 () () 
INFO[0000] 1 valid certificate(s) found in "test/badlink.pem" 
INFO[0000] 1 valid certificate(s) found in "test/basic.pem" 

and generating metrics...

x509_cert_expired{filename="badlink.pem",filepath="test/badlink.pem",is_CA="true",issuer_CN="kubernetes",serial_number="0",subject_CN="kubernetes"} 0
x509_cert_not_after{filename="badlink.pem",filepath="test/badlink.pem",is_CA="true",issuer_CN="kubernetes",serial_number="0",subject_CN="kubernetes"} 1.861190854e+09
x509_cert_not_before{filename="badlink.pem",filepath="test/badlink.pem",is_CA="true",issuer_CN="kubernetes",serial_number="0",subject_CN="kubernetes"} 1.545830854e+09

even though it truly does not exist...

$ ls -l test/badlink.pem 
lrwxrwxrwx 1 me me 15 Nov 21 15:44 test/badlink.pem -> /toto/basic.pem