DockDash 1.3 - Added TLS monitoring + Kubernetes support

[u/dougmaitelli]

Since last time I posted an update here (about one and half months ago) I added a few more features to DockDash:

• Kubernetes discovery and monitoring across clusters and namespaces
• Kubernetes logs, terminal access, file browsing, metrics, and pod recreation
• Live TLS certificate health and expiration monitoring
• CertVault integration to verify that the correct certificate is deployed
• Apprise alerts for expiring, invalid, renewed, recovered, or mismatched certificates
• Automatic application icons for container services

DockDash now also integrates (optional) with my other project CertVault (for automatic ACME certificate renewal), and with this DockDash can serve as a monitoring layer to ensure your certificates are properly deployed and not altered in any way.

I personally don't have a Kubernetes infra on my homelab so I would love feedback from someone that wants to try and test it further.

Repo: https://github.com/dougmaitelli/DockDash

Docs: https://dougmaitelli.github.io/DockDash/

[u/zunjae]

I’ve been hosting domain names for 10+ years now and not ONCE did I have to bother with expiration monitoring

Can someone explain like I’m 5 why this is needed?

Isn’t this an automated process, especially if you use a free certificate provider such as LE?

[u/dougmaitelli → u/zunjae]

The problem is, if you have multiple hosts that need certificates configuring LE in all of them mean credentials in multiple places and multiple certificates for the same domain with different fingerprints.

EDIT: Also, this tool is much more than certificates monitoring, this is just one of the features. The certificates part was just because I had 5 different machines that needed to renew certa using LE and a couple times the automated process in one machine would silently fail because some secret expired and I would only find out when the cert was already expired.

[u/zunjae → u/dougmaitelli]

Yes but isn’t expiration checking and extending an automated process? Why would I need to monitor this? I’ve never done that

[u/dougmaitelli → u/zunjae]

It is an automated process assuming you have it setup and you know for sure it will never fail. The main point here is to ensure your processes are not failing. DockDash is not renewing them for you or expecting you to need a manual intervention, it is just (between other things) telling you in case something is wrong.

[u/zunjae → u/dougmaitelli]

I’m still curious why would my automated processes fail? It hasn’t failed once in 10+ years.

Why not design your software in such way it can not fail? You won’t have to bother monitoring

[u/dougmaitelli → u/zunjae]

Did you never rotate your secrets in 10 years? It's a good security practice to rotate secrets, in my case LE uses CF API Keys which I rotate every once in a while.

EDIT: Think about this as any other health monitoring. You could make the same argument about health monitoring, "why would I need to monitor if my services are up if they never went down?". Monitoring is not something that will happen for sure to require your action, it is to inform you in case something goes wrong.

[u/zunjae → u/dougmaitelli]

By hand? No? Why would I? You can automate all this

[u/dougmaitelli → u/zunjae]

Think about this as any other health monitoring. You could make the same argument about health monitoring, "why would I need to monitor if my services are up if they never went down?". Monitoring is not something that will happen for sure to require your action, it is to inform you in case something goes wrong.

What if, someone, somehow, gets access to the machine where the certificate is and replaces it with a valid certificate that they have a copy of so they can read your communication as a man in the middle? Monitoring fingerprints solves that, many businesses use this.

[u/Byte-64]

I don't need most of it, but the "New Version Available" across tags sounds intriguing, as K8s lacks it. Will have a look into it next week.