Design Partner programme: the first 100 teams get SreNix free. 100 places left.

See the offer and apply →
AI SRE for KubernetesSource-availableBring-your-own-LLMPatent Pending
Book a call
Examples / Ingress TLS mismatch
Fix example · Community · auto-fixed

An Ingress serving the wrong certificate, repointed automatically

A certificate rotated to a new Secret name, but the Ingress that fronts the service was never updated. Traffic kept using the old certificate until it expired.

What happened

Follow the record on the right, one step at a time.

  1. Detect: the certificate serving traffic on the Ingress did not match the current, healthy certificate for that host.
  2. Cause: a recent rotation issued a new certificate under a new Secret name, but the Ingress spec.tls still named the old one.
  3. Policy: repointing an Ingress to the correct, already-issued TLS Secret is on the default closed list, scoped to Ingresses in namespaces the operator manages.
  4. Fix: the Ingress was patched to reference the current Secret. No new certificate was issued — the correct one already existed.
  5. Verify: the same check ran again and confirmed the Ingress now serves the current, matching certificate.
fix record · checkout.example.comVERIFIED
14:02:10DETECTIngress/checkout serves tls-secret/checkout-2025 · current cert is checkout-2026
14:02:16CAUSEIngress not updated after cert-manager rotated to a new Secret name
14:02:22POLICYrepoint-ingress-tls-secret · namespace checkout · auto-approved
14:02:29FIXpatched Ingress/checkout tls.secretName → checkout-2026
14:03:41VERIFYserved certificate matches checkout-2026 · SAN covers checkout.example.com
signed by workload identity · srenix-fixer@prod-eu-1

The rule that allowed it

This fixer only ever points an Ingress at a Secret that cert-manager has already issued and marked healthy. It never creates or edits certificate material itself.

# fixers/k8s-limit-raise.policy.yaml
scope:
  namespaces: [payments, checkout]
  resources: [deployment]
bounds:
  memory_multiplier_max: 2.0
  requires_verification: true
  rollback_on_regression: true
approval:
  in_envelope: auto
  out_of_envelope: signed_url
  signer_roles: [sre-oncall]
identity: oidc://srenix-fixer

See another certificate example

A stuck certificate request, cleared so cert-manager could issue a fresh one.

See a deeper certificate check

A certificate that renews on schedule but is still weak underneath.

On-call should be quieter every week

Helm install in 5 minutes. No telemetry exfiltration. No per-investigation surprises.

Talk to usView pricing