Metrics for updated / patched certificates should be cleaned #7301
Description
Describe the bug:
We have a clusterIssuer named issuer-g2, but we have deployed ingress with annotation: "cert-manager.io/cluster-issuer: issuer-G2". In cert-manager prometheus metrics, it appeared as:
certmanager_certificate_ready_status{condition="False",issuer_group="cert-manager.io",issuer_kind="ClusterIssuer",issuer_name="issuer-G2",name="falco-ui-ingress-tls",namespace="falco"} 1
It was alerted, we have fixed the clusterIssuer name and redeployed that ingress using helm. But, metrics mentioned above is still there and also new metrics for same certificate with new clusterIssuer:
certmanager_certificate_ready_status{condition="False",issuer_group="cert-manager.io",issuer_kind="ClusterIssuer",issuer_name="issuer-G2",name="falco-ui-ingress-tls",namespace="falco"} 1
certmanager_certificate_ready_status{condition="False",issuer_group="cert-manager.io",issuer_kind="ClusterIssuer",issuer_name="issuer-g2",name="falco-ui-ingress-tls",namespace="falco"} 0
certmanager_certificate_ready_status{condition="True",issuer_group="cert-manager.io",issuer_kind="ClusterIssuer",issuer_name="issuer-G2",name="falco-ui-ingress-tls",namespace="falco"} 0
certmanager_certificate_ready_status{condition="True",issuer_group="cert-manager.io",issuer_kind="ClusterIssuer",issuer_name="issuer-g2",name="falco-ui-ingress-tls",namespace="falco"} 1
certmanager_certificate_ready_status{condition="Unknown",issuer_group="cert-manager.io",issuer_kind="ClusterIssuer",issuer_name="issuer-G2",name="falco-ui-ingress-tls",namespace="falco"} 0
certmanager_certificate_ready_status{condition="Unknown",issuer_group="cert-manager.io",issuer_kind="ClusterIssuer",issuer_name="issuer-g2",name="falco-ui-ingress-tls",namespace="falco"} 0
Expected behaviour:
When ingress / certificate object is modiffied / recreated, metrics for non-existing object should be deleted.
Steps to reproduce the bug:
- create ingress with wrong clusterIssuer name in annotation
- fix the clusterIssuer name in ingress
- check cert-manager metrics
Anything else we need to know?:
Environment details::
- Kubernetes version: 1.30
- Cloud-provider/provisioner: AWS
- cert-manager version: 1.14.4
- Install method: helm
/kind bug