[yahor-kurachkin]

feat: Create WebhookInjectorCertRotationStuck alert

Summary

Adds monitoring for webhook-injector certificate rotation failures in controlplane-operations.

The alert detects sustained reconciliation issues — excessive requeues or persistent errors — in the configmap controller running the webhook-injector container.

Alert Logic

Triggers when either condition persists over a 5-minute window:

• Requeue rate > 0.05 req/s (configmap controller, webhook-injector)
• Error rate > 0 (same controller/container)

Changes

• charts/controlplane-operations/alerts/controlplane-remote.yaml — adds the WebhookInjectorCertRotationStuck alert rule with configurable thresholds, diagnostic annotations, and a playbook link

Notes

• Alert uses result-specific label matchers — consider whether alternating failure modes could delay detection or produce duplicate firings

[Copilot]

🟡 Changes recommended

Result-specific alert identities can delay detection when failure modes alternate and produce duplicate alerts when both persist.

1 open issue

• Aggregate alert expression to share identity across failure modes · New

What changed in this PR

Adds WebhookInjectorCertRotationStuck to monitor potential webhook-injector certificate rotation failures.

Changes:

• Detects sustained excessive requeues or reconciliation errors.
• Adds configurable alert settings, diagnostic annotations, and a playbook link.

File	Description
charts/​controlplane-operations/​alerts/​controlplane-remote.yaml	Adds the certificate rotation alert and its configuration.

_{Review effort: Balanced}