Akeyless Monitoring with Vigilmon

Akeyless is a unified, cloud-native secrets and authentication platform that centralizes management of static secrets, dynamic secrets, SSH certificates, TLS certificates, Kubernetes authentication, and tokenization. Its SaaS-first architecture combined with a self-hosted Gateway option makes it a popular choice for enterprises that need secrets management across multi-cloud and hybrid environments without operating HashiCorp Vault themselves.

The Akeyless platform surfaces secrets to applications through several channels: the Akeyless Gateway (a self-hosted proxy), direct API calls to api.akeyless.io, the akeyless CLI, and language SDKs. Each of these channels is a potential point of failure that can cause applications to lose access to credentials, authentication to break, or dynamic secret leases to fail to renew.

This guide covers how to monitor Akeyless infrastructure using Vigilmon.

Why Akeyless Infrastructure Needs Monitoring

Akeyless platform failures surface in unexpected ways:

• Gateway pod unavailability — the self-hosted Akeyless Gateway is down; all applications routing secret requests through it fail immediately
• Dynamic secret lease expiry — a database dynamic secret's lease expires before renewal; the application's database connection fails with authentication errors
• OIDC/JWT auth endpoint failures — Akeyless's authentication endpoints become unavailable; Kubernetes workloads and CI/CD pipelines lose the ability to authenticate
• Secret rotation target unavailability — an automatic secret rotation job cannot reach the target system (database, cloud IAM, etc.) and the rotation silently fails; the old credentials remain active past their intended lifetime
• Gateway TLS certificate expiry — the Gateway's TLS certificate expires; clients that validate certificates start rejecting connections
• API rate limiting — high-frequency secret reads trigger rate limits; applications start receiving 429 errors and backing off in ways that cause cascading failures

Vigilmon monitors these failure modes through HTTP checks against Akeyless API and Gateway endpoints, and heartbeats from your rotation and lease renewal automation.

Akeyless Architecture Components

| Component | Role | Monitoring Priority | |-----------|------|---------------------| | Akeyless SaaS API (api.akeyless.io) | Core secret storage and auth | Critical | | Akeyless Gateway | Self-hosted secret proxy | Critical | | Dynamic secret engine | Database/cloud credentials | High | | Secret rotation jobs | Credential lifecycle | High | | Authentication endpoints | K8s, JWT, OIDC auth | High | | CLI and SDKs | Developer and CI access | Medium |

Monitoring the Akeyless SaaS API

Monitor 1: Akeyless API Health Check

1. Log in to Vigilmon → Monitors → New Monitor
2. Type: HTTP
3. Name: Akeyless API - Health
4. URL: https://api.akeyless.io/get-secret-value
5. Method: POST
6. Request body: {"names":["health-check"],"token":"READONLY_HEALTH_TOKEN"}
7. Expected status: 200
8. Interval: 2 minutes

Alternatively, use the dedicated health endpoint if your Akeyless plan exposes one, or use the /describe-item endpoint with a non-sensitive test item.

Monitor 2: Akeyless Status Page API

Monitor Akeyless's published status:

1. Type: HTTP
2. Name: Akeyless Cloud Status
3. URL: https://status.akeyless.io/api/v2/status.json
4. Method: GET
5. Expected status: 200
6. Keyword check: "indicator":"none"
7. Interval: 5 minutes

Monitoring the Akeyless Gateway

The Gateway is the most critical self-hosted component. It proxies all secret reads for applications configured to use it:

Monitor 1: Gateway Health Endpoint

# The Akeyless Gateway exposes /healthz
# Expose it via an ingress or load balancer for external monitoring

In Vigilmon:

1. Type: HTTP
2. Name: Akeyless Gateway - Liveness
3. URL: https://akeyless-gateway.your-domain.com/healthz
4. Method: GET
5. Expected status: 200
6. Interval: 1 minute

Monitor 2: Gateway Secret Read Test

This is more valuable than a process liveness check — it verifies that the Gateway can actually proxy secret reads:

#!/bin/bash
# gateway-health-check.sh - run every 5 minutes as a cron job or K8s CronJob
set -euo pipefail

# Authenticate to Akeyless via the Gateway
TOKEN=$(curl -s -X POST \
  "https://akeyless-gateway.your-domain.com/v2/auth" \
  -H "Content-Type: application/json" \
  -d "{\"access-id\":\"${AKEYLESS_ACCESS_ID}\",\"access-type\":\"access_key\",\"access-key\":\"${AKEYLESS_ACCESS_KEY}\"}" \
  | jq -r '.token')

if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
  echo "[akeyless] gateway authentication failed"
  exit 1
fi

# Read a health-check secret
VALUE=$(curl -s -X POST \
  "https://akeyless-gateway.your-domain.com/v2/get-secret-value" \
  -H "Content-Type: application/json" \
  -d "{\"names\":[\"health/vigilmon-check\"],\"token\":\"$TOKEN\"}" \
  | jq -r '."health/vigilmon-check"')

if [ "$VALUE" != "ok" ]; then
  echo "[akeyless] gateway returned unexpected health value: $VALUE"
  exit 1
fi

echo "[akeyless] gateway health check passed"
curl -s "https://heartbeat.vigilmon.online/$VIGILMON_GATEWAY_HEARTBEAT_ID"

In Vigilmon:

• Type: Heartbeat
• Name: Akeyless Gateway - Secret Read
• Expected interval: 5 minutes
• Grace period: 2 minutes

Monitoring Dynamic Secrets

Dynamic secrets — database credentials, AWS IAM tokens, Azure service principals — have leases that must be renewed before expiry. Monitor the renewal process:

Pattern 1: Database Dynamic Secret Lease Renewal Heartbeat

#!/bin/bash
# renew-db-dynamic-secret.sh
set -euo pipefail

# Authenticate
TOKEN=$(akeyless auth \
  --access-id "$AKEYLESS_ACCESS_ID" \
  --access-key "$AKEYLESS_ACCESS_KEY" \
  --output text 2>/dev/null)

# Get dynamic credentials
CREDS=$(akeyless dynamic-secret get-value \
  --name "/dynamic/production-postgres" \
  --token "$TOKEN" \
  --format json)

DB_USER=$(echo "$CREDS" | jq -r '.user')
DB_PASS=$(echo "$CREDS" | jq -r '.password')

if [ -z "$DB_USER" ] || [ -z "$DB_PASS" ]; then
  echo "[akeyless] dynamic secret retrieval returned empty credentials"
  exit 1
fi

# Test the credentials (optional but recommended)
PGPASSWORD="$DB_PASS" psql \
  -h postgres.your-domain.com \
  -U "$DB_USER" \
  -d healthcheck \
  -c "SELECT 1" > /dev/null 2>&1

echo "[akeyless] dynamic secret verified"
curl -s "https://heartbeat.vigilmon.online/$VIGILMON_DYNAMIC_SECRET_HEARTBEAT_ID"

In Vigilmon:

• Type: Heartbeat
• Name: Akeyless - Production Postgres Dynamic Secret
• Expected interval: Lease duration minus 20% (e.g., for a 1-hour lease, expect every 48 minutes)
• Grace period: 10 minutes

Pattern 2: AWS Dynamic Secret

#!/bin/bash
# renew-aws-dynamic-secret.sh
set -euo pipefail

CREDS=$(akeyless dynamic-secret get-value \
  --name "/dynamic/aws-prod" \
  --token "$AKEYLESS_TOKEN" \
  --format json)

AWS_ACCESS_KEY=$(echo "$CREDS" | jq -r '.access_key_id')
AWS_SECRET_KEY=$(echo "$CREDS" | jq -r '.secret_access_key')

if [ -z "$AWS_ACCESS_KEY" ]; then
  echo "[akeyless] AWS dynamic secret retrieval failed"
  exit 1
fi

# Verify credentials with a read-only API call
AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY" \
AWS_SECRET_ACCESS_KEY="$AWS_SECRET_KEY" \
  aws sts get-caller-identity > /dev/null

echo "[akeyless] AWS dynamic secret valid"
curl -s "https://heartbeat.vigilmon.online/$VIGILMON_AWS_DYNAMIC_HEARTBEAT_ID"

Monitoring Secret Rotation Jobs

Akeyless can automatically rotate secrets on a schedule. Monitor that rotations succeed:

#!/bin/bash
# post-rotation-verify.sh - triggered by Akeyless rotation webhook or run as a cron job after expected rotation window
set -euo pipefail

TOKEN=$(akeyless auth \
  --access-id "$AKEYLESS_ACCESS_ID" \
  --access-key "$AKEYLESS_ACCESS_KEY" \
  --output text 2>/dev/null)

# Get the metadata for the rotated item to check last rotation time
METADATA=$(akeyless describe-item \
  --name "/rotated/production-api-key" \
  --token "$TOKEN" \
  --format json)

LAST_ROTATED=$(echo "$METADATA" | jq -r '.last_rotation_date // empty')

if [ -z "$LAST_ROTATED" ]; then
  echo "[akeyless] could not determine last rotation date"
  exit 1
fi

echo "[akeyless] secret last rotated: $LAST_ROTATED"
curl -s "https://heartbeat.vigilmon.online/$VIGILMON_ROTATION_HEARTBEAT_ID"

In Vigilmon:

• Type: Heartbeat
• Name: Akeyless - Production API Key Rotation
• Expected interval: Your configured rotation period (e.g., 30 days)
• Grace period: 24 hours

Monitoring Kubernetes Authentication

For Kubernetes workloads that authenticate to Akeyless via the K8s auth method:

# k8s-akeyless-health-check.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: akeyless-k8s-auth-check
  namespace: monitoring
spec:
  schedule: "*/10 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: akeyless-health-check-sa
          containers:
            - name: check
              image: akeyless/akeyless-cli:latest
              command:
                - sh
                - -c
                - |
                  set -e

                  # Authenticate using K8s service account JWT
                  SA_JWT=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
                  TOKEN=$(akeyless auth \
                    --access-id "$AKEYLESS_K8S_ACCESS_ID" \
                    --access-type k8s \
                    --k8s-service-account-token "$SA_JWT" \
                    --k8s-auth-config-name "production-k8s" \
                    --output text)

                  if [ -z "$TOKEN" ]; then
                    echo "K8s authentication failed"
                    exit 1
                  fi

                  # Read health check secret
                  VALUE=$(akeyless get-secret-value \
                    --name "health/k8s-check" \
                    --token "$TOKEN" \
                    --output text)

                  if [ "$VALUE" = "ok" ]; then
                    curl -s "$VIGILMON_K8S_AUTH_HEARTBEAT_URL"
                  else
                    exit 1
                  fi
              env:
                - name: AKEYLESS_K8S_ACCESS_ID
                  value: "p-XXXXXXXXXXXXXXXX"
                - name: VIGILMON_K8S_AUTH_HEARTBEAT_URL
                  value: "https://heartbeat.vigilmon.online/YOUR_HEARTBEAT_ID"
          restartPolicy: Never

In Vigilmon:

• Type: Heartbeat
• Name: Akeyless - Kubernetes Auth
• Expected interval: 10 minutes
• Grace period: 3 minutes

Alert Configuration

| Monitor | Type | Interval | Alert Channel | |---------|------|----------|---------------| | Akeyless SaaS API | HTTP | 2 min | PagerDuty + Slack | | Akeyless Cloud Status | HTTP | 5 min | Slack | | Gateway liveness | HTTP | 1 min | PagerDuty | | Gateway secret read | Heartbeat | 5 min | PagerDuty + Slack | | Dynamic secrets (DB) | Heartbeat | Per lease | PagerDuty | | Dynamic secrets (AWS) | Heartbeat | Per lease | PagerDuty | | Secret rotation | Heartbeat | Per schedule | Email + Slack | | Kubernetes auth | Heartbeat | 10 min | Slack |

Configure in Vigilmon under Settings → Notifications. Gateway failures should route to PagerDuty immediately — a Gateway outage blocks all secret reads from applications routing through it.

Gateway Kubernetes Deployment Health

If you run the Gateway on Kubernetes, add liveness and readiness probes:

# akeyless-gateway deployment excerpt
livenessProbe:
  httpGet:
    path: /healthz
    port: 8000
  initialDelaySeconds: 30
  periodSeconds: 30
  failureThreshold: 3

readinessProbe:
  httpGet:
    path: /healthz
    port: 8000
  initialDelaySeconds: 10
  periodSeconds: 10
  failureThreshold: 3

Kubernetes handles pod-level recovery. Vigilmon catches the window between failure and recovery, and catches cases where the pod is healthy but the Gateway cannot authenticate or proxy requests.

Status Page for Secrets Infrastructure

Create a Vigilmon status page grouping all Akeyless monitors:

1. Status Pages → New Page → name it "Akeyless Secrets Infrastructure"
2. Add monitors: Akeyless Cloud API, Akeyless Gateway, Dynamic Secrets, Secret Rotation, Kubernetes Auth
3. Set visibility to internal (share with platform and security teams)

During incident response, this page disambiguates between a self-hosted Gateway issue and an Akeyless SaaS outage — critical for directing the right team to respond.

Summary

Akeyless centralizes secrets management across your cloud and on-premise infrastructure. When it fails, applications lose access to credentials at the worst possible time. Vigilmon gives you:

• HTTP monitors for Akeyless SaaS API, Gateway liveness, and cloud status
• Heartbeat monitors for dynamic secret lease renewal, secret rotation jobs, and Kubernetes auth checks
• Alert routing to PagerDuty for Gateway outages and dynamic secret failures that block production workloads
• Status pages for organization-wide secrets infrastructure visibility

Get started at vigilmon.online.