Monitoring Antrea with Vigilmon: CNI Health, Controller Availability, Antrea Proxy & SSL Certificates

Antrea is VMware's open-source CNI (Container Network Interface) plugin that implements Kubernetes networking and NetworkPolicy enforcement using Open vSwitch (OVS). When the Antrea controller loses quorum or antrea-agent DaemonSet pods crash, pod networking breaks across the affected nodes — new pods fail to start, existing connections may drop, and NetworkPolicy enforcement becomes inconsistent. Vigilmon gives you external visibility into the Antrea controller API, agent health, and certificate status so you catch networking failures before they cascade into application outages.

What You'll Build

An HTTP monitor on the Antrea controller API health endpoint
A TCP monitor confirming the Antrea controller port is reachable
Heartbeat monitors verifying antrea-agent pods are operational across nodes
SSL certificate monitoring for your Antrea API endpoint
Alerting runbook mapped to Antrea failure modes

Prerequisites

A Kubernetes cluster with Antrea installed as the CNI
Antrea controller API accessible (default internal service antrea in namespace kube-system)
kubectl access to the cluster
A free account at vigilmon.online

Step 1: Verify the Antrea Controller API Health

The Antrea controller exposes its API server on port 10349 inside the cluster. You can check its readiness from within a pod or via kubectl:

# Check Antrea controller readiness
kubectl get pods -n kube-system -l app=antrea,component=antrea-controller

# Query the controller API (from within the cluster)
curl -sk https://antrea.kube-system.svc.cluster.local:443/healthz

A healthy controller returns ok. The controller manages NetworkPolicy distribution to all antrea-agent pods — if it goes down, new policies are no longer enforced on agents.

Step 2: Create a Vigilmon HTTP Monitor for the Antrea API

If you expose the Antrea controller API externally (or via a Kubernetes Ingress for monitoring purposes), set up an HTTP monitor:

Log in to Vigilmon → Add Monitor → HTTP.
URL: https://antrea-api.yourdomain.com/healthz (or your exposed endpoint).
Check interval: 60 seconds.
Response timeout: 10 seconds.
Expected status: 200.
Label: Antrea Controller API.
Click Save.

If the controller is only accessible internally, use the heartbeat approach in Step 4 instead and skip this step.

Step 3: Monitor the Antrea Controller Port with TCP

The Antrea controller listens on port 10349 (or 443 via the antrea Service). Network policy changes or an OVS misconfiguration can block traffic to this port even when the controller pod is running:

Add Monitor → TCP.
Host: antrea-api.yourdomain.com (your externally-accessible Antrea controller endpoint).
Port: 443.
Check interval: 2 minutes.
Label: Antrea Controller Port.
Click Save.

Step 4: Monitor Antrea-Agent Health via a Heartbeat

The antrea-agent DaemonSet runs on every node and is responsible for programming OVS flows and enforcing NetworkPolicy. An agent failure on a node means pods on that node lose policy enforcement and may lose connectivity. Set up a CronJob that verifies all expected agent pods are healthy:

Step 4a — Create a Heartbeat monitor in Vigilmon:

Add Monitor → Heartbeat.
Name: Antrea Agent DaemonSet Health.
Expected interval: 5 minutes.
Grace period: 3 minutes.
Copy the generated ping URL (e.g., https://vigilmon.online/ping/abc123).

Step 4b — Deploy the CronJob:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: antrea-agent-heartbeat
  namespace: kube-system
spec:
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: antrea-controller
          containers:
            - name: check
              image: bitnami/kubectl:latest
              command:
                - sh
                - -c
                - |
                  DESIRED=$(kubectl get daemonset antrea-agent -n kube-system \
                    -o jsonpath='{.status.desiredNumberScheduled}')
                  READY=$(kubectl get daemonset antrea-agent -n kube-system \
                    -o jsonpath='{.status.numberReady}')
                  if [ "$DESIRED" -eq "$READY" ] && [ "$READY" -gt "0" ]; then
                    curl -fsS -m 10 https://vigilmon.online/ping/abc123
                  fi
          restartPolicy: OnFailure

If any antrea-agent pod is not ready, the CronJob skips the ping and Vigilmon alerts after the grace period.

Step 5: Monitor the Antrea Controller Heartbeat

The Antrea controller is a single-replica deployment. A controller failure means no new NetworkPolicies can be distributed and the controller-managed resources become stale. Set up a separate heartbeat for the controller:

Step 5a — Create a Heartbeat monitor in Vigilmon:

Add Monitor → Heartbeat.
Name: Antrea Controller Health.
Expected interval: 5 minutes.
Grace period: 3 minutes.
Copy the ping URL.

Step 5b — Deploy the CronJob:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: antrea-controller-heartbeat
  namespace: kube-system
spec:
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: antrea-controller
          containers:
            - name: check
              image: bitnami/kubectl:latest
              command:
                - sh
                - -c
                - |
                  READY=$(kubectl get deployment antrea-controller -n kube-system \
                    -o jsonpath='{.status.readyReplicas}')
                  if [ "$READY" -ge "1" ]; then
                    curl -fsS -m 10 https://vigilmon.online/ping/abc123
                  fi
          restartPolicy: OnFailure

Step 6: Monitor the Antrea API SSL Certificate

The Antrea controller API uses TLS for all internal and external communication. An expired certificate causes kubectl antrea-related commands to fail and breaks the controller-to-agent communication channel:

Add Monitor → SSL Certificate.
Domain: antrea-api.yourdomain.com.
Alert when expiry is within: 30 days.
Alert again at: 14 days, 7 days, 3 days, 1 day.
Click Save.

Antrea manages its own internal CA and certificates — monitor both the internally-generated certs and any external Ingress certificates separately.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Controller API | Non-200 response | kubectl get pods -n kube-system -l app=antrea; check controller logs | | Controller port TCP | Connection refused | Verify Service and endpoint; check OVS status | | Agent heartbeat | No ping within 8 min | kubectl get ds antrea-agent -n kube-system; check NotReady nodes | | Controller heartbeat | No ping within 8 min | kubectl describe deploy antrea-controller -n kube-system | | SSL certificate | < 30 days | Rotate Antrea CA or renew Ingress TLS certificate |

Common Antrea Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Antrea controller pod evicted | Controller heartbeat expires | | antrea-agent OOMKilled on a node | Agent DaemonSet heartbeat shows mismatch | | OVS bridge misconfiguration | Agent pods NotReady; DaemonSet heartbeat fires | | NetworkPolicy distribution stalled | Controller heartbeat; policies silently not applied | | TLS certificate rotation failure | SSL monitor alerts at 30-day threshold | | antrea-agent loses controller connectivity | Agent logs show errors; heartbeat eventually expires | | Node NotReady due to CNI plugin failure | Agent heartbeat detects ready count drop |

Antrea is the networking foundation your cluster runs on — when it fails, applications don't just slow down, they stop communicating entirely. Vigilmon's external monitoring of the Antrea controller API, agent DaemonSet health, and SSL certificates gives you an independent signal layer that operates outside the cluster's own observability stack, so you're alerted even when Prometheus itself is affected by the networking outage.

Start monitoring Antrea in under 5 minutes — register free at vigilmon.online.