Monitoring CUE Configuration Pipelines with Vigilmon

CUE is an open-source configuration and data validation language that unifies schema, policy, and data into a single evaluator. Teams use it to validate Kubernetes manifests, generate Helm values, and enforce cross-service API contracts. But CUE itself has no runtime — it's a tool invoked by pipelines. When those pipelines fail silently, misconfigured resources make it to production undetected. Vigilmon adds the runtime observability layer CUE lacks: heartbeat monitors for validation jobs, HTTP monitors for any API services that run CUE evaluation, and alerting when the pipeline goes quiet.

What You'll Set Up

• Cron heartbeat monitors for scheduled CUE validation and export jobs
• HTTP monitors for services that expose CUE evaluation APIs
• Alerting for silent pipeline failures
• SSL certificate monitoring for CUE-backed API services

Prerequisites

• CUE 0.7+ installed (cue version)
• At least one scheduled job or service that runs CUE evaluation
• A free Vigilmon account

Step 1: Add a Heartbeat Monitor for Scheduled CUE Validation Jobs

The most common CUE failure mode is a validation job that exits zero but stops running — a broken cron entry, a CI step that gets skipped, or a dependency that times out silently. Vigilmon's cron heartbeat catches these by alerting when the expected ping doesn't arrive.

1. Log in to vigilmon.online and click Add Monitor.
2. Select Cron Heartbeat.
3. Set the expected ping interval to match your job schedule (e.g. 60 minutes for an hourly validation run).
4. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).

Now update your CUE validation script to ping Vigilmon on success:

#!/bin/bash
set -e

# Run CUE validation across the config directory
cue vet ./config/... ./schema/...

# Export validated configs to Kubernetes manifests
cue export ./config/... --out yaml > /tmp/manifests.yaml

# Signal success — only reached if cue commands exit 0
curl -s https://vigilmon.online/heartbeat/abc123

If cue vet or cue export fails, the script exits before the curl, and Vigilmon alerts after the expected window passes.

For a GitHub Actions workflow, add the ping step explicitly:

- name: Validate CUE configs
  run: cue vet ./config/... ./schema/...

- name: Export manifests
  run: cue export ./config/... --out yaml > dist/manifests.yaml

- name: Ping Vigilmon
  if: success()
  run: curl -s https://vigilmon.online/heartbeat/abc123

Step 2: Monitor CUE Evaluation APIs

Some teams build HTTP services that run cue eval or cue export on demand — a webhook receiver that validates incoming JSON, a Kubernetes admission webhook that runs CUE policy checks, or an internal API that generates environment-specific configs. Monitor these like any HTTP service:

1. Click Add Monitor in Vigilmon.
2. Set Type to HTTP / HTTPS.
3. Enter the service URL: https://cue-validator.internal.example.com/health.
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

Add a /health endpoint to your CUE evaluation service that verifies the CUE runtime is available:

// Go service wrapping cue/load
http.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
    // Quick CUE parse to confirm the evaluator is working
    ctx := cuecontext.New()
    v := ctx.CompileString(`x: 1`)
    if v.Err() != nil {
        http.Error(w, "cue evaluator error", http.StatusServiceUnavailable)
        return
    }
    w.WriteHeader(http.StatusOK)
    w.Write([]byte(`{"status":"ok"}`))
})

Step 3: Validate CUE Schema in CI and Alert on Drift

CUE schemas drift when the data they validate changes faster than the schema. Catch drift early by running schema validation in CI and using a heartbeat to confirm CI is actually running.

Create a validation wrapper script:

#!/bin/bash
# validate-and-report.sh
set -e

echo "Running CUE schema validation..."
cue vet ./schema/... ./data/...

echo "Checking for unhandled fields..."
cue vet -c ./schema/strict/... ./data/...

echo "All validations passed."
curl -s "https://vigilmon.online/heartbeat/def456"

Add it to your CI pipeline on a schedule (daily at minimum):

# .github/workflows/cue-validate.yml
on:
  push:
    paths: ['schema/**', 'data/**', 'config/**']
  schedule:
    - cron: '0 6 * * *'  # daily at 06:00 UTC

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: cue-lang/setup-cue@v1
        with:
          version: 'v0.7.0'
      - run: ./scripts/validate-and-report.sh

Set the Vigilmon heartbeat interval to 25 hours to handle weekend gaps without false alerts.

Step 4: Monitor CUE-Generated Kubernetes Manifests Pipeline

Teams that use CUE to generate Kubernetes manifests typically run a pipeline: CUE export → apply to cluster. If the export step silently stops running, stale manifests accumulate. Monitor the full pipeline:

#!/bin/bash
set -e

# Generate manifests from CUE
cue export ./k8s/... --out yaml -o dist/

# Validate against Kubernetes schema
kubectl apply --dry-run=client -f dist/

# Apply to cluster
kubectl apply -f dist/

# Confirm pipeline completed
curl -s https://vigilmon.online/heartbeat/ghi789

Create a separate Vigilmon monitor for each environment (staging, production) so you get per-environment visibility.

Step 5: SSL Certificate Alerts for CUE API Services

If your CUE evaluation service is exposed over HTTPS, add certificate expiry monitoring:

1. Open the HTTP / HTTPS monitor for your CUE service (from Step 2).
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

Step 6: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or a webhook.
2. For heartbeat monitors, set Consecutive failures before alert to 1 — a missed heartbeat is immediately actionable.
3. For HTTP service monitors, set it to 2 to absorb transient restarts.

Summary

| Monitor | Type | What It Catches | |---|---|---| | Validation job heartbeat | Cron heartbeat | Silent cron failure, broken CI step | | CUE evaluation API | HTTP | Service crash, evaluator errors | | Schema drift CI | Cron heartbeat | Missed daily validation run | | Manifest pipeline | Cron heartbeat | Stale config reaching cluster | | API SSL certificate | HTTP + SSL | Certificate expiry |

CUE enforces correctness at evaluation time — Vigilmon enforces it at pipeline time. Together they close the gap between "the schema is valid" and "the pipeline that enforces the schema is actually running."