tutorial

How to Monitor Gardener Kubernetes-as-a-Service with Vigilmon (HTTP + TCP + Alerts)

Gardener is an open-source Kubernetes-as-a-Service platform that uses Kubernetes to manage Kubernetes. It provisions and manages "shoot" clusters for your us...

Gardener is an open-source Kubernetes-as-a-Service platform that uses Kubernetes to manage Kubernetes. It provisions and manages "shoot" clusters for your users on top of "seed" clusters, with the Gardener API server acting as the control plane for everything. This architecture is powerful — but a failure in the Gardener API server, gardenlet, or seed cluster silently breaks all shoot cluster reconciliation.

In this tutorial you'll set up comprehensive uptime monitoring for your Gardener landscape using Vigilmon — free tier, no credit card required.

Why Gardener deployments need external monitoring

Gardener introduces a layered architecture where failures at one layer don't automatically surface at another:

  • Gardener API server goes down — users can't create or update shoot clusters; existing shoots keep running but cannot be reconciled or scaled
  • Gardenlet loses connectivity to seed — shoot cluster reconciliation stops silently; new workers can't be added, control plane updates stall
  • Seed cluster becomes unhealthy — all shoot control planes hosted on that seed are affected, but the garden control plane still shows them as healthy
  • Gardener controller manager stops — shoot hibernation, credential rotation, and health check reconciliation all stop running
  • DNS extension failure — shoot cluster DNS records stop being updated; load balancer IPs change but DNS entries lag behind

Users see healthy shoot clusters in kubectl get shoots while the real shoot services are degraded or the provisioning pipeline is broken. External monitoring is the only way to catch this gap.

What you'll need

  • A running Gardener landscape (garden cluster + at least one seed cluster)
  • The Gardener API server exposed externally (standard for multi-tenant setups)
  • A free Vigilmon account (sign up takes 30 seconds)

Step 1: Identify the Gardener endpoints to monitor

Gardener exposes several critical endpoints you should monitor:

Gardener API server — the aggregated API server that handles all garden.sapcloud.io resources:

# Find the Gardener API server endpoint
kubectl -n garden get svc gardener-apiserver
# NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)          AGE
# gardener-apiserver     LoadBalancer   10.96.12.5      203.0.113.100    443:32443/TCP    5d

Gardener controller manager:

kubectl -n garden get pods -l app=gardener-controller-manager

Gardenlet health endpoint on each seed:

# Check gardenlet in the seed cluster
kubectl -n garden get pods -l app=gardenlet

Add a health check endpoint exposure for monitoring. Gardener's API server responds to /healthz:

# Verify Gardener API server health
curl -k https://203.0.113.100/healthz
# ok

If you want a non-TLS health proxy for easier monitoring configuration:

# gardener-health-proxy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gardener-health-proxy
  namespace: garden
spec:
  replicas: 1
  selector:
    matchLabels:
      app: gardener-health-proxy
  template:
    metadata:
      labels:
        app: gardener-health-proxy
    spec:
      containers:
        - name: proxy
          image: curlimages/curl:latest
          command:
            - /bin/sh
            - -c
            - |
              while true; do
                STATUS=$(curl -sk https://127.0.0.1:2719/healthz && echo "ok" || echo "error")
                echo "status: $STATUS"
                sleep 10
              done
---
apiVersion: v1
kind: Service
metadata:
  name: gardener-health-proxy
  namespace: garden
spec:
  type: LoadBalancer
  selector:
    app: gardener-health-proxy
  ports:
    - port: 8080
      targetPort: 8080

Alternatively, use a simple nginx reverse proxy in front of the Gardener API server's /healthz endpoint.

Step 2: Set up HTTP monitoring in Vigilmon

With the Gardener API server reachable, add it to Vigilmon:

  1. Log in to vigilmon.online and go to Monitors → New Monitor
  2. Choose HTTP / HTTPS as the type
  3. Set the URL to your Gardener API server health endpoint: https://203.0.113.100/healthz
  4. Set the check interval to 1 minute
  5. Under Expected response, set:
    • Status code: 200
    • Response body contains: ok
  6. Under SSL, enable SSL certificate monitoring
  7. Save the monitor

Add a second monitor for your most critical shoot cluster API server:

URL: https://api.shoot.your-domain.com/healthz
Expected status: 200
Body contains: ok

Vigilmon probes from multiple geographic regions. If the Gardener API server becomes unreachable — even while individual shoot clusters appear healthy — an alert fires immediately.

Multi-region consensus for control plane monitoring

Gardener API servers are typically multi-tenant, single-region deployments. A network partitioning event or upstream provider issue can make the control plane unreachable from outside while all internal components still see each other as healthy. Vigilmon's multi-region consensus model eliminates false positives by requiring probes from multiple independent geographic locations to agree before firing an alert.

Step 3: Monitor TCP connectivity to seed and shoot API servers

TCP monitoring provides an additional layer of coverage below the HTTP/application level:

Gardener API server TCP port:

  1. Go to Monitors → New Monitor
  2. Choose TCP Port
  3. Enter: Host 203.0.113.100, Port 443
  4. Save the monitor

Shoot cluster API server (if directly exposed):

  1. Choose TCP Port
  2. Enter your shoot API server host and port (typically 6443)
  3. Save the monitor

TCP monitoring catches:

  • LoadBalancer port binding failures
  • Firewall rule regressions that block HTTPS traffic
  • TLS handshake failures that the HTTP layer would report as connection refused
# Verify shoot API server connectivity from outside
kubectl --kubeconfig=shoot-kubeconfig cluster-info
# Kubernetes control plane is running at https://api.shoot.your-domain.com

nc -zv api.shoot.your-domain.com 443

Step 4: Configure alert channels

A degraded Gardener control plane is often invisible to end users until they try to scale a shoot cluster or rotate credentials — and then it's a fire drill.

Email alerts

  1. In Vigilmon, go to Alert Channels → Add Channel → Email
  2. Enter your platform engineering team's on-call email
  3. Assign the channel to your Gardener and shoot cluster monitors

Webhook alerts (Slack, PagerDuty, etc.)

  1. Go to Alert Channels → Add Channel → Webhook
  2. Enter your webhook URL
  3. Assign the channel to your monitors

Example payload when the Gardener API server goes down:

{
  "monitor_name": "Gardener API Server",
  "status": "down",
  "url": "https://203.0.113.100/healthz",
  "started_at": "2024-01-15T10:23:00Z",
  "duration_seconds": 240
}

Use this to trigger automated diagnostics:

# Check Gardener control plane components
kubectl -n garden get pods
kubectl -n garden logs -l app=gardener-apiserver --tail=100
kubectl -n garden logs -l app=gardener-controller-manager --tail=100

# Check shoot cluster conditions
kubectl get shoots -A
kubectl describe shoot <shoot-name> -n <project-namespace>

# Check gardenlet on each seed
kubectl -n garden get seeds
kubectl -n garden describe seed <seed-name>

Step 5: Create a public status page

Give your development teams and shoot cluster operators visibility into the Gardener landscape health.

  1. In Vigilmon, go to Status Pages → New Status Page
  2. Give it a name: "Gardener Platform Status"
  3. Add your monitors: Gardener API Server, Seed connectivity, Shoot cluster API servers
  4. Group them: Control Plane, Seed Clusters, Shoot Clusters
  5. Publish the page

Share this URL with:

  • Development teams that depend on shoot clusters
  • Operations teams managing the landscape
  • Stakeholders who need SLA visibility without Kubernetes access

Putting it all together

Here's a summary of the monitors to create for a typical Gardener landscape:

| Monitor | Type | What it catches | |---------|------|-----------------| | https://203.0.113.100/healthz | HTTP | Gardener API server health | | https://api.shoot.your-domain.com/healthz | HTTP | Shoot cluster API server health | | 203.0.113.100:443 | TCP | Gardener API server TCP reachability | | api.shoot.your-domain.com:443 | TCP | Shoot API server TCP reachability | | https://203.0.113.100/healthz | HTTP (SSL) | Gardener API TLS cert validity |

And the diagnostics to run when an alert fires:

# Full landscape health overview
kubectl get seeds -o wide
kubectl get shoots -A -o wide
kubectl get controllerinstallations -A

# Gardenlet status on seeds
kubectl -n garden get pods -l app=gardenlet -A

# Shoot control plane components
kubectl -n <shoot-technical-id> get pods  # on the seed cluster

# Gardener extension health
kubectl get extensions -A

What's next

  • SSL certificate monitoring — Gardener manages TLS for all shoot API servers; add a Vigilmon SSL monitor for each shoot's API server to catch cert-manager renewal failures
  • Heartbeat monitoring — use Vigilmon heartbeats to verify that your Gardener gardenlet reconciliation loops are running on schedule (configure gardenlet to POST to a heartbeat URL after each reconciliation cycle)
  • Multi-seed coverage — create a monitor group per seed cluster and use status page grouping to show per-seed health to your platform team

Get started free at vigilmon.online — no credit card, monitors start running in under a minute.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles