How to Monitor Infisical with Vigilmon

Infisical is an open-source secrets manager — a self-hosted alternative to HashiCorp Vault and Doppler — that provides end-to-end encrypted secret storage, dynamic secrets, and native Kubernetes integration. When Infisical goes down, every application that pulls secrets at runtime is at risk: new pods won't start, secret rotations stall, and audit trails go dark.

External monitoring with Vigilmon ensures you detect Infisical outages before your applications do. This tutorial covers monitoring the API server, secret sync status, agent connectivity, the audit log pipeline, and E2E encryption health.

Why Infisical needs external monitoring

Infisical's architecture has several components that can fail independently:

| Component | Role | |---|---| | API Server | REST and gRPC endpoints for secret access and management | | Infisical Agent | Sidecar or DaemonSet that syncs secrets to the filesystem | | Kubernetes Operator | Controller that syncs Infisical secrets to Kubernetes Secrets | | Audit Log Pipeline | Streams access events to the audit log storage backend | | E2E Encryption Layer | Client-side encryption/decryption; broken key derivation is silent |

Each failure mode is distinct:

• API server down — no secret reads or writes; applications crash on startup if they can't fetch secrets
• Agent loses connection — secrets cached on disk are served stale; rotated secrets never reach the pod
• Kubernetes Operator stops reconciling — InfisicalSecret CRDs are not synced to native Kubernetes Secrets; new deployments fail
• Audit log pipeline stalls — security team loses visibility into who accessed what; compliance requirements break
• TLS certificate expired — API clients reject the server; all secret access fails with a TLS handshake error

Standard Kubernetes health checks only verify the API server process is alive. They cannot verify secret sync, audit log delivery, or end-to-end encryption correctness.

What you'll need

• Infisical deployed on Kubernetes (Helm chart) or as a Docker container
• Infisical exposed via Ingress or LoadBalancer on HTTPS
• A free Vigilmon account

Step 1: Verify the Infisical API health endpoint

Infisical exposes a /api/status endpoint that returns the health of the API server and its database connection:

curl -i https://secrets.example.com/api/status

A healthy Infisical instance returns HTTP 200:

{
  "date": "2026-07-01T10:00:00.000Z",
  "message": "Ok",
  "reqId": "abc123"
}

This endpoint checks database connectivity internally — if PostgreSQL is unreachable, the endpoint returns a non-200 response. This makes it the most valuable single monitor you can set up.

If you're running Infisical in Kubernetes, confirm the service is exposed:

kubectl get svc -n infisical
# NAME       TYPE           CLUSTER-IP      EXTERNAL-IP       PORT(S)
# infisical  LoadBalancer   10.96.78.3      203.0.113.100     443:30443/TCP

Step 2: Set up the primary API health monitor

In Vigilmon:

1. Click Add Monitor → HTTP(S)
2. URL: https://secrets.example.com/api/status
3. Interval: 1 minute
4. Expected status: 200
5. String assertion: response body contains "message":"Ok"
6. Timeout: 10 seconds
7. Name: Infisical – API Server Health
8. Enable SSL certificate monitoring: alert when cert expires within 14 days
9. Save

Because /api/status validates database connectivity, this single monitor catches both the API process failure and the most common infrastructure dependency failure — your PostgreSQL instance going down.

Step 3: Monitor secret sync status

The Infisical Kubernetes Operator reconciles InfisicalSecret CRDs into native Kubernetes Secrets. When it stops reconciling, secrets silently go stale.

Check the operator status:

kubectl get pods -n infisical -l app.kubernetes.io/name=infisical-k8s-operator
# NAME                                        READY   STATUS    RESTARTS
# infisical-k8s-operator-xxx-yyy             1/1     Running   0

# Check InfisicalSecret CRD reconciliation status
kubectl get infisicalsecrets -A -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.conditions[?(@.type=="secrets.infisical.com/AutoRedeployReady")].status}{"\n"}{end}'
# my-app-secrets    True

Create a probe deployment that surfaces sync status as an HTTP endpoint:

# infisical-sync-probe.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: secret-sync-probe
  namespace: infisical
spec:
  replicas: 1
  selector:
    matchLabels:
      app: secret-sync-probe
  template:
    metadata:
      labels:
        app: secret-sync-probe
    spec:
      serviceAccountName: infisical-k8s-operator
      containers:
        - name: probe
          image: bitnami/kubectl:latest
          command:
            - /bin/sh
            - -c
            - |
              while true; do
                FAILED=$(kubectl get infisicalsecrets -A \
                  -o jsonpath='{range .items[*]}{.status.conditions[?(@.type=="secrets.infisical.com/AutoRedeployReady")].status}{"\n"}{end}' \
                  | grep -c "False" || echo "0")
                if [ "$FAILED" -gt "0" ]; then
                  echo "sync-failed" > /tmp/sync-status
                else
                  echo "sync-ok" > /tmp/sync-status
                fi
                sleep 30
              done

Expose via Ingress at https://infisical-health.internal.example.com/sync, then add a Vigilmon monitor:

• URL: https://infisical-health.internal.example.com/sync
• String assertion: sync-ok
• Name: Infisical – Secret Sync Status

Step 4: Monitor agent connectivity

The Infisical Agent runs as a sidecar or DaemonSet and continuously syncs secrets to a local directory. When it loses connectivity to the API server, it serves cached secrets — which may be rotated and no longer valid.

Check the agent's status endpoint:

# Infisical Agent exposes a status endpoint on :5555 by default
kubectl port-forward -n my-app pod/my-app-pod 5555:5555
curl -s http://localhost:5555/status
# {"connected":true,"last_sync":"2026-07-01T10:00:00Z","secret_count":42}

Add a lightweight connectivity probe that verifies the agent can reach the API from inside the cluster:

# agent-connectivity-probe.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: agent-connectivity-probe
  namespace: infisical
spec:
  replicas: 1
  selector:
    matchLabels:
      app: agent-connectivity-probe
  template:
    metadata:
      labels:
        app: agent-connectivity-probe
    spec:
      containers:
        - name: probe
          image: curlimages/curl:8.5.0
          command:
            - /bin/sh
            - -c
            - |
              while true; do
                RESP=$(curl -fsS --max-time 5 \
                  http://infisical.infisical.svc.cluster.local/api/status 2>/dev/null)
                if echo "$RESP" | grep -q '"message":"Ok"'; then
                  echo "connected" > /tmp/agent-status
                else
                  echo "disconnected" > /tmp/agent-status
                fi
                sleep 15
              done
          ports:
            - containerPort: 8080

Add a Vigilmon HTTP monitor for the agent connectivity endpoint:

• URL: https://infisical-health.internal.example.com/agent
• Expected status: 200
• String assertion: connected
• Name: Infisical – Agent Connectivity

Step 5: Monitor the audit log pipeline

Infisical's audit log records every secret access, rotation, and permission change. Compliance requirements (SOC 2, ISO 27001) typically require that audit logs are continuously delivered. If the audit pipeline stalls, you won't know.

Check recent audit log activity via the API:

curl -s -H "Authorization: Bearer $INFISICAL_API_TOKEN" \
  "https://secrets.example.com/api/v1/audit-logs?limit=1" \
  | jq '.auditLogs[0].createdAt'
# "2026-07-01T10:05:00.000Z"

Create a probe that alerts if no audit logs have been written in the last 10 minutes:

#!/usr/bin/env python3
# audit-log-probe.py — deploy as a container exposing :8080
from http.server import HTTPServer, BaseHTTPRequestHandler
from datetime import datetime, timezone
import urllib.request, json, os

INFISICAL_URL = os.environ.get('INFISICAL_URL', 'https://secrets.example.com')
API_TOKEN = os.environ.get('INFISICAL_API_TOKEN', '')

class Handler(BaseHTTPRequestHandler):
    def log_message(self, *args):
        pass

    def do_GET(self):
        if self.path != '/healthz':
            self.send_response(404)
            self.end_headers()
            return
        try:
            req = urllib.request.Request(
                f'{INFISICAL_URL}/api/v1/audit-logs?limit=1',
                headers={'Authorization': f'Bearer {API_TOKEN}'}
            )
            with urllib.request.urlopen(req, timeout=5) as resp:
                data = json.loads(resp.read())
            logs = data.get('auditLogs', [])
            if logs:
                last_ts = datetime.fromisoformat(
                    logs[0]['createdAt'].replace('Z', '+00:00'))
                age_min = (datetime.now(timezone.utc) - last_ts).seconds / 60
                if age_min < 10:
                    self.send_response(200)
                    self.end_headers()
                    self.wfile.write(json.dumps(
                        {'status': 'ok', 'last_log_age_min': round(age_min, 1)}
                    ).encode())
                    return
        except Exception:
            pass
        self.send_response(503)
        self.end_headers()
        self.wfile.write(b'{"status":"stale"}')

HTTPServer(('', 8080), Handler).serve_forever()

Deploy this in the infisical namespace and add a Vigilmon monitor:

• URL: https://infisical-health.internal.example.com/audit-log
• Expected status: 200
• String assertion: "status":"ok"
• Name: Infisical – Audit Log Pipeline

Step 6: Monitor E2E encryption health

Infisical uses client-side E2E encryption — the server never sees plaintext secrets. While it's difficult to monitor encryption correctness externally, you can verify the encryption pipeline by doing a write/read round-trip test.

Create a CronJob that runs every 5 minutes:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: infisical-e2e-check
  namespace: infisical
spec:
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: check
              image: infisical/cli:latest
              env:
                - name: INFISICAL_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: infisical-monitor-token
                      key: token
                - name: PROJECT_ID
                  value: "your-project-id"
              command:
                - /bin/sh
                - -c
                - |
                  # Write a test secret
                  infisical secrets set HEALTHCHECK="ok" \
                    --projectId "$PROJECT_ID" --environment=dev
                  # Read it back — verifies E2E encryption round-trip
                  VALUE=$(infisical secrets get HEALTHCHECK \
                    --projectId "$PROJECT_ID" --environment=dev --plain)
                  [ "$VALUE" = "ok" ] || exit 1
                  echo "E2E encryption check passed"
          restartPolicy: Never

Pair this with a Vigilmon heartbeat monitor: the CronJob pings a Vigilmon heartbeat URL on success, and Vigilmon alerts if no ping arrives within 10 minutes.

Step 7: Alerts and escalation

In Vigilmon → Alert Channels:

1. Add PagerDuty — Infisical outages are P1 (apps can't start without secrets)
2. Add Slack for the security team channel
3. Set Alert after: 1 consecutive failure for API health (no tolerance for secrets being inaccessible)
4. Set Alert after: 2 consecutive failures for sync and audit monitors
5. Enable Recovery alerts on all monitors

Recommended escalation policy:

| Severity | Trigger | Action | |---|---|---| | Critical | /api/status returns non-200 | Page on-call — deployments are stalled | | Critical | SSL cert expires < 7 days | Emergency renewal | | High | Secret sync probe fails | Alert infra team | | High | Agent connectivity probe fails | Investigate agent pods | | Medium | Audit log pipeline stale > 10 min | Alert security team | | Warning | E2E encryption round-trip fails | Investigate key derivation |

Monitor checklist

| Monitor | What it catches | |---|---| | API Server /api/status | Server down, DB disconnected | | TLS certificate expiry | Cert < 14 days; API clients will reject | | Secret sync status | Kubernetes Operator stopped reconciling | | Agent connectivity | Agents can't reach API; stale secrets in pods | | Audit log pipeline | Audit log delivery stalled; compliance risk | | E2E encryption round-trip | Write/read cycle broken; encryption layer failure |

Summary

Infisical is critical infrastructure — when it goes down, every secret-dependent service is at risk. Vigilmon's external monitors give you a complete picture: API availability, TLS validity, secret sync health, agent connectivity, and audit pipeline status. Because Vigilmon checks from multiple geographic regions, you also catch regional outages or routing failures that internal probes never see.

Sign up for a free account at vigilmon.online and add your first Infisical monitor before the next incident finds you first.