Monitoring Kong Ingress Controller with Vigilmon

Kong Ingress Controller (KIC) is the Kubernetes-native way to run Kong Gateway as your cluster's API gateway, managing routing rules through Custom Resource Definitions rather than static configuration files. As the single ingress layer for your cluster, KIC is a critical dependency — when it fails, every service it routes goes unreachable. Vigilmon gives you external uptime monitoring for KIC itself, the routes it manages, and the SSL certificates it terminates, so you catch gateway failures before your users do.

What You'll Set Up

• HTTP uptime monitors for the Kong Ingress Controller health endpoint
• Per-route monitors for critical backend services
• TCP port monitors for the gateway listener ports
• SSL certificate alerts for TLS-terminated routes

Prerequisites

• Kong Ingress Controller 3.x deployed in Kubernetes
• Kong Gateway exposed via a LoadBalancer or NodePort service
• A free Vigilmon account

Step 1: Find Your Kong Gateway External Address

Before adding monitors, confirm the external address Vigilmon will probe:

# Get the external IP or hostname of the Kong proxy service
kubectl get service -n kong kong-gateway-proxy -o wide

# Expected output
NAME                  TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)
kong-gateway-proxy    LoadBalancer   10.96.0.1       203.0.113.10     80:30080/TCP,443:30443/TCP

Use the EXTERNAL-IP value as the base for all Vigilmon monitors. If you're using a cloud load balancer, this will be a hostname — use that hostname directly.

Step 2: Monitor the Kong Proxy Health Endpoint

Kong exposes a status endpoint on port 8100 by default. This endpoint reports whether the proxy is healthy and processing traffic. Make it reachable externally (or add it to your ingress) and monitor it with Vigilmon:

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter the Kong status URL: http://203.0.113.10:8100/status.
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

If port 8100 is not publicly reachable, expose it through an internal service or add a KIC HTTPRoute pointing to it with appropriate authentication. Alternatively, proxy it through your existing infrastructure:

# Expose the admin/status API via an ingress rule (restrict by IP in production)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kong-status
  namespace: kong
  annotations:
    konghq.com/strip-path: "true"
spec:
  rules:
  - host: status.your-domain.com
    http:
      paths:
      - path: /status
        pathType: Prefix
        backend:
          service:
            name: kong-gateway-admin
            port:
              number: 8100

Then monitor https://status.your-domain.com/status.

Step 3: Monitor Critical Backend Routes

Each KIC Ingress or HTTPRoute resource creates a path that routes traffic to a backend service. Monitor the most critical routes directly so you know which service is down when an alert fires:

# List all ingress rules to find routes to monitor
kubectl get ingress -A -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOST:.spec.rules[*].host,PATH:.spec.rules[*].http.paths[*].path'

For each critical route, add a Vigilmon HTTP monitor:

1. Click Add Monitor → HTTP / HTTPS.
2. Enter the full route URL: https://api.your-domain.com/users/health.
3. Set the Expected HTTP status to 200.
4. Set the Check interval to 1 minute.
5. Click Save.

A route monitor tests the full path: DNS resolution → load balancer → Kong proxy → KIC routing logic → backend pod. A failure anywhere in this chain triggers the alert.

Step 4: Monitor TCP Ports for the Proxy Listener

HTTP monitors test routing logic but can miss lower-level failures where the gateway process is running but not accepting connections. Add TCP port monitors for ports 80 and 443:

1. Click Add Monitor → TCP Port.
2. Enter the gateway IP: 203.0.113.10.
3. Set Port to 443.
4. Set Check interval to 1 minute.
5. Click Save.

Repeat for port 80. TCP monitors are faster and cheaper to run than HTTP checks — they confirm the listener is open without parsing HTTP responses.

Step 5: Verify KIC CRD Sync with a Canary Route

KIC watches Kubernetes API for changes to Ingress, HTTPRoute, and KongPlugin resources. If the controller pod is running but the watch loop has stalled, new routes won't be applied and existing routes may silently fall behind configuration. A canary route lets you test that the sync loop is live:

Deploy a lightweight echo backend and a corresponding ingress rule:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: echo-canary
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: echo-canary
  template:
    metadata:
      labels:
        app: echo-canary
    spec:
      containers:
      - name: echo
        image: ealen/echo-server:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: echo-canary
  namespace: default
spec:
  selector:
    app: echo-canary
  ports:
  - port: 80
    targetPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echo-canary
  namespace: default
spec:
  ingressClassName: kong
  rules:
  - host: canary.your-domain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: echo-canary
            port:
              number: 80

Add a Vigilmon monitor for https://canary.your-domain.com/. If KIC's sync loop stalls after a CRD update or pod restart, this monitor surfaces the failure independently of your production routes.

Step 6: SSL Certificate Alerts for TLS-Terminated Routes

KIC handles TLS termination using Kubernetes Secret resources containing certificate data, often managed by cert-manager. Certificate renewal failures are silent until the certificate expires and clients start seeing TLS errors.

For each HTTPS route:

1. Open the HTTP monitor created in Step 3.
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

List all TLS-enabled routes to ensure full coverage:

kubectl get ingress -A -o jsonpath='{range .items[*]}{range .spec.tls[*]}{.hosts[*]}{"\n"}{end}{end}' | sort -u

Add a Vigilmon SSL monitor for every hostname returned.

Step 7: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, PagerDuty, or a webhook.
2. For the gateway health and TCP port monitors, set Consecutive failures before alert to 1 — a gateway outage affects all downstream services simultaneously.
3. For individual route monitors, set it to 2 to absorb rolling pod restarts where KIC briefly returns 503 while the backend pod comes back up.
4. Use maintenance windows during Kong or KIC upgrades:

# Open a maintenance window before a KIC upgrade
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "kong-health-monitor-id", "duration_minutes": 10}'

Summary

| Monitor | Target | What It Catches | |---|---|---| | Kong health endpoint | :8100/status | Controller crash, config failure | | Backend route | https://api.domain.com/route/health | Routing failure, backend down | | TCP port 443 | Gateway external IP | Listener down, LB misconfiguration | | Canary route | https://canary.domain.com/ | KIC sync loop stall | | SSL certificates | All TLS-enabled hostnames | cert-manager renewal failure |

Kong Ingress Controller is the gateway through which all external traffic enters your cluster — which makes it both the most impactful component to monitor and the one where failures have the widest blast radius. With Vigilmon watching the health endpoint, individual routes, TCP listeners, and SSL certificates, you have external visibility that survives even a complete KIC crash.