tutorial

Monitoring Kubernetes Dashboard with Vigilmon: UI Availability, API Server Connectivity, RBAC Health & TLS Certificate Alerts

How to monitor Kubernetes Dashboard with Vigilmon — UI availability checks, API server connectivity, RBAC misconfiguration detection, TLS certificate expiry, and metrics-server health monitoring.

Kubernetes Dashboard is the official web-based UI for managing Kubernetes clusters — providing a visual interface for deploying applications, viewing resource status, inspecting logs, and managing namespaces without touching the command line. When the Dashboard pod crashes, platform teams lose visibility into cluster state and junior engineers can no longer perform routine operations. When the metrics-server integration fails, CPU and memory graphs go blank and capacity planning becomes guesswork. When RBAC is misconfigured, users see 403 errors or — worse — have unintended access to resources they shouldn't see. Vigilmon gives you external visibility into Dashboard availability, TLS validity, API server connectivity, and the metrics pipeline that drives Dashboard's resource graphs.

What You'll Build

  • HTTP monitor on the Dashboard UI endpoint to detect pod crashes and service outages
  • SSL certificate monitor for the Dashboard's HTTPS listener
  • TCP monitors to verify API server connectivity from the Dashboard namespace
  • HTTP monitors on the metrics-server endpoint that powers Dashboard resource graphs
  • Alerting runbook mapping Dashboard failure modes to the right Kubernetes resources to inspect

Prerequisites

  • A Kubernetes cluster with Kubernetes Dashboard installed (via Helm or the official manifest)
  • Dashboard exposed via NodePort, LoadBalancer, or Ingress
  • A free account at vigilmon.online

Step 1: Understand Kubernetes Dashboard's Health Surface

Kubernetes Dashboard runs as a Deployment in the kubernetes-dashboard namespace. Its health depends on multiple components:

# Check Dashboard pod status
kubectl get pods -n kubernetes-dashboard
# Expected: kubernetes-dashboard-* Running 1/1
# Also: dashboard-metrics-scraper-* Running 1/1

# Check Dashboard service
kubectl get svc -n kubernetes-dashboard
# Look for: kubernetes-dashboard (NodePort or LoadBalancer)

# Check metrics-server (required for CPU/memory graphs)
kubectl get pods -n kube-system -l k8s-app=metrics-server
kubectl top nodes  # fails if metrics-server is unhealthy

The key failure points to monitor externally are:

  1. The Dashboard HTTP/HTTPS endpoint (UI reachability)
  2. The TLS certificate on the Dashboard service
  3. The metrics-server health (drives Dashboard resource graphs)
  4. The Dashboard's ability to reach the API server

Step 2: Monitor the Dashboard UI Endpoint

The most important check is whether the Dashboard UI is reachable. Dashboard by default serves on HTTPS with a self-signed certificate or a cert-manager-issued certificate:

# Get the Dashboard's external URL
kubectl get svc kubernetes-dashboard -n kubernetes-dashboard
# For NodePort: https://<node-ip>:<node-port>
# For LoadBalancer: https://<external-ip>

# Test the Dashboard login page
curl -k https://dashboard.example.com/
# Expected: 200 OK with HTML login page
  1. Log in to Vigilmon → Add Monitor → HTTP.
  2. URL: https://dashboard.example.com/ (your Dashboard's public URL).
  3. Check interval: 60 seconds.
  4. Response timeout: 10 seconds.
  5. Expected status: 200.
  6. Keyword: kubernetes-dashboard (present in the HTML title).
  7. Label: Kubernetes Dashboard UI.
  8. Click Save.

Self-signed certificates: If Dashboard uses a self-signed certificate and your monitor returns a TLS error, configure your monitor to skip certificate verification (Vigilmon → monitor settings → Ignore SSL errors). Add a separate SSL Certificate monitor (Step 3) to track expiry regardless.

Step 3: Monitor the TLS Certificate

Dashboard's HTTPS endpoint requires a valid TLS certificate. Expiry causes browser warnings and breaks API-driven Dashboard integrations:

# Check the Dashboard TLS secret
kubectl get secret kubernetes-dashboard-certs -n kubernetes-dashboard -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -dates
# notAfter=... shows when the cert expires
  1. Add Monitor → SSL Certificate.
  2. Domain: dashboard.example.com.
  3. Alert when expiry is within: 30 days.
  4. Alert again: 14 days, 7 days, 3 days, 1 day.
  5. Click Save.

cert-manager integration: If Dashboard's certificate is managed by cert-manager, renewal failures are silent until the certificate actually expires. The 30-day Vigilmon alert gives you time to run kubectl describe certificaterequest -n kubernetes-dashboard and identify any renewal failures before they affect users.

Step 4: Monitor the Metrics-Server (Dashboard Resource Graphs)

Kubernetes Dashboard fetches CPU and memory data from the metrics-server. When metrics-server is unavailable, Dashboard resource graphs go blank and kubectl top commands fail. If metrics-server is exposed externally or reachable via an ingress, monitor it directly:

# Verify metrics-server is running
kubectl get pods -n kube-system -l k8s-app=metrics-server

# Check the metrics-server API endpoint (from within the cluster)
kubectl get --raw /apis/metrics.k8s.io/v1beta1/nodes | jq '.items | length'

# If you expose metrics-server health externally
curl https://metrics.example.com/readyz

If you expose a health probe externally:

  1. Add Monitor → HTTP.
  2. URL: https://metrics.example.com/readyz.
  3. Check interval: 2 minutes.
  4. Expected status: 200.
  5. Label: metrics-server (Dashboard graphs).
  6. Click Save.

Alternatively, create a Kubernetes CronJob that checks metrics availability and alerts via a webhook:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: metrics-server-check
  namespace: monitoring
spec:
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: monitoring-reader
          containers:
            - name: checker
              image: bitnami/kubectl:latest
              command:
                - /bin/sh
                - -c
                - |
                  RESULT=$(kubectl get --raw /apis/metrics.k8s.io/v1beta1/nodes 2>&1)
                  if echo "$RESULT" | grep -q "Error\|could not"; then
                    echo "ALERT: metrics-server unavailable — Dashboard graphs will be blank"
                    exit 1
                  fi
          restartPolicy: Never

Step 5: Monitor the Dashboard's API Server Connectivity

Dashboard communicates directly with the Kubernetes API server to list pods, deployments, and events. If the API server becomes unreachable from the Dashboard namespace (due to network policy, API server overload, or misconfiguration), Dashboard shows errors on every resource page:

# Verify API server is reachable from the Dashboard namespace
kubectl exec -n kubernetes-dashboard deployment/kubernetes-dashboard -- \
  wget -qO- https://kubernetes.default.svc.cluster.local/healthz
# Expected: ok

For external monitoring, add a TCP monitor on the API server port:

  1. Add Monitor → TCP.
  2. Host: api.example.com (your API server's external hostname or load balancer).
  3. Port: 6443.
  4. Check interval: 60 seconds.
  5. Label: Kubernetes API server TCP (6443).
  6. Click Save.

A TCP failure on port 6443 while the Dashboard UI HTTP monitor also fires indicates an API server reachability problem rather than a Dashboard pod failure.

Step 6: Monitor for RBAC and Authentication Errors

Dashboard uses RBAC to control what users can see. Misconfigured ClusterRoleBindings or deleted ServiceAccount tokens cause 401/403 errors on every API call Dashboard makes. While Vigilmon cannot directly check RBAC, you can expose a Dashboard health endpoint or use a synthetic test:

# Create a test ServiceAccount with read-only Dashboard access
kubectl create serviceaccount dashboard-health-check -n kubernetes-dashboard
kubectl create clusterrolebinding dashboard-health-check \
  --clusterrole=view \
  --serviceaccount=kubernetes-dashboard:dashboard-health-check

# Generate a token and test Dashboard access
TOKEN=$(kubectl create token dashboard-health-check -n kubernetes-dashboard)
curl -k -H "Authorization: Bearer $TOKEN" https://dashboard.example.com/api/v1/pod/
# Expected: 200 OK with pod list JSON (not 401 or 403)

If you can expose this synthetic check via a small health service:

  1. Add Monitor → HTTP.
  2. URL: https://dashboard.example.com/api/v1/pod/ (with bearer token auth configured).
  3. Expected status: 200.
  4. Label: Dashboard API RBAC health.
  5. Click Save.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, configure alert channels and response runbooks:

| Monitor | Trigger | Immediate action | |---|---|---| | Dashboard UI HTTP | Non-200 or timeout | Check pod: kubectl get pods -n kubernetes-dashboard; check logs: kubectl logs -n kubernetes-dashboard -l app.kubernetes.io/name=kubernetes-dashboard | | Dashboard TLS certificate | < 30 days | Check cert-manager: kubectl describe certificate -n kubernetes-dashboard; renew manually if needed | | metrics-server health | Non-200 or CronJob failure | Check pod: kubectl get pods -n kube-system -l k8s-app=metrics-server; restart: kubectl rollout restart deployment/metrics-server -n kube-system | | API server TCP (6443) | Connection refused | Check API server health from a node; check control plane pod status | | Dashboard API RBAC | 401 or 403 | Check ServiceAccount token: kubectl get secret -n kubernetes-dashboard; verify ClusterRoleBinding exists |

Alert grouping: Create a kubernetes-dashboard monitor group. When Dashboard becomes fully unavailable (pod crash + API server unreachable), multiple monitors fire — the group view immediately shows the scope of the incident.

Common Kubernetes Dashboard Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon signal | |---|---| | Dashboard pod OOMKilled or crash-loops | HTTP monitor fires with connection refused or 502 | | TLS certificate expires | SSL monitor fires at 30-day threshold; HTTP monitor fires on expiry day with TLS error | | metrics-server pod crash | Resource graphs go blank; metrics-server health monitor fires | | API server overloaded (high latency) | Dashboard HTTP monitor shows slow response time; requests timeout | | RBAC ClusterRoleBinding deleted | RBAC health monitor returns 403; pod list pages show errors | | Ingress misconfiguration after upgrade | HTTP monitor fires; TCP on 6443 stays green (isolating the ingress layer) | | Node affinity change evicts Dashboard pod | HTTP monitor fires; pod transitions to Pending state | | Dashboard namespace NetworkPolicy too restrictive | API server TCP monitor stays green but Dashboard shows connection errors | | cert-manager renewal failure | SSL certificate monitor fires at 30-day threshold before UI breaks | | Service account token rotation breaks login | RBAC health monitor returns 401 on next check |

Kubernetes Dashboard provides essential visual cluster management — but when it goes down, teams lose the shared view that underpins operational confidence for non-CLI users. Vigilmon gives you external visibility into Dashboard availability, certificate validity, metrics-server health, and API server reachability. When a pod crash or TLS expiry takes the Dashboard offline, Vigilmon alerts you before the next person opens a browser tab and sees a blank screen.

Start monitoring your Kubernetes Dashboard in under 5 minutes — register free at vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles