tutorial

Monitoring Kubescape with Vigilmon

Kubescape is the CNCF Kubernetes security posture management tool — here's how to monitor compliance scan results, track risk scores, alert on control failures, and keep your CI/CD pipeline healthy with Vigilmon.

Kubescape is a CNCF-graduated Kubernetes security posture management (KSPM) tool that scans your clusters against NSA/CISA, CIS, MITRE ATT&CK, and custom frameworks. It's invaluable for catching misconfigurations before they become incidents — but only if you're watching the scan results and acting on them. Vigilmon adds the uptime and alerting layer that ensures your Kubescape operators, API endpoints, and CI/CD integrations are continuously healthy.

What You'll Set Up

  • Vigilmon HTTP checks on the Kubescape in-cluster operator API
  • Compliance score and risk-score tracking via Prometheus metrics
  • Control failure alerting for critical NSA/CISA or CIS benchmark items
  • CI/CD health heartbeat monitoring for scheduled scan pipelines
  • SSL certificate monitoring for the Kubescape cloud dashboard endpoint

Prerequisites

  • Kubernetes cluster (1.24+) with Kubescape operator installed via Helm
  • kubectl and helm CLI tools configured
  • A free Vigilmon account
  • Optional: Prometheus and Grafana for metrics scraping

Step 1: Install the Kubescape Operator

Install Kubescape into your cluster using the official Helm chart:

helm repo add kubescape https://kubescape.github.io/helm-charts
helm repo update

helm upgrade --install kubescape kubescape/kubescape-operator \
  --namespace kubescape \
  --create-namespace \
  --set clusterName=$(kubectl config current-context) \
  --set account=<YOUR_KUBESCAPE_ACCOUNT_ID>

Verify all operator components are running:

kubectl get pods -n kubescape
# NAME                                        READY   STATUS    RESTARTS   AGE
# kubescape-548b7f5d9f-8rqzl                 1/1     Running   0          2m
# kubevuln-6d9f4c8b9-xj2nk                   1/1     Running   0          2m
# operator-7bdc7f9d9f-p4mnc                  1/1     Running   0          2m
# storage-5c78c9d8c8-kqvbr                   1/1     Running   0          2m

Step 2: Expose the Kubescape API Service

The Kubescape operator exposes a REST API for retrieving scan results. Port-forward it locally for testing, or expose it via an ingress for external Vigilmon checks:

# Port-forward for local testing
kubectl port-forward -n kubescape svc/kubescape 8080:8080

Test the API health endpoint:

curl http://localhost:8080/v1/health
# {"status":"ok","version":"v2.9.0"}

For production monitoring, expose the service via an internal load balancer or ingress:

# kubescape-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kubescape-api
  namespace: kubescape
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: kubescape.internal.yourdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kubescape
            port:
              number: 8080

Apply it:

kubectl apply -f kubescape-ingress.yaml

Step 3: Add Vigilmon Uptime Checks

With the Kubescape API accessible, configure Vigilmon monitors:

3a. Operator Health Check

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter the URL: https://kubescape.internal.yourdomain.com/v1/health
  4. Set Check interval to 2 minutes.
  5. Set Expected HTTP status to 200.
  6. Set Expected response body contains to "status":"ok".
  7. Click Save.

3b. Scan Results API Check

Add a second monitor to confirm scan result data is available:

  1. Add another monitor with URL: https://kubescape.internal.yourdomain.com/v1/postureScan
  2. Set Expected HTTP status to 200.
  3. Set Check interval to 5 minutes.

If this endpoint stops returning 200, your operator may have lost connectivity to the Kubescape cloud backend or its in-cluster storage.

Step 4: Expose Prometheus Metrics

Kubescape exposes Prometheus metrics via the operator. Scrape them to track compliance scores over time:

# Check available metrics
curl http://localhost:8080/metrics | grep kubescape

Key metrics to track:

| Metric | Description | |--------|-------------| | kubescape_resources_counter | Total Kubernetes resources scanned | | kubescape_risk_score | Cluster risk score (lower is safer) | | kubescape_failed_controls_total | Number of controls that failed the scan | | kubescape_all_scanned_namespaces | Namespaces covered by the last scan |

Add a Prometheus scrape config:

# prometheus.yml snippet
scrape_configs:
  - job_name: 'kubescape'
    static_configs:
      - targets: ['kubescape.kubescape.svc.cluster.local:8080']
    metrics_path: /metrics
    scrape_interval: 60s

Step 5: Create a Compliance Score Alerting Script

Write a script that checks the current risk score and alerts Vigilmon if it exceeds your threshold:

#!/usr/bin/env python3
# kubescape_score_check.py
import requests
import sys

KUBESCAPE_API = "https://kubescape.internal.yourdomain.com"
VIGILMON_HEARTBEAT = "https://vigilmon.online/api/v1/heartbeat/<YOUR_HEARTBEAT_TOKEN>"
RISK_THRESHOLD = 30  # fail if risk score above 30%

def main():
    try:
        resp = requests.get(f"{KUBESCAPE_API}/v1/postureScan", timeout=10)
        resp.raise_for_status()
        data = resp.json()

        risk_score = data.get("riskScore", 100)
        failed_controls = data.get("failedControls", [])
        critical_failures = [c for c in failed_controls if c.get("severity") == "Critical"]

        if risk_score > RISK_THRESHOLD or len(critical_failures) > 0:
            print(f"ALERT: risk_score={risk_score}, critical_failures={len(critical_failures)}")
            sys.exit(1)

        # Ping Vigilmon heartbeat to confirm scan pipeline is healthy
        requests.get(VIGILMON_HEARTBEAT, timeout=5)
        print(f"OK: risk_score={risk_score}, critical_failures=0")

    except requests.RequestException as e:
        print(f"ERROR: {e}")
        sys.exit(1)

if __name__ == "__main__":
    main()

Schedule this as a Kubernetes CronJob:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: kubescape-score-monitor
  namespace: kubescape
spec:
  schedule: "0 */6 * * *"  # every 6 hours
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: score-checker
            image: python:3.11-slim
            command: ["python", "/scripts/kubescape_score_check.py"]
            volumeMounts:
            - name: scripts
              mountPath: /scripts
          volumes:
          - name: scripts
            configMap:
              name: kubescape-monitor-scripts
          restartPolicy: OnFailure

Step 6: CI/CD Integration Health Monitoring

If you run Kubescape scans in your CI/CD pipeline (GitHub Actions, GitLab CI, etc.), add a Vigilmon heartbeat to verify the pipeline is firing on schedule:

# .github/workflows/kubescape-scan.yml
name: Kubescape Security Scan

on:
  schedule:
    - cron: '0 2 * * *'  # daily at 2am UTC
  push:
    branches: [main]

jobs:
  kubescape-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Kubescape scan
        uses: kubescape/github-action@main
        with:
          format: "pretty-printer"
          threshold: 30  # fail if risk score above 30
          frameworks: "NSA,MITRE"

      - name: Ping Vigilmon heartbeat on success
        if: success()
        run: |
          curl -s "${{ secrets.VIGILMON_HEARTBEAT_URL }}" > /dev/null

Set up the Vigilmon heartbeat monitor:

  1. In Vigilmon, click Add Monitor → Cron / Heartbeat.
  2. Set the expected interval to 1 day.
  3. Set the grace period to 2 hours.
  4. Copy the heartbeat URL and add it as VIGILMON_HEARTBEAT_URL in your repository secrets.

If your pipeline skips or fails silently, Vigilmon will alert you within 2 hours of the missed heartbeat.

Step 7: Monitor Critical Control Failures

Kubescape maps scan failures to individual security controls. Track critical ones via the API:

# List all failed controls with severity
curl -s "https://kubescape.internal.yourdomain.com/v1/postureScan" \
  | jq '.failedControls[] | select(.severity=="Critical") | {name, remediation}'

For controls that directly map to compliance mandates (e.g., C-0021: Ensure that the API server admission control plugin AlwaysPullImages is set), set up targeted Vigilmon keyword checks on your scan result export endpoint:

  1. Add a monitor of type HTTP / HTTPS.
  2. Point it at your scan result export (e.g., a webhook or S3 pre-signed URL).
  3. Set Expected response body does NOT contain to "severity":"Critical".

This gives you an instant alert the moment a new critical control failure appears in scan output.

Alerting and Notifications

Configure Vigilmon alert channels in Settings → Notifications:

  • Email: immediate alert on operator health failures
  • Slack: post to #security-alerts on risk score threshold breaches
  • PagerDuty: page on-call for critical control failures in production clusters
  • Webhooks: push scan failure data to your SIEM or ticketing system

Set escalation so that if the operator health check fails for more than 5 minutes, it pages the on-call security engineer automatically.

Troubleshooting

Operator pods CrashLoopBackOff

kubectl logs -n kubescape deployment/kubescape --previous

Common causes: missing account ID, network policy blocking egress to api.armosec.io.

Scan returns empty results

kubectl describe kubescape -n kubescape

Check that the KubescapeScheduler CRD has a valid scan schedule and that RBAC allows the operator to list all cluster resources.

Risk score not updating The operator caches results. Force a new scan:

kubectl annotate kubescapescheduler -n kubescape kubescape-scheduler \
  kubescape.io/trigger-scan=$(date +%s) --overwrite

Summary

You now have comprehensive Kubescape monitoring with Vigilmon:

  • Operator health checks every 2 minutes to catch crashes or network failures
  • Compliance score checks via the posture scan API
  • CI/CD heartbeat monitoring to ensure daily scans never silently skip
  • Critical control failure alerts using keyword-based response body checks
  • Prometheus metrics for risk score trend dashboards

Kubescape gives you the security signal — Vigilmon ensures that signal keeps flowing even when your cluster has problems.

Ready to start monitoring your Kubescape deployment? Create a free Vigilmon account and add your first check in under two minutes.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles