Monitoring MicroK8s Clusters with Vigilmon

MicroK8s is Canonical's lightweight, single-package Kubernetes distribution — installed in seconds via snap, no kubeadm required. It's the go-to Kubernetes for Raspberry Pis, edge nodes, developer laptops, and small-scale production servers. But MicroK8s has no built-in external uptime monitoring: if a node goes silent, there's no alert unless you're watching. Vigilmon fills that gap with HTTP uptime checks, TCP port monitoring, SSL certificate alerts, and cron heartbeats — running externally, 24/7, for every MicroK8s cluster you manage.

What You'll Set Up

• HTTP uptime monitors for services and ingress endpoints on MicroK8s
• TCP port checks for the MicroK8s API server
• CronJob heartbeat monitoring for scheduled workloads
• SSL certificate expiry alerts for ingress TLS
• Integration with MicroK8s add-ons (ingress, cert-manager)

Prerequisites

• MicroK8s installed and running (microk8s status --wait-ready)
• At least one service or ingress exposed over HTTP/HTTPS
• A free Vigilmon account

Step 1: Enable the Ingress Add-on and Monitor Endpoints

MicroK8s ships with an optional ingress controller. Enable it if you haven't already:

microk8s enable ingress

This deploys an nginx-based ingress on the host's port 80 and 443. Add a Vigilmon HTTP monitor for each ingress-exposed service:

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter your ingress URL: https://api.yourdomain.com.
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

List all ingresses in your MicroK8s cluster:

microk8s kubectl get ingress -A
# NAMESPACE   NAME      CLASS    HOSTS                 ADDRESS        PORTS
# default     api-ing   public   api.yourdomain.com    10.0.0.5       80, 443

For services accessed directly via a NodePort (common on single-node MicroK8s setups):

microk8s kubectl get services -A
# NAMESPACE   NAME    TYPE       CLUSTER-IP     EXTERNAL-IP   PORT(S)          AGE
# default     api     NodePort   10.152.183.50  <none>        8080:30080/TCP   2d

Monitor http://<microk8s-host-ip>:30080 for NodePort services.

Step 2: Add Health Endpoints to MicroK8s Workloads

Kubernetes readiness and liveness probes run inside the cluster. Vigilmon's external probe validates the full path from the internet to your pod. Add a health route to each monitored service:

Python / Django

# urls.py
from django.http import JsonResponse
urlpatterns = [
    path('health/', lambda r: JsonResponse({'status': 'ok'})),
    # ...
]

Go / Gin

r.GET("/healthz", func(c *gin.Context) {
    c.JSON(200, gin.H{"status": "ok"})
})

Node.js

app.get('/healthz', (req, res) => res.json({ status: 'ok' }));

Also configure Kubernetes probes in your deployment manifest — they catch pod-level failures before Vigilmon's external check:

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 10
  periodSeconds: 30
readinessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 10

Apply the manifest:

microk8s kubectl apply -f deployment.yaml

Step 3: Monitor the MicroK8s API Server

The MicroK8s API server runs on port 16443 by default (not 6443, to avoid conflicting with a system-level Kubernetes installation). Add a TCP monitor:

1. In Vigilmon, click Add Monitor → TCP Port.
2. Set Host to your MicroK8s node IP or hostname.
3. Set Port to 16443.
4. Set Check interval to 1 minute.
5. Click Save.

Confirm the API server port on your node:

microk8s kubectl cluster-info
# Kubernetes control plane is running at https://192.168.100.5:16443

For multi-node MicroK8s clusters (using microk8s add-node), add TCP monitors for each control plane node. A TCP failure here means microk8s kubectl commands will fail — knowing this externally is essential for edge and IoT deployments where the node may be unattended.

Step 4: CronJob Heartbeat Monitoring

MicroK8s CronJobs that fail or are evicted don't surface as alerts unless you're actively monitoring the cluster. Vigilmon's heartbeat monitor detects silent failures:

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set Expected ping interval to match the CronJob schedule (e.g. 1440 minutes for a daily job).
3. Copy the heartbeat URL: https://vigilmon.online/heartbeat/abc123.

Update your CronJob manifest:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: daily-backup
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: backup
              image: backup-tool:latest
              command:
                - /bin/sh
                - -c
                - |
                  /scripts/backup.sh && \
                  wget -qO- https://vigilmon.online/heartbeat/abc123

Apply and verify:

microk8s kubectl apply -f cronjob.yaml
microk8s kubectl get cronjobs
# NAME           SCHEDULE    SUSPEND   ACTIVE   LAST SCHEDULE   AGE
# daily-backup   0 2 * * *   False     0        14h             3d

If the CronJob fails to complete or the pod is evicted before finishing, no ping is sent and Vigilmon alerts you after the expected interval.

Step 5: Enable and Monitor SSL Certificates

Enable the MicroK8s cert-manager add-on for automatic TLS certificate management:

microk8s enable cert-manager

Create a ClusterIssuer for Let's Encrypt:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: you@yourdomain.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: public

microk8s kubectl apply -f clusterissuer.yaml

Add SSL monitoring in Vigilmon for each ingress TLS endpoint:

1. Open the HTTP monitor for your ingress URL.
2. Enable Monitor SSL certificate.
3. Set Alert when certificate expires in less than 21 days.
4. Click Save.

Check certificate status on the cluster:

microk8s kubectl get certificates -A
# NAMESPACE   NAME       READY   SECRET         AGE
# default     api-cert   True    api-tls-cert   10d

A READY: False combined with a Vigilmon SSL expiry alert means cert-manager renewal has stalled. Manually trigger re-issuance:

microk8s kubectl delete certificaterequest -n default --all
# cert-manager will create a new request automatically

Step 6: Configure Alert Channels

1. In Vigilmon, go to Alert Channels and add Slack, email, PagerDuty, or a webhook.
2. Set Consecutive failures before alert to 2 — MicroK8s on constrained hardware (Raspberry Pi, edge nodes) may have momentary slowdowns that cause a single probe to time out.
3. For planned MicroK8s upgrades (via snap refresh microk8s), open a maintenance window:

# Before upgrade — suppress alerts for 10 minutes
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "abc123", "duration_minutes": 10}'

# Upgrade MicroK8s
sudo snap refresh microk8s --channel=1.30/stable

# Verify cluster is healthy
microk8s status --wait-ready
microk8s kubectl get nodes

For edge and IoT deployments where nodes may be physically unreachable, configure alert escalation in Vigilmon to page on-call personnel after 3 consecutive failures rather than 2.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP uptime | https://api.yourdomain.com/healthz | Pod crash, ingress misconfiguration | | TCP port | Node IP :16443 | API server down, node offline | | Cron heartbeat | Vigilmon heartbeat URL | CronJob failure or missed schedule | | SSL certificate | Ingress TLS endpoint | cert-manager renewal failure |

MicroK8s makes Kubernetes accessible on hardware that full Kubernetes distributions can't run on — from Raspberry Pis at the edge to developer laptops. But lightweight doesn't mean no monitoring. Vigilmon provides the external, always-on uptime layer that MicroK8s clusters need: catching crashes, API server outages, and expired certificates before they become incidents, even when no one is watching the terminal.