Monitoring Rancher Kubernetes Management with Vigilmon

Rancher is the leading open-source Kubernetes management platform, used by teams running SUSE Rancher (formerly Rancher Labs) to manage multi-cluster Kubernetes deployments from a single control plane. When the Rancher UI goes down, operators lose visibility into every cluster it manages. When the Kubernetes API server on port 6443 becomes unreachable, kubectl commands stop working across your entire fleet. Vigilmon gives you continuous uptime monitoring for the Rancher web UI, its /healthz liveness probe, /ping readiness check, SSL certificates, and TCP connectivity to the Kubernetes API.

What You'll Set Up

HTTP uptime monitor for the Rancher web UI
/healthz Kubernetes-style liveness probe monitoring
/ping readiness check monitoring
SSL certificate expiry alerts for the Rancher TLS certificate
TCP port monitoring for the Kubernetes API server (port 6443)

Prerequisites

Rancher 2.6+ running in a Docker container or on an RKE/K3s cluster
Rancher web UI accessible over HTTPS (Rancher enforces HTTPS by default)
A free Vigilmon account

Step 1: Monitor the Rancher Web UI

The Rancher web UI is your primary operational surface for every Kubernetes cluster under management. Its availability depends on the Rancher server pod, the ingress controller, and the underlying etcd data store.

Log in to vigilmon.online and click Add Monitor.
Set Type to HTTP / HTTPS.
Enter your Rancher URL: https://rancher.yourdomain.com
Set Check interval to 1 minute.
Set Expected HTTP status to 200.
Click Save.

Rancher's root path serves the React SPA and redirects to the login page if you're unauthenticated. A 200 or 302 response confirms the server is healthy. If you want to probe more specifically, use the /dashboard/ path which loads the main application shell:

https://rancher.yourdomain.com/dashboard/

Add a keyword check for Rancher to confirm you're getting the actual Rancher frontend rather than an nginx 502 error page from a crashed Rancher pod.

Step 2: Monitor the `/healthz` Liveness Probe

Rancher exposes a Kubernetes-style /healthz endpoint that returns ok when the Rancher server is alive and its internal health checks pass. This is the same pattern used by Kubernetes API server liveness probes and is the most reliable programmatic health signal Rancher provides.

In Vigilmon, click Add Monitor → HTTP / HTTPS.
Set the URL to: https://rancher.yourdomain.com/healthz
Set Expected HTTP status to 200.
Enable Keyword check and enter ok.
Set Check interval to 1 minute.
Click Save.

The /healthz endpoint bypasses authentication and is designed specifically for external health probing. If it returns non-200 or an unexpected body, the Rancher server process is unhealthy even if the web UI appears partially functional.

You can verify this endpoint manually:

curl -sk https://rancher.yourdomain.com/healthz
# Expected: ok

Step 3: Monitor the `/ping` Readiness Check

While /healthz is a liveness probe (is the process alive?), Rancher's /ping endpoint functions as a readiness check — it confirms the server is ready to handle requests, including authentication, API calls, and cluster operations.

In Vigilmon, click Add Monitor → HTTP / HTTPS.
Set the URL to: https://rancher.yourdomain.com/ping
Set Expected HTTP status to 200.
Enable Keyword check and enter pong.
Set Check interval to 1 minute.
Click Save.

curl -sk https://rancher.yourdomain.com/ping
# Expected: pong

Having both /healthz and /ping monitors gives you differentiated alerting: a liveness failure without a readiness failure indicates a partially degraded state, while both failing simultaneously indicates a complete Rancher server outage. This distinction helps incident responders triage faster.

Step 4: SSL Certificate Alerts for the Rancher TLS Certificate

Rancher enforces HTTPS for all connections — there is no HTTP fallback. A certificate expiry or renewal failure makes the entire Rancher UI inaccessible to every operator and breaks all kubectl contexts that use the Rancher-generated kubeconfig.

Open the HTTPS monitor created in Step 1.
Enable Monitor SSL certificate under the SSL section.
Set Alert when certificate expires in less than 21 days.
Click Save.

Rancher supports three certificate sources, each with different renewal behavior:

Rancher-generated self-signed certificates — rotated automatically by Rancher; monitor for rotation failures:

kubectl get secret tls-rancher -n cattle-system -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -dates

Let's Encrypt certificates — renewed automatically via cert-manager; check the cert-manager renewal logs if Vigilmon fires:

kubectl get certificates -n cattle-system
kubectl describe certificate tls-rancher-ingress -n cattle-system

Bring-your-own certificates — manual rotation required; the 21-day Vigilmon alert window is essential since there's no automated renewal:

# Update BYO certificate in Rancher
kubectl create secret tls tls-rancher-ingress \
  --cert=/path/to/fullchain.pem \
  --key=/path/to/privkey.pem \
  -n cattle-system --dry-run=client -o yaml | kubectl apply -f -

Step 5: TCP Port Monitoring for the Kubernetes API (Port 6443)

The Kubernetes API server runs on port 6443 in every cluster Rancher manages, including the local cluster where Rancher itself runs. TCP connectivity to port 6443 is required for kubectl commands, Rancher's cluster agents, and any CI/CD system that interacts with Kubernetes directly.

In Vigilmon, click Add Monitor → TCP Port.
Set Host to your Rancher server hostname or the Kubernetes API endpoint.
Set Port to 6443.
Set Check interval to 1 minute.
Click Save.

For multi-cluster Rancher deployments, add a TCP port monitor for the Kubernetes API of each downstream cluster you want to monitor:

| Cluster | API endpoint | Port | |---|---|---| | Local (Rancher host) | rancher.yourdomain.com | 6443 | | Production cluster | k8s-prod.yourdomain.com | 6443 | | Staging cluster | k8s-staging.yourdomain.com | 6443 |

A TCP failure on port 6443 while the Rancher web UI is still responding typically indicates a network policy change, a kube-apiserver pod crash, or an etcd quorum failure — all critical issues requiring immediate investigation.

Step 6: Configure Alert Channels

Go to Alert Channels in Vigilmon and add Slack, email, or a webhook.
Set Consecutive failures before alert to 2 on the Rancher UI monitor — Rancher pod restarts during upgrades typically complete within 30–60 seconds and cause a brief gap in availability.
For the /healthz, /ping, and TCP port 6443 monitors, set Consecutive failures to 1 — these endpoints have no known transient failure modes and a single failure is significant.
Route Kubernetes API (port 6443) alerts to your on-call channel with highest priority — a Kubernetes API outage means no deployments, no autoscaling, and no self-healing for every workload in the cluster.

Use Maintenance windows during Rancher upgrades:

# Suppress alerts during Rancher upgrade (typically 5-15 minutes)
curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "abc123", "duration_minutes": 20}'

# Perform Rancher upgrade (Helm-based)
helm upgrade rancher rancher-latest/rancher \
  --namespace cattle-system \
  --set hostname=rancher.yourdomain.com \
  --set replicas=3

Summary

| Monitor | Target | What It Catches | |---|---|---| | Web UI | https://rancher.yourdomain.com | Rancher pod crash, ingress failure | | Liveness probe | /healthz | Rancher server internal health failure | | Readiness check | /ping | Server degraded, not ready for requests | | SSL certificate | Rancher domain | Certificate expiry, renewal failure | | Kubernetes API | TCP :6443 | API server crash, etcd failure, network issue |

Rancher gives you a single pane of glass for your entire Kubernetes fleet — and that means Rancher itself is a single point of failure for your operational visibility. With Vigilmon watching every health signal Rancher exposes plus the Kubernetes API TCP port, you'll detect Rancher problems before your developers notice that kubectl has stopped working.