Monitoring Tekton with Vigilmon: Pipeline Controller Health, Dashboard Availability, Heartbeat Checks & SSL Certificates

Tekton is the Kubernetes-native CI/CD framework powering build, test, and deployment pipelines for many engineering teams. Unlike hosted CI services, Tekton runs entirely in your cluster — which means its health depends on your Kubernetes control plane, the Tekton controllers, and whatever storage and networking your pipeline tasks consume. When a Tekton controller crashes or a pipeline silently stops running, you may not notice until a deployment is hours behind schedule. Vigilmon gives you external visibility into the Tekton Dashboard, controller metrics, pipeline completion, and SSL certificates so you catch failures before they delay releases.

What You'll Build

• A monitor on the Tekton Dashboard web UI availability
• A metrics endpoint check for the Tekton Pipelines controller
• A heartbeat monitor confirming scheduled pipelines actually complete
• A Tekton Triggers availability check
• SSL certificate monitoring for the Tekton Dashboard

Prerequisites

• A running Tekton Pipelines installation in Kubernetes (v0.44+)
• Tekton Dashboard deployed and exposed at a public or VPN-accessible URL
• A free account at vigilmon.online

Step 1: Verify the Tekton Dashboard is Accessible

The Tekton Dashboard is the primary interface for inspecting pipeline runs, task runs, and trigger events. Its availability is a good proxy for the overall Tekton deployment health because the Dashboard connects to the Kubernetes API server to fetch pipeline state.

curl -I https://tekton.example.com

A running Dashboard returns 200 OK with HTML content. If you have authentication (e.g., OAuth2 proxy or ingress auth), verify the check URL returns a predictable status:

• Unauthenticated access with auth proxy enabled → 401 or 302 redirect to login
• Authenticated internal access → 200

Note which status your deployment returns — you will configure Vigilmon to expect that exact code.

Step 2: Create a Vigilmon HTTP Monitor for the Tekton Dashboard

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://tekton.example.com (your Dashboard URL).
3. Check interval: 60 seconds.
4. Response timeout: 15 seconds.
5. Expected status: 200 (or 302/401 if behind an auth proxy).
6. Label: Tekton Dashboard.
7. Click Save.

The Dashboard going down typically indicates the Tekton Dashboard Deployment has crashed or been evicted — a signal to check pod status in the tekton-pipelines namespace.

Step 3: Monitor the Tekton Pipelines Controller via kubectl Proxy

The Tekton Pipelines controller exposes a /metrics endpoint (default port 9090) inside the cluster. To monitor it externally via Vigilmon, expose it through kubectl proxy on a jump host, or configure an Ingress with authentication for the metrics port.

Option A — kubectl proxy (simplest for internal access):

On a host that has kubectl access to the cluster, run:

kubectl proxy --port=8001 &

Then add a Vigilmon monitor:

1. Add Monitor → HTTP.
2. URL: http://your-jump-host:8001/api/v1/namespaces/tekton-pipelines/pods/https:tekton-pipelines-controller-<hash>:9090/proxy/metrics.
3. Check interval: 5 minutes.
4. Expected status: 200.
5. Keyword: tekton_ (Tekton prefixes all controller metrics).
6. Label: Tekton Controller Metrics.

Option B — Ingress with auth (recommended for production):

Expose the metrics port behind your ingress controller at https://tekton-metrics.example.com/metrics with basic auth or token auth, then add the monitor pointing to that URL.

Either option confirms the Tekton controller pod is alive and the metrics subsystem is healthy.

Step 4: Set Up Pipeline Run Heartbeat Monitoring

The most critical Tekton health signal is not whether the controller is running, but whether your pipelines are actually completing. A controller can be healthy while pipelines silently fail due to misconfigured tasks, broken images, or resource limits. Use Vigilmon's heartbeat monitoring to verify scheduled pipelines complete on time.

How it works: Your pipeline's final task sends a heartbeat ping to a Vigilmon monitor URL. If the ping doesn't arrive within the expected window, Vigilmon alerts you.

Step 4a — Create a Heartbeat monitor in Vigilmon:

1. Add Monitor → Heartbeat.
2. Name: Tekton nightly build pipeline.
3. Expected interval: match your pipeline schedule (e.g., 24 hours for a nightly job, 30 minutes for a continuous pipeline).
4. Grace period: 15 minutes.
5. Copy the generated ping URL (e.g., https://vigilmon.online/ping/abc123).

Step 4b — Add a ping Task to your Tekton Pipeline:

Add a final Task to your pipeline that runs after all other tasks:

apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: vigilmon-heartbeat
spec:
  steps:
    - name: ping
      image: curlimages/curl:latest
      command:
        - curl
        - -fsS
        - -m
        - "10"
        - "https://vigilmon.online/ping/abc123"

Reference it as the last task in your Pipeline spec with runAfter pointing to your final build/test task. Every successful pipeline run now pings Vigilmon — a missing ping means the pipeline didn't complete, whether due to a task failure, timeout, or resource exhaustion.

Step 5: Monitor Tekton Triggers Availability

Tekton Triggers (EventListener) receives webhook events from GitHub, GitLab, or other sources and converts them into PipelineRun objects. If the EventListener pod is down, pushes and pull request events silently queue with no pipeline runs starting.

Tekton EventListeners expose an HTTP endpoint on port 8080 that returns a health response:

curl http://el-your-event-listener.tekton-pipelines.svc:8080
# or via ingress:
curl https://tekton-triggers.example.com

A running EventListener returns 200 OK. Add this monitor:

1. Add Monitor → HTTP.
2. URL: https://tekton-triggers.example.com (your EventListener ingress URL).
3. Check interval: 60 seconds.
4. Expected status: 200.
5. Label: Tekton Triggers EventListener.
6. Click Save.

If Tekton Triggers is down but the pipeline controller is healthy, webhooks stop triggering runs while manually submitted PipelineRuns still work — a distinction that helps narrow the incident scope quickly.

Step 6: Monitor SSL Certificates for the Tekton Dashboard

The Tekton Dashboard is accessed by engineers directly in their browsers. A certificate expiry causes browser warnings that break the workflow:

1. Add Monitor → SSL Certificate.
2. Domain: tekton.example.com (your Dashboard domain).
3. Alert when expiry is within: 30 days.
4. Alert again at: 14 days, 7 days, 3 days, 1 day.
5. Click Save.

If you expose the Tekton Triggers EventListener on a separate domain, add a second SSL monitor for that domain.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Tekton Dashboard | Non-200 | Check kubectl get pods -n tekton-pipelines; look for CrashLoopBackOff | | Controller metrics | Non-200 or no tekton_ metrics | Controller pod crashed; check events with kubectl describe pod | | Pipeline heartbeat | No ping within window | Pipeline failed or timed out; check PipelineRun status | | Triggers EventListener | Non-200 | Webhooks not being received; check EventListener pod | | SSL certificate | < 30 days | Renew; check cert-manager or ingress TLS configuration |

Common Tekton Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Tekton controller pod crashes | Controller metrics unreachable; new PipelineRuns won't start | | Pipeline task fails or times out | Heartbeat monitor fires; controller health may still be green | | EventListener pod evicted | Triggers monitor fires; GitHub webhooks queue silently | | Dashboard pod OOMKilled | Dashboard monitor fires; controller runs normally | | SSL certificate expires | SSL monitor alerts at 30-day threshold | | Kubernetes API server degraded | Dashboard and all monitors may fire simultaneously | | Scheduled pipeline missed | Heartbeat monitor alerts after grace period |

Tekton's distributed architecture means failures are often invisible — a crashed controller, a missing heartbeat, or a silently queued webhook can delay deployments for hours without any obvious error surface. Vigilmon's combination of endpoint checks and pipeline heartbeat monitoring gives you external proof that Tekton is not just running but actually completing work on schedule.

Start monitoring Tekton in under 5 minutes — register free at vigilmon.online.