How to Monitor ValidKube with Vigilmon

ValidKube is an online Kubernetes manifest validation and linting tool that combines three leading validators — kubeconform for schema conformance, kube-score for security and reliability scoring, and trivy for vulnerability scanning — into a single web interface and API. Platform and DevOps teams use ValidKube to gate manifest quality before cluster deployment, catching schema violations, missing resource limits, missing security contexts, and known CVEs in container images before they reach production. When ValidKube's backend validation service or its upstream databases (schema registries, CVE databases) become degraded, teams push unvalidated manifests or fall back to running each tool independently, reintroducing the drift and inconsistency ValidKube was adopted to prevent.

In this tutorial you'll set up uptime monitoring for the ValidKube service and the infrastructure it depends on using Vigilmon — free tier, no credit card required.

Why ValidKube's dependencies need external monitoring

ValidKube runs kubeconform, kube-score, and trivy in a coordinated pipeline and exposes the results through a single API endpoint. Its failure modes span upstream availability, CVE database freshness, and backend processing capacity:

ValidKube API endpoint unavailability blocks manifest validation gates — if the ValidKube backend becomes unreachable, CI pipelines that call the validation API fail open (skipping validation) or fail closed (blocking all deployments), both of which are operational hazards that go undetected until a build engineer investigates a stuck pipeline
Stale CVE database returns false negatives — trivy's vulnerability scanner relies on a CVE database that must be periodically refreshed; if the trivy database update job fails silently, image scans return clean results for containers with known vulnerabilities, creating a false sense of security with no visible indicator in the UI
kubeconform schema registry unavailability causes schema checks to be skipped — kubeconform validates manifests against Kubernetes JSON schemas fetched from upstream registries; if the schema source becomes unreachable, validation may be skipped rather than failed, allowing malformed manifests through with no warning
kube-score rule engine degradation produces incomplete scores — kube-score checks dozens of rules covering resource limits, security contexts, network policies, and readiness probes; a partial rule engine failure returns scores based on only the rules that completed, giving engineers a misleadingly positive assessment of manifest quality
Backend processing timeout on large manifests — complex Helm chart outputs and multi-resource manifests can trigger processing timeouts in the ValidKube backend; the API returns a 504 or empty result rather than a clear timeout error, making it look like the manifests passed validation

External monitoring from Vigilmon watches the ValidKube API and its supporting infrastructure, alerting you when validation results can no longer be trusted.

What you'll need

Access to the ValidKube API (self-hosted instance or the public validkube.com service)
A node or LoadBalancer endpoint to host the health check if running a self-hosted instance
curl available in your validation environment
A free Vigilmon account

Step 1: Expose a health endpoint for ValidKube

If you are running a self-hosted ValidKube instance, deploy a health exporter that validates the validation pipeline — kubeconform, kube-score, and trivy — are all producing consistent results:

# validkube-health.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: validkube-health-script
  namespace: observability
data:
  check.sh: |
    #!/bin/sh
    set -e

    VALIDKUBE_URL="${VALIDKUBE_URL:-http://validkube-service:8080}"

    # Test manifest to validate — minimal deployment
    TEST_MANIFEST='apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: health-check-test
      namespace: default
    spec:
      replicas: 1
      selector:
        matchLabels:
          app: health-check
      template:
        metadata:
          labels:
            app: health-check
        spec:
          containers:
          - name: app
            image: nginx:1.25
            resources:
              requests:
                cpu: 100m
                memory: 128Mi
              limits:
                cpu: 200m
                memory: 256Mi'

    HTTP_CODE=$(curl -s -o /tmp/vk_response.json -w "%{http_code}" \
      -X POST "$VALIDKUBE_URL/api/validate" \
      -H "Content-Type: application/json" \
      -d "{\"manifest\": \"$TEST_MANIFEST\"}" \
      --max-time 30 2>/dev/null || echo "000")

    if [ "$HTTP_CODE" = "200" ]; then
      if grep -q "kubeconform" /tmp/vk_response.json && grep -q "kube-score" /tmp/vk_response.json; then
        echo "healthy pipeline=full status=200"
      else
        echo "degraded pipeline=partial status=200 missing_validators=true"
      fi
    else
      echo "unhealthy status=$HTTP_CODE api=unreachable"
    fi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: validkube-health
  namespace: observability
spec:
  replicas: 1
  selector:
    matchLabels:
      app: validkube-health
  template:
    metadata:
      labels:
        app: validkube-health
    spec:
      containers:
        - name: checker
          image: curlimages/curl:latest
          command:
            - /bin/sh
            - -c
            - |
              while true; do
                /scripts/check.sh > /tmp/status 2>&1 || echo "unhealthy check_error=true" > /tmp/status
                sleep 60
              done
          env:
            - name: VALIDKUBE_URL
              value: "http://validkube-service:8080"
          volumeMounts:
            - name: scripts
              mountPath: /scripts
            - name: status
              mountPath: /tmp
        - name: health-server
          image: busybox:latest
          command:
            - /bin/sh
            - -c
            - |
              while true; do
                STATUS=$(cat /tmp/status 2>/dev/null || echo "starting")
                if echo "$STATUS" | grep -q "^healthy"; then
                  printf "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: ${#STATUS}\r\n\r\n$STATUS" | nc -l -p 8080 -q 1
                else
                  printf "HTTP/1.1 503 Service Unavailable\r\nContent-Type: text/plain\r\nContent-Length: ${#STATUS}\r\n\r\n$STATUS" | nc -l -p 8080 -q 1
                fi
              done
          ports:
            - containerPort: 8080
              name: health
          volumeMounts:
            - name: status
              mountPath: /tmp
      volumes:
        - name: scripts
          configMap:
            name: validkube-health-script
            defaultMode: 0755
        - name: status
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: validkube-health
  namespace: observability
spec:
  type: NodePort
  selector:
    app: validkube-health
  ports:
    - name: health
      port: 8080
      targetPort: 8080
      nodePort: 30089

kubectl apply -f validkube-health.yaml

# Verify
NODE_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
curl http://$NODE_IP:30089/
# healthy pipeline=full status=200

Step 2: Validate the ValidKube pipeline end to end

Before setting up monitoring, confirm all three validators are producing results:

#!/bin/bash
# check-validkube.sh

VALIDKUBE_URL="${1:-https://validkube.com}"

echo "=== ValidKube API connectivity ==="
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "$VALIDKUBE_URL" --max-time 15 2>/dev/null || echo "000")
if [ "$HTTP_CODE" = "200" ]; then
  echo "OK: ValidKube reachable (HTTP $HTTP_CODE)"
else
  echo "FAILED: ValidKube returned HTTP $HTTP_CODE or timed out"
  exit 1
fi

echo ""
echo "=== kubeconform validation check ==="
VALID_MANIFEST='{"manifest": "apiVersion: v1\nkind: Pod\nmetadata:\n  name: test\nspec:\n  containers:\n  - name: app\n    image: nginx:1.25"}'
RESPONSE=$(curl -s -X POST "$VALIDKUBE_URL/api/validate" \
  -H "Content-Type: application/json" \
  -d "$VALID_MANIFEST" \
  --max-time 30 2>/dev/null)

if echo "$RESPONSE" | grep -q "kubeconform"; then
  echo "OK: kubeconform results present in response"
else
  echo "WARNING: kubeconform results missing — schema validation may be degraded"
fi

echo ""
echo "=== kube-score check ==="
if echo "$RESPONSE" | grep -q "kube-score"; then
  echo "OK: kube-score results present in response"
else
  echo "WARNING: kube-score results missing — reliability scoring may be degraded"
fi

echo ""
echo "=== trivy vulnerability scan check ==="
if echo "$RESPONSE" | grep -q "trivy"; then
  echo "OK: trivy results present in response"
else
  echo "WARNING: trivy results missing — vulnerability scanning may be degraded"
fi

echo ""
echo "=== Invalid manifest detection ==="
INVALID_MANIFEST='{"manifest": "apiVersion: invalid/v999\nkind: Nonexistent\nmetadata:\n  name: bad"}'
INVALID_RESPONSE=$(curl -s -X POST "$VALIDKUBE_URL/api/validate" \
  -H "Content-Type: application/json" \
  -d "$INVALID_MANIFEST" \
  --max-time 30 2>/dev/null)

if echo "$INVALID_RESPONSE" | grep -qi "error\|invalid\|unknown"; then
  echo "OK: invalid manifests are detected and reported"
else
  echo "WARNING: invalid manifest was not flagged — validation logic may be impaired"
fi

chmod +x check-validkube.sh
./check-validkube.sh https://validkube.com

Step 3: Set up HTTP monitoring in Vigilmon

With the health endpoint running, add ValidKube monitors to Vigilmon:

Log in to vigilmon.online and go to Monitors → New Monitor
Choose HTTP / HTTPS
Add monitors for the ValidKube service:

| Monitor name | URL | Expected status | |---|---|---| | ValidKube health | http://your-node-ip:30089/ | 200 | | ValidKube API root | https://validkube.com | 200 | | ValidKube validate endpoint | https://validkube.com/api/validate | 200 or 405 |

Set the check interval to 1 minute
Under Expected response, match healthy in the response body for the self-hosted health endpoint
For the API root, simply verify HTTP 200 is returned within the configured timeout
Save each monitor

Step 4: Add a TCP monitor for the ValidKube service port

A TCP monitor catches network-level failures before the HTTP layer responds:

Go to Monitors → New Monitor
Choose TCP Port
Enter your ValidKube instance hostname and port 8080 (or 443 for the public service)
Set the check interval to 1 minute
Save the monitor

A TCP failure means all manifest validation in CI pipelines will fail or be skipped, depending on how the pipeline is configured to handle ValidKube unavailability.

Step 5: Configure alert channels

ValidKube is used in CI/CD gates where undetected downtime leads to either blocked deployments or unvalidated manifests reaching production — both are high-impact outcomes.

Email alerts

Go to Alert Channels → Add Channel → Email
Enter your platform engineering and DevOps on-call addresses
Assign the channel to all ValidKube monitors

Webhook alerts

Go to Alert Channels → Add Channel → Webhook
Enter your incident management webhook URL (PagerDuty, Opsgenie, Slack)
Sample Vigilmon webhook payload:

{
  "monitor_name": "ValidKube health",
  "status": "down",
  "url": "http://your-node-ip:30089/",
  "started_at": "2024-01-15T22:00:00Z",
  "duration_seconds": 120
}

Route this to a runbook that instructs platform engineers to temporarily enable local fallback validation using kubeconform, kube-score, and trivy individually until ValidKube is restored.

Step 6: Correlate Vigilmon alerts with ValidKube diagnostics

When you receive a ValidKube downtime alert:

# 1. Check ValidKube API availability
curl -s -o /dev/null -w "%{http_code}" https://validkube.com --max-time 15

# 2. Test the validate endpoint directly
curl -s -X POST https://validkube.com/api/validate \
  -H "Content-Type: application/json" \
  -d '{"manifest": "apiVersion: v1\nkind: Pod\nmetadata:\n  name: test\nspec:\n  containers:\n  - name: app\n    image: nginx:latest"}' | head -100

# 3. Check self-hosted instance pod status
kubectl get pods -n observability -l app=validkube

# 4. Check ValidKube pod logs
kubectl logs -n observability -l app=validkube --tail=50

# 5. Check the health exporter status
kubectl logs -n observability -l app=validkube-health -c checker --tail=20

# 6. Run individual validators as fallback
# kubeconform
kubeconform -summary -output json < your-manifest.yaml

# kube-score
kube-score score your-manifest.yaml

# trivy
trivy config your-manifest.yaml

# 7. Check trivy database freshness (self-hosted)
kubectl exec -n observability -l app=validkube -- trivy --version

If the ValidKube API is up but returning empty results, the most likely cause is a stale trivy CVE database or a failed kubeconform schema refresh. Check the ValidKube backend logs for database update errors.

Step 7: Create a status page for manifest validation visibility

Make ValidKube's availability visible to the platform and development teams:

Go to Status Pages → New Status Page
Name it: "Manifest Validation Pipeline (ValidKube)"
Add the ValidKube health monitor, API root monitor, and TCP monitor
Share the URL with your platform engineering and DevOps teams

During a CI pipeline failure investigation, developers checking this page immediately know whether ValidKube is the bottleneck and whether to fall back to local validators.

Summary

| What you set up | What it catches | |---|---| | HTTP monitor on ValidKube health endpoint | Pipeline degradation, missing validators, API errors | | HTTP monitor on ValidKube API root | Full service unavailability | | HTTP monitor on validate endpoint | API routing and processing failures | | TCP monitor on service port | Network-level failures blocking all validation traffic | | Email + webhook alert channels | Immediate notification when CI validation gates are at risk | | Status page | Platform team visibility into validation pipeline health |

ValidKube is a high-leverage tool: a single integration point that enforces schema correctness, reliability scoring, and vulnerability scanning across every manifest before it reaches the cluster. External monitoring ensures you know when that gate is open or degraded — before unvalidated manifests find their way to production.

Get started at vigilmon.online — free tier, no credit card required.