Monitoring Argo Image Updater with Vigilmon: Process Health, Registry Connectivity, Metrics Endpoint & SSL Certificate Alerts

Argo Image Updater is the GitOps-native controller that automatically updates container image tags in Argo CD Application manifests when new images are pushed to a container registry. When Argo Image Updater stops running, image tag updates are silently skipped — your staging environments stop tracking the latest builds, your Kubernetes clusters drift from your intended image state, and no one is notified. When the controller can't reach your container registry, it fails without updating any application, often without clear errors in your CI/CD pipeline. Vigilmon gives you external visibility into Argo Image Updater's health and the connectivity it depends on.

What You'll Build

• A health endpoint monitor for the Argo Image Updater controller
• A container registry connectivity check for your Docker Hub, ECR, or GCR endpoint
• A Prometheus metrics endpoint monitor to confirm the controller is processing updates
• SSL certificate monitoring for your container registry domain
• An alerting setup that catches silent failures before image drift accumulates across environments

Prerequisites

• Argo Image Updater installed in your cluster (typically via Helm chart or kubectl apply)
• Argo CD running in the same or an accessible cluster
• A container registry accessible from the cluster (Docker Hub, ECR, GCR, GHCR, or private)
• A free account at vigilmon.online

Step 1: Understand Argo Image Updater's Health Endpoint

Argo Image Updater exposes a health endpoint on port 8080 (the metrics and health port):

# Health check
curl http://<pod-ip>:8080/healthz
# Returns: OK

# Metrics (Prometheus exposition format)
curl http://<pod-ip>:8080/metrics
# Returns: Prometheus metrics lines

Because these endpoints bind to the pod's ClusterIP, you need to expose them externally to monitor them with Vigilmon. Create a Kubernetes Service:

apiVersion: v1
kind: Service
metadata:
  name: argocd-image-updater-health
  namespace: argocd
spec:
  selector:
    app.kubernetes.io/name: argocd-image-updater
  ports:
    - name: metrics
      port: 8080
      targetPort: 8080
  type: LoadBalancer

Apply this and note the external IP or hostname assigned by your cloud provider.

Step 2: Create a Vigilmon HTTP Monitor for the Controller Health

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: http://<external-ip>:8080/healthz.
3. Check interval: 60 seconds.
4. Response timeout: 10 seconds.
5. Expected status: 200.
6. Keyword: OK.
7. Label: Argo Image Updater health.
8. Click Save.

This monitor catches:

• Argo Image Updater pod crashes or OOM kills
• Controller startup failures caused by invalid configuration
• Kubernetes API server connectivity failures that prevent the controller from listing Applications
• RBAC misconfiguration that causes the controller to crash on startup
• Memory pressure events that evict the controller pod

Alert sensitivity: Set to trigger after 1 consecutive failure. When Argo Image Updater is down, no image updates are applied to any Argo CD Application in your cluster. Staging environments stop tracking new builds silently.

Step 3: Monitor Container Registry Connectivity

Argo Image Updater polls your container registry on each reconciliation loop to list available image tags. If the registry is unreachable, updates are skipped without retry until the next reconciliation cycle. Monitor the registry health endpoint directly:

Docker Hub:

curl https://index.docker.io/v2/
# Returns: {} with HTTP 401 (endpoint is live; unauthenticated access returns 401)

GitHub Container Registry:

curl https://ghcr.io/v2/
# Returns: {} with HTTP 401

AWS Elastic Container Registry (ECR — uses an API endpoint):

curl https://api.ecr.<region>.amazonaws.com/v2/
# Returns: 401 Unauthorized

Google Container Registry / Artifact Registry:

curl https://gcr.io/v2/
# Returns: {} with HTTP 401

For any registry:

1. Add Monitor → HTTP.
2. URL: https://index.docker.io/v2/ (or your registry's v2 API root).
3. Check interval: 5 minutes.
4. Response timeout: 15 seconds.
5. Expected status: 401 (unauthenticated requests to v2 API roots return 401 when the endpoint is live).
6. Label: Container registry connectivity (Docker Hub).
7. Click Save.

Why monitor 401 as success? The OCI Distribution Specification mandates that unauthenticated requests to /v2/ return 401 Unauthorized with a WWW-Authenticate header. A 401 confirms the registry is alive and correctly enforcing authentication. A 502, 503, or connection timeout means the registry is down or unreachable from the monitoring network — the same connectivity Argo Image Updater needs.

Step 4: Monitor the Prometheus Metrics Endpoint

Argo Image Updater exposes Prometheus metrics that include reconciliation cycle counts, registry API call durations, and error rates. Monitoring the metrics endpoint confirms the controller is actively processing:

curl http://<external-ip>:8080/metrics | grep argocd_image_updater
# Returns metrics lines like:
# argocd_image_updater_applications_processed_total 42
# argocd_image_updater_images_updated_total 17

1. Add Monitor → HTTP.
2. URL: http://<external-ip>:8080/metrics.
3. Check interval: 2 minutes.
4. Response timeout: 10 seconds.
5. Expected status: 200.
6. Keyword: argocd_image_updater (present in all Argo Image Updater Prometheus metrics).
7. Label: Argo Image Updater Prometheus metrics.
8. Click Save.

If the metrics endpoint disappears while the health endpoint stays green, the controller may be in a degraded state where it responds to health probes but has stopped its reconciliation loop. The metrics monitor catches this class of partial failure that pure health checks miss.

Step 5: Monitor SSL Certificates for Your Registry

If you run a private container registry (Harbor, GitLab Container Registry, or a self-hosted distribution registry) with a custom TLS certificate, monitor it for expiry:

openssl s_client -connect registry.example.com:443 2>/dev/null | openssl x509 -noout -dates

1. Add Monitor → SSL Certificate.
2. Domain: registry.example.com.
3. Alert when expiry is within: 30 days.
4. Alert again: 14 days, 7 days, 3 days, 1 day.
5. Click Save.

When a private registry certificate expires, Argo Image Updater's registry polls fail with TLS handshake errors. The error appears in the controller logs but not in any CI/CD dashboard — builds continue pushing images to the registry successfully, but Argo Image Updater silently stops updating Argo CD Application manifests. A 30-day lead time gives you time to renew the certificate through your PKI process before any drift accumulates.

Step 6: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Controller health | Non-200 or OK missing | Check pod: kubectl get pods -n argocd -l app.kubernetes.io/name=argocd-image-updater | | Registry connectivity | Unexpected status (not 401) | Check registry status page; inspect network egress rules | | Prometheus metrics | Non-200 or keyword missing | Controller may be in degraded loop; check controller logs | | SSL certificate | < 30 days to expiry | Renew private registry certificate; check cert-manager |

Alert thresholds: Use 1 consecutive failure for the controller health and registry connectivity monitors. Use 2 consecutive failures for the metrics monitor to absorb brief reconciliation cycle delays.

Common Argo Image Updater Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Controller pod OOM killed | Health monitor fires within 60 seconds | | Registry API rate limiting (Docker Hub pull limits) | Registry connectivity monitor returns unexpected status | | Argo CD Application RBAC misconfiguration | Controller crashes on startup; health monitor fires | | Private registry certificate expires | SSL monitor fires at 30-day threshold; TLS errors begin | | Registry unreachable due to egress firewall change | Registry connectivity monitor fires; controller health stays green | | Controller config map invalid after upgrade | Controller crash-loops; health monitor fires | | Metrics exporter goroutine panics | Metrics monitor fires; health endpoint may still pass | | Git write-back fails (push to manifests repo) | Not catchable externally; controller logs show push failures | | Argo CD API server down | Controller cannot list Applications; reconciliation stops | | Kubernetes API server degraded | Controller cannot watch Application CRDs |

Argo Image Updater is the automation that keeps your GitOps image manifests in sync with your container builds — when it fails silently, staging environments accumulate drift from production, and the gap is only discovered when someone manually checks image tags days or weeks later. Vigilmon gives you external visibility into every availability layer: the controller health, registry connectivity, metrics collection, and certificate health, so you catch failures immediately and restore automated image updates before drift becomes a problem.

Start monitoring Argo Image Updater in under 5 minutes — register free at vigilmon.online.