Monitoring Devtron with Vigilmon: API Health, Web UI Availability, Webhook Endpoints & SSL Certificate Alerts

Devtron is the Kubernetes-native software delivery platform that consolidates application deployment, CI/CD pipelines, security scanning, and multi-cluster access control into a single pane of glass. When Devtron's API server goes down, every team member loses the ability to trigger deployments, view pipeline logs, and inspect application health across clusters. When the web UI becomes unreachable, on-call engineers lose their primary operations dashboard. Vigilmon gives you external visibility into Devtron's availability: the API health endpoint, web UI, webhook receivers, and SSL certificate expiry — all from outside your cluster.

What You'll Build

• A monitor on Devtron's API health endpoint to detect server failures
• A web UI availability check to confirm the dashboard is accessible
• A TCP monitor on the webhook port to verify pipeline trigger connectivity
• SSL certificate monitoring for your Devtron domain
• An alerting setup that maps each failure mode to the right remediation action

Prerequisites

• A running Devtron 0.6+ instance exposed via an Ingress or LoadBalancer
• HTTPS configured (e.g., https://devtron.example.com)
• A free account at vigilmon.online

Step 1: Understand Devtron's Health Endpoints

Devtron exposes a health check through its orchestrator service. The standard liveness endpoint is at /orchestrator/health:

curl https://devtron.example.com/orchestrator/health
# Returns: {"status":"ok"}

A healthy response returns HTTP 200 with a JSON status payload. If the orchestrator pod crashes or the ingress is misconfigured, you receive a connection error or a 502/503 from your ingress controller.

You can also confirm the API is initialised and connected to its database by checking the ready endpoint:

curl https://devtron.example.com/orchestrator/health/ready
# Returns: {"status":"ok"}

The /health endpoint passes as soon as the process is alive; the /health/ready endpoint only passes after the orchestrator has completed its startup sequence and connected to PostgreSQL and NATS.

Step 2: Create a Vigilmon HTTP Monitor for the API Health Endpoint

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://devtron.example.com/orchestrator/health.
3. Check interval: 60 seconds.
4. Response timeout: 15 seconds.
5. Expected status: 200.
6. Keyword: ok (present in the health response JSON when the orchestrator is running).
7. Click Save.

This monitor catches:

• Devtron orchestrator pod crashes or OOM kills
• Kubernetes control plane failures that prevent the orchestrator from starting
• Ingress controller failures that block access to Devtron's service
• Deployment failures after Devtron version upgrades
• PostgreSQL or NATS connectivity failures that cause the orchestrator to refuse traffic

Alert sensitivity: Set to trigger after 1 consecutive failure. When Devtron's API is down, CI/CD pipelines cannot be triggered, deployed applications cannot be rolled back, and platform engineers lose cross-cluster visibility.

Step 3: Monitor the Devtron Web UI

The Devtron dashboard is where platform engineers manage deployments, review pipeline runs, configure chart repositories, and access application environments. A frontend serving failure is a distinct failure mode from an API crash:

curl https://devtron.example.com
# Returns HTML with "Devtron" in the page title

1. Add Monitor → HTTP.
2. URL: https://devtron.example.com.
3. Check interval: 2 minutes.
4. Response timeout: 15 seconds.
5. Expected status: 200.
6. Keyword: Devtron (present in the web UI HTML response).
7. Label: Devtron web UI.
8. Click Save.

When the web UI monitor fires but the API health monitor stays green, the issue is in Devtron's dashboard static asset serving or the ingress routing rules — not the orchestrator backend. This distinction lets you escalate to the right team without a full incident.

Step 4: Monitor Webhook Endpoints via TCP Check

Devtron receives pipeline trigger webhooks from GitHub, GitLab, and Bitbucket over HTTPS on port 443, or a dedicated webhook port if your ingress is configured to route webhook traffic separately. A TCP connectivity check confirms that the port is reachable from the public internet:

# Verify TCP connectivity to the Devtron ingress
nc -zv devtron.example.com 443

If your Devtron deployment uses a dedicated webhook receiver pod on a separate NodePort or LoadBalancer port (a common pattern in air-gapped environments), add a TCP monitor for that port:

1. Add Monitor → TCP.
2. Host: devtron.example.com.
3. Port: 443 (or your dedicated webhook port).
4. Check interval: 2 minutes.
5. Label: Devtron webhook port.
6. Click Save.

Why TCP and not HTTP for webhooks? Webhook endpoints typically require a valid payload with a secret signature — an unauthenticated GET returns 401 or 405. TCP monitoring confirms port reachability without needing a valid request body. If your webhook endpoint responds with 401 to unauthenticated requests, you can add an HTTP monitor with expected status 401 to confirm the handler is up.

Step 5: Monitor SSL Certificates

Devtron engineers interact with the dashboard over HTTPS and the Devtron CLI (devtron) validates certificates. An expired or misconfigured certificate locks out both browser access and CLI-based operations. Proactive certificate monitoring prevents this:

openssl s_client -connect devtron.example.com:443 2>/dev/null | openssl x509 -noout -dates

1. Add Monitor → SSL Certificate.
2. Domain: devtron.example.com.
3. Alert when expiry is within: 30 days.
4. Alert again: 14 days, 7 days, 3 days, 1 day.
5. Click Save.

cert-manager and Let's Encrypt: Devtron Helm chart installations typically use cert-manager with a ClusterIssuer to provision certificates automatically. Renewal can fail silently when the ClusterIssuer hits Let's Encrypt rate limits, when ACME HTTP-01 challenges are blocked by a NetworkPolicy, or when the Ingress annotation is overwritten during a Devtron chart upgrade. A 30-day warning window gives you time to investigate cert-manager events before the certificate actually expires.

Step 6: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels for each monitor:

| Monitor | Trigger | Remediation action | |---|---|---| | API health | Non-200 or ok missing | Check orchestrator pod: kubectl get pods -n devtroncd | | Web UI | Non-200 or keyword missing | UI serving issue; check Devtron dashboard deployment and ingress | | Webhook port TCP | Connection refused | Port blocked; check ingress configuration and load balancer health | | SSL certificate | < 30 days to expiry | Check cert-manager: kubectl get certificate -n devtroncd |

Alert thresholds: Use 1 consecutive failure for the API health and TCP webhook port monitors. Use 2 consecutive failures for the web UI monitor to reduce noise from transient network hiccups.

Common Devtron Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Orchestrator pod OOM killed | API health monitor fires within 60 seconds | | PostgreSQL connection pool exhausted | Ready endpoint fails; API health endpoint may still pass | | Ingress controller upgrade breaks routing | All HTTP monitors fire simultaneously | | Webhook port blocked by firewall rule change | TCP monitor fires; HTTP monitors stay green | | SSL certificate expires | SSL monitor fires at 30-day threshold; browser and CLI access fail | | Devtron upgrade breaks UI serving | Web UI keyword monitor fires; API health stays green | | NATS messaging failure | Pipelines stop triggering; orchestrator health may stay green | | DNS record misconfiguration | All monitors fire simultaneously | | Node drain evicts orchestrator pod | API health monitor fires during pod reschedule |

Devtron is the control plane your platform team uses to ship software safely across every Kubernetes cluster in your fleet. When it fails, deployments stall, rollbacks become manual shell operations, and on-call engineers lose the visibility they need to respond confidently. Vigilmon gives you external eyes on every availability layer — API server, web dashboard, webhook connectivity, and certificate health — so you know the moment something breaks.

Start monitoring Devtron in under 5 minutes — register free at vigilmon.online.