How to Monitor Krew with Vigilmon

Krew is the package manager for kubectl plugins, providing a curated index of plugins that can be discovered, installed, updated, and removed with a single command. Engineering teams rely on Krew to deliver specialized kubectl tooling — from cluster inspection utilities to security auditors — and any breakage in Krew's plugin index, the GitHub infrastructure it fetches from, or the local plugin cache can silently leave engineers working with outdated or broken kubectl extensions. In environments where Krew-installed plugins are part of daily SRE and DevOps workflows, undetected Krew failures compound over time until a critical plugin is missing exactly when it is needed most.

In this tutorial you'll set up uptime monitoring for the infrastructure that Krew depends on using Vigilmon — free tier, no credit card required.

Why Krew's dependencies need external monitoring

Krew fetches plugin metadata from the Krew index hosted on GitHub and downloads plugin archives from GitHub Releases. Its failure modes span both upstream availability and local state:

• Krew index unreachable — kubectl krew update pulls the plugin index from github.com/kubernetes-sigs/krew-index; if GitHub is unreachable or rate-limited, engineers cannot discover or install new plugins and the index becomes stale without any visible error until the next attempted update
• Plugin download failure — individual plugin archives are fetched from GitHub Releases and author-hosted URLs; a single deleted release tag or misconfigured CDN can make a plugin permanently uninstallable via Krew without warning
• Outdated plugin running silently — if kubectl krew upgrade cannot reach upstream, installed plugins remain at their current version indefinitely; security fixes and API compatibility patches never arrive, but Krew reports no errors at runtime
• Krew binary missing after kubectl upgrade — if kubectl is upgraded via a package manager that replaces ~/.krew/bin, the Krew binary and all its installed plugins can be dropped from PATH silently, causing every Krew-installed plugin to fail with "command not found"
• Corrupted plugin cache — interrupted downloads or disk-full conditions can leave partial archives in the Krew store that cause plugins to fail on invocation with cryptic errors rather than a clear "corrupted installation" message

External monitoring from Vigilmon watches the upstream services Krew depends on and alerts you before stale indexes or download failures impact engineer productivity.

What you'll need

• Krew installed in your local or CI environment (kubectl krew version returns without error)
• kubectl access to your monitored cluster
• A node or LoadBalancer endpoint to host the health check
• A free Vigilmon account

Step 1: Expose a health endpoint for Krew's dependencies

Krew has no built-in HTTP interface. Deploy a health exporter that validates the Krew index is reachable, the Krew binary is present, and installed plugins are loadable:

# krew-health.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: krew-health-script
  namespace: observability
data:
  check.sh: |
    #!/bin/sh
    set -e

    KREW_STATUS="unknown"
    KREW_DETAIL=""

    # Check if Krew binary is present
    if ! command -v kubectl-krew > /dev/null 2>&1 && \
       ! kubectl krew version > /dev/null 2>&1; then
      KREW_STATUS="unhealthy"
      KREW_DETAIL="krew binary not found or not in PATH"
    else
      KREW_VERSION=$(kubectl krew version 2>/dev/null | grep GitTag | awk '{print $2}' || echo "unknown")

      # Check if Krew index is fresh (updated within 7 days)
      INDEX_AGE=$(kubectl krew update --dry-run 2>&1 | grep "last updated" || echo "")

      # Check that installed plugins are listed
      PLUGIN_COUNT=$(kubectl krew list 2>/dev/null | wc -l | tr -d ' ')

      if [ "$PLUGIN_COUNT" -gt 0 ] 2>/dev/null; then
        KREW_STATUS="healthy"
        KREW_DETAIL="version=$KREW_VERSION plugins=$PLUGIN_COUNT"
      else
        KREW_STATUS="degraded"
        KREW_DETAIL="version=$KREW_VERSION no_plugins_installed"
      fi
    fi

    echo "$KREW_STATUS $KREW_DETAIL" > /tmp/krew_status
    exit 0
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: krew-health
  namespace: observability
spec:
  replicas: 1
  selector:
    matchLabels:
      app: krew-health
  template:
    metadata:
      labels:
        app: krew-health
    spec:
      containers:
        - name: checker
          image: bitnami/kubectl:latest
          command:
            - /bin/sh
            - -c
            - |
              while true; do
                PLUGIN_COUNT=$(kubectl krew list 2>/dev/null | wc -l | tr -d ' ' || echo "0")
                KREW_VER=$(kubectl krew version 2>/dev/null | grep GitTag | awk '{print $2}' || echo "unavailable")
                if [ "$KREW_VER" != "unavailable" ] && [ "$PLUGIN_COUNT" -ge 0 ] 2>/dev/null; then
                  echo "healthy version=$KREW_VER plugins=$PLUGIN_COUNT" > /tmp/status
                else
                  echo "unhealthy krew=unavailable" > /tmp/status
                fi
                sleep 60
              done
        - name: health-server
          image: busybox:latest
          command:
            - /bin/sh
            - -c
            - |
              while true; do
                STATUS=$(cat /tmp/status 2>/dev/null || echo "starting")
                if echo "$STATUS" | grep -q "^healthy"; then
                  printf "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: ${#STATUS}\r\n\r\n$STATUS" | nc -l -p 8080 -q 1
                else
                  printf "HTTP/1.1 503 Service Unavailable\r\nContent-Type: text/plain\r\nContent-Length: ${#STATUS}\r\n\r\n$STATUS" | nc -l -p 8080 -q 1
                fi
              done
          ports:
            - containerPort: 8080
              name: health
          volumeMounts:
            - name: status
              mountPath: /tmp
      volumes:
        - name: status
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: krew-health
  namespace: observability
spec:
  type: NodePort
  selector:
    app: krew-health
  ports:
    - name: health
      port: 8080
      targetPort: 8080
      nodePort: 30086

kubectl apply -f krew-health.yaml

# Verify
NODE_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
curl http://$NODE_IP:30086/
# healthy version=v0.4.4 plugins=12

Step 2: Validate Krew installation and plugin health

Before setting up monitoring, confirm Krew is functional and all installed plugins are accessible:

#!/bin/bash
# check-krew-health.sh

echo "=== Krew binary check ==="
if kubectl krew version > /dev/null 2>&1; then
  echo "OK: $(kubectl krew version | grep GitTag)"
else
  echo "FAILED: krew not found — ensure ~/.krew/bin is in PATH"
  exit 1
fi

echo ""
echo "=== Installed plugins ==="
kubectl krew list

echo ""
echo "=== Plugin invocation check ==="
# Test that each installed plugin loads without error
while IFS= read -r plugin; do
  if kubectl "$plugin" --help > /dev/null 2>&1; then
    echo "OK: kubectl-$plugin"
  else
    echo "WARN: kubectl-$plugin failed to load"
  fi
done < <(kubectl krew list | tail -n +2)

echo ""
echo "=== Index freshness ==="
INDEX_DIR="${KREW_ROOT:-$HOME/.krew}/index/default"
if [ -d "$INDEX_DIR" ]; then
  INDEX_AGE=$(( ($(date +%s) - $(date -r "$INDEX_DIR" +%s)) / 86400 ))
  echo "Krew index last updated: ${INDEX_AGE} days ago"
  [ "$INDEX_AGE" -gt 7 ] && echo "WARNING: index is stale — run kubectl krew update"
else
  echo "WARNING: Krew index directory not found at $INDEX_DIR"
fi

chmod +x check-krew-health.sh
./check-krew-health.sh

Step 3: Set up HTTP monitoring in Vigilmon

With the health endpoint running, add it to Vigilmon:

1. Log in to vigilmon.online and go to Monitors → New Monitor
2. Choose HTTP / HTTPS
3. Add monitors for Krew's infrastructure:

| Monitor name | URL | Expected status | |---|---|---| | Krew plugin manager health | http://your-node-ip:30086/ | 200 | | GitHub API (Krew index source) | https://api.github.com | 200 | | Krew releases (plugin downloads) | https://github.com/kubernetes-sigs/krew-index | 200 |

4. Set the check interval to 5 minutes
5. Under Expected response, set status code 200 and match healthy in the response body for the health endpoint
6. Save each monitor

Step 4: Add a TCP monitor for GitHub connectivity

Krew fetches its index and plugin archives from GitHub. A TCP monitor catches network-level failures before they appear in application logs:

1. Go to Monitors → New Monitor
2. Choose TCP Port
3. Enter github.com and port 443
4. Set the check interval to 5 minutes
5. Save the monitor

A TCP failure to GitHub port 443 predicts that kubectl krew update and kubectl krew install will fail for all engineers in your environment.

Step 5: Configure alert channels

Krew failures silently strand engineers with outdated plugins. Alert the platform team immediately when Krew's upstream dependencies are unreachable.

Email alerts

1. Go to Alert Channels → Add Channel → Email
2. Enter your platform engineering and DevOps lead addresses
3. Assign the channel to all Krew monitors

Webhook alerts

1. Go to Alert Channels → Add Channel → Webhook
2. Enter your incident management webhook URL (PagerDuty, Opsgenie, Slack)
3. Sample Vigilmon webhook payload:

{
  "monitor_name": "Krew plugin manager health",
  "status": "down",
  "url": "http://your-node-ip:30086/",
  "started_at": "2024-01-15T14:00:00Z",
  "duration_seconds": 300
}

Route this to a runbook that instructs the platform team to check kubectl krew update output and GitHub status, and notify engineers to avoid relying on Krew-installed plugins until upstream connectivity is restored.

Step 6: Correlate Vigilmon alerts with Krew diagnostics

When you receive a Krew health downtime alert:

# 1. Check Krew version and index state
kubectl krew version
kubectl krew update 2>&1 | tail -5

# 2. List installed plugins and their versions
kubectl krew list

# 3. Test a critical plugin
kubectl krew info <plugin-name>

# 4. Check GitHub reachability
curl -I https://github.com/kubernetes-sigs/krew-index 2>&1 | head -5

# 5. Verify PATH includes Krew bin directory
echo $PATH | tr ':' '\n' | grep krew

# 6. Check Krew store for corrupted downloads
ls -la ${KREW_ROOT:-$HOME/.krew}/store/

# 7. Force a manual index refresh
kubectl krew update

# 8. Reinstall a failing plugin
kubectl krew uninstall <plugin-name>
kubectl krew install <plugin-name>

Step 7: Create a status page for Krew and plugin tooling

Make Krew's availability visible to the platform and SRE teams:

1. Go to Status Pages → New Status Page
2. Name it: "Kubernetes Plugin Tooling (Krew)"
3. Add your Krew health monitor, GitHub API monitor, and TCP monitor
4. Share the URL with all engineers who use kubectl plugins daily

When this page shows degraded, engineers know to avoid kubectl krew install and to treat missing plugins as a known infrastructure issue rather than a local configuration problem.

Summary

| What you set up | What it catches | |---|---| | HTTP monitor on Krew health endpoint | Missing Krew binary, no plugins installed, checker failures | | HTTP monitor on GitHub API | Krew index fetch failures, plugin download unavailability | | TCP monitor on GitHub port 443 | Network-level failures blocking all Krew operations | | Email + webhook alert channels | Immediate notification when Krew's upstream is unreachable | | Status page | Team-wide visibility into plugin tooling health |

Krew is the foundation of the kubectl plugin ecosystem in your cluster. External monitoring ensures you know when the index or download infrastructure it depends on is degraded — before engineers hit cryptic "plugin not found" errors during a live incident.

Get started at vigilmon.online — free tier, no credit card required.