Monitoring KubeVela with Vigilmon: Application Controller Health, Workflow Status, Addon Availability & Delivery Heartbeats

KubeVela is an open application delivery platform built on the Open Application Model (OAM) that lets platform teams define reusable delivery workflows and lets developers deploy applications without writing raw Kubernetes manifests. As the delivery control plane for cloud-native workloads, KubeVela's controller manages ApplicationRevisions, drives CUE-based workflow steps, and coordinates addon installations across clusters. A crashed KubeVela controller silently stalls all application rollouts, workflow reconciliation halts without a warning, and a broken addon registry leaves components unavailable for new delivery pipelines. Vigilmon gives you external visibility into the KubeVela API server health, workflow engine availability, addon registry status, SSL certificates, and delivery pipeline heartbeats so you catch failures before they block your engineering teams.

What You'll Build

A monitor on the KubeVela API server health endpoint
A workflow engine availability check via the KubeVela webhook endpoint
An addon registry status check via keyword matching
SSL certificate monitoring for the KubeVela API endpoint
A heartbeat monitor confirming scheduled delivery pipeline jobs complete on time

Prerequisites

A running KubeVela installation with the VelaUX API server exposed at a URL
KubeVela API accessible over HTTPS (via an Ingress or LoadBalancer)
A free account at vigilmon.online

Step 1: Verify the KubeVela API Server Health Endpoint

KubeVela's VelaUX API server exposes a health check endpoint:

curl https://vela.example.com/api/v1/health

A healthy KubeVela API server returns:

{"status":"ok"}

This confirms the VelaUX API server is alive and its internal routing is responding. Application controller health and workflow engine status are checked in subsequent steps.

Step 2: Create a Vigilmon HTTP Monitor for the KubeVela API

Log in to Vigilmon → Add Monitor → HTTP.
URL: https://vela.example.com/api/v1/health.
Check interval: 60 seconds.
Response timeout: 10 seconds.
Expected status: 200.
Keyword: ok.
Label: KubeVela API Server Health.
Click Save.

Set alerts to trigger after 1 consecutive failure — a KubeVela API outage blocks all application deployments, workflow status queries, and addon management operations.

Step 3: Monitor the KubeVela Webhook Endpoint

KubeVela registers a mutating webhook that intercepts Application resource creation and runs workflow validation. When the webhook is unreachable, new Application resources fail admission and deployments are silently blocked:

curl -k https://vela.example.com/mutate-core-oam-dev-v1beta1-application

Add Monitor → HTTP.
URL: https://vela.example.com/mutate-core-oam-dev-v1beta1-application.
Check interval: 2 minutes.
Expected status: 200 or 405 (POST-only endpoint; any non-5xx confirms reachability).
Label: KubeVela Webhook.
Click Save.

Step 4: Monitor the Addon Registry

KubeVela's addon system provides reusable capabilities (Flux, ArgoCD, Prometheus, etc.) pulled from a remote addon registry. When the registry is unreachable, addon installations fail and pending component definitions cannot be resolved:

curl https://vela.example.com/api/v1/addons

A healthy response includes an array of available addons:

{"addons":[{"name":"fluxcd","enabled":true},{"name":"prometheus","enabled":false}]}

Add a monitor using keyword matching:

Add Monitor → HTTP.
URL: https://vela.example.com/api/v1/addons.
Check interval: 5 minutes.
Expected status: 200.
Keyword: addons.
HTTP Headers: Authorization: Bearer your-token (if authentication is required).
Label: KubeVela Addon Registry.
Click Save.

Authentication: VelaUX uses JWT-based authentication. Generate a token via vela auth login and include it in the Authorization header.

Step 5: Monitor Application List Availability

KubeVela's application list endpoint confirms the controller is reconciling resources and the API database layer is healthy:

curl https://vela.example.com/api/v1/applications

A healthy response returns an array of managed applications. An empty cluster returns {"applications":[]}, which is still a valid healthy response:

Add Monitor → HTTP.
URL: https://vela.example.com/api/v1/applications.
Check interval: 2 minutes.
Expected status: 200.
Keyword: applications.
Label: KubeVela Application List.
Click Save.

Step 6: Set Up Delivery Pipeline Heartbeat Monitoring

KubeVela workflows can include notification steps that ping an external URL on successful completion. A pipeline that silently fails leaves applications in a partially deployed or stale state. Use Vigilmon heartbeat monitoring to confirm delivery pipelines complete on schedule:

Step 6a — Create a Heartbeat monitor in Vigilmon:

Add Monitor → Heartbeat.
Name: KubeVela nightly delivery pipeline.
Expected interval: 24 hours (or match your pipeline schedule).
Grace period: 30 minutes.
Copy the generated ping URL (e.g., https://vigilmon.online/ping/abc123).

Step 6b — Add a notification step to your KubeVela workflow:

apiVersion: core.oam.dev/v1beta1
kind: Application
metadata:
  name: my-app
spec:
  components:
    - name: my-service
      type: webservice
      properties:
        image: my-org/my-service:latest
  workflow:
    steps:
      - name: deploy-production
        type: deploy
        properties:
          policies:
            - name: production-env
      - name: notify-vigilmon
        type: webhook
        properties:
          url: https://vigilmon.online/ping/abc123
          method: GET

If the workflow fails before reaching the notify step, or the Application resource is deleted, Vigilmon fires an alert after the grace period expires.

Step 7: Monitor SSL Certificates

KubeVela's VelaUX dashboard and API are consumed by developers, CI/CD systems, and CLI tooling. An expired certificate causes TLS errors across all API consumers:

Add Monitor → SSL Certificate.
Domain: vela.example.com.
Alert when expiry is within: 30 days.
Alert again at: 14 days, 7 days, 3 days, 1 day.
Click Save.

Step 8: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | API server health | Non-200 or ok missing | Check VelaUX pod; kubectl get pods -n vela-system | | Webhook | Non-200/405 | Webhook service down; deployments blocked at admission | | Addon registry | Non-200 or addons absent | Registry unreachable; addon installs will fail | | Application list | Non-200 | Controller DB issue; reconciliation may be stalled | | Delivery heartbeat | No ping within window | Pipeline failed; check workflow steps and component status | | SSL certificate | < 30 days | Renew; verify cert-manager TLS config |

Common KubeVela Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | KubeVela controller pod crash | API health unreachable; alert within 60 s | | Webhook service unavailable | Webhook monitor fires; new Application resources blocked | | Addon registry connectivity lost | Addon monitor fires; pending installs stall | | VelaUX DB connection failure | Application list returns 500; alert immediately | | Delivery pipeline silently fails | Heartbeat monitor alerts after grace period | | SSL certificate expires | SSL monitor alerts at 30-day threshold | | OAM component definition sync breaks | Application list API degrades; reconciliation errors | | Multi-cluster target unreachable | Workflow deploy step fails; heartbeat misses |

KubeVela's abstraction layers mean failures can be invisible — the controller may appear running while workflow reconciliation stalls, addon components fail to resolve, or delivery pipelines exit without notifying anyone. Vigilmon's layered monitoring of the API server, webhook admission, addon registry, application list, delivery heartbeats, and SSL certificates gives you external visibility across every layer of KubeVela's application delivery stack, so you catch failures before they block your teams' deployments.

Start monitoring KubeVela in under 5 minutes — register free at vigilmon.online.