Monitoring NGINX Gateway Fabric with Vigilmon

NGINX Gateway Fabric is a Kubernetes-native implementation of the Gateway API spec, using NGINX as the data plane. It provides fine-grained HTTP routing, TLS termination, and traffic splitting through Gateway and HTTPRoute CRDs. Because it's the entry point for all external traffic, a configuration error or data-plane crash propagates to every service behind it. Vigilmon gives you the external perspective to catch these failures immediately — before users notice.

What You'll Set Up

• HTTP monitors for each HTTPRoute managed by NGINX Gateway Fabric
• TCP monitor for the NGINX data plane port
• TLS certificate expiry monitoring
• Heartbeat to confirm automated Gateway configuration pipelines are healthy
• Alert channel to notify your team on failure

Prerequisites

• NGINX Gateway Fabric installed in your cluster (typically in the nginx-gateway namespace)
• At least one Gateway and HTTPRoute resource configured and routing live traffic
• A free Vigilmon account
• kubectl access to retrieve Gateway addresses and route status

Step 1: Find Your Gateway Address and Routes

After installing NGINX Gateway Fabric and creating a Gateway resource, retrieve the external address:

# Get the Gateway and its external address
kubectl get gateway -n nginx-gateway
# NAME      CLASS   ADDRESS          PROGRAMMED   AGE
# prod-gw   nginx   203.0.113.50     True         10m

# List HTTPRoutes and their parent Gateways
kubectl get httproutes -A
# NAMESPACE    NAME         HOSTNAMES                PARENT REFS          AGE
# production   api-route    ["api.example.com"]      [prod-gw]            8m
# production   app-route    ["app.example.com"]      [prod-gw]            8m

Confirm routes are serving traffic:

# Test an HTTPRoute directly against the Gateway address
curl -H "Host: api.example.com" http://203.0.113.50/health

# Or using a configured hostname if DNS is set up
curl https://api.example.com/health

Check that your backend services expose health endpoints:

# Example HTTPRoute to a backend with a /health path
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-route
  namespace: production
spec:
  parentRefs:
    - name: prod-gw
      namespace: nginx-gateway
  hostnames:
    - "api.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /health
      backendRefs:
        - name: api-service
          port: 80

Step 2: Add HTTP Monitors for Each HTTPRoute

Add a Vigilmon monitor for every hostname and critical path managed by NGINX Gateway Fabric.

1. Log in to vigilmon.online and click Add Monitor.
2. Select HTTP / HTTPS.
3. Enter your route URL: https://api.example.com/health.
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

NGINX Gateway Fabric handles route programming asynchronously — a Programmed: False status on an HTTPRoute means NGINX hasn't applied the config yet, which can manifest as 404s or connection resets. Vigilmon catches these from outside the cluster where Kubernetes status fields don't help:

# Check if all HTTPRoutes are programmed successfully
kubectl get httproutes -A -o json | \
  jq '.items[] | select(.status.parents[].conditions[] | select(.type=="Accepted" and .status!="True")) | .metadata.name'

Monitor the full set of routes:

| Route | Hostname | Expected Status | |---|---|---| | api-route | https://api.example.com/health | 200 | | app-route | https://app.example.com/ | 200 | | admin-route | https://admin.example.com/ | 200 or 401 |

Step 3: Add a TCP Monitor for the NGINX Data Plane

NGINX Gateway Fabric's data plane (NGINX process) listens on port 80 and 443. A TCP-level check confirms the listener is accepting connections even when the HTTP layer might return unexpected codes:

1. In Vigilmon, click Add Monitor → TCP.
2. Enter your Gateway external address and port: 203.0.113.50 : 443.
3. Set Check interval to 1 minute.
4. Click Save.

Add a TCP check for port 80 as well if your Gateway accepts HTTP (for redirect or non-TLS routes). A failed TCP check means the NGINX process has crashed or the LoadBalancer stopped forwarding — neither condition will show in kubectl get pods until pods restart.

Step 4: Monitor TLS Certificates

NGINX Gateway Fabric terminates TLS using Secret resources referenced by Gateway listeners. Certificate expiry or misconfigured secrets cause HTTPS failures without any visible Kubernetes error in kubectl get gateway.

1. In Vigilmon, click Add Monitor → HTTP / HTTPS.
2. Enter your HTTPS endpoint: https://api.example.com/health.
3. Enable SSL certificate expiry monitoring.
4. Set an alert threshold of 14 days before expiry.
5. Click Save.

Inspect cert-manager certificates backing your Gateway TLS secrets:

# Find TLS secrets referenced by Gateway listeners
kubectl get gateway prod-gw -n nginx-gateway -o json | \
  jq '.spec.listeners[] | select(.tls) | .tls.certificateRefs'

# Check cert-manager certificate status
kubectl get certificates -n production
# NAME      READY   SECRET       AGE
# api-tls   True    api-tls-secret  45d

# Days until expiry
kubectl get certificate api-tls -n production -o json | \
  jq '.status.notAfter'

Vigilmon's TLS check validates the actual certificate served over the wire — catching cases where cert-manager renewed the certificate but the Gateway still serves the old expiring one.

Step 5: Heartbeat for Gateway Configuration Pipelines

If your team uses GitOps (Flux, ArgoCD) or CI pipelines to apply Gateway and HTTPRoute changes, add a heartbeat to confirm configuration syncs are completing:

1. In Vigilmon, click Add Monitor → Cron Heartbeat.
2. Set the expected interval to your sync cadence — 5 minutes for Flux, or match your CI trigger frequency.
3. Copy the heartbeat URL: https://vigilmon.online/heartbeat/abc123.

In a Flux Kustomization post-deploy hook or CI script:

#!/bin/bash
set -e

# Apply Gateway API configuration
kubectl apply -f k8s/gateway/
kubectl apply -f k8s/routes/

# Wait for all HTTPRoutes to be programmed
kubectl wait httproute --all -n production \
  --for=condition=Accepted=True --timeout=60s

# Ping Vigilmon heartbeat on success
curl -s "https://vigilmon.online/heartbeat/abc123"

If the sync fails or kubectl wait times out (a route stuck in Programmed: False), the heartbeat is never sent and Vigilmon alerts after the expected interval.

Step 6: Configure Alert Channels

NGINX Gateway Fabric is the entry point for all external traffic — alert quickly:

1. Go to Alert Channels in Vigilmon.
2. Add your Slack webhook, email list, or PagerDuty integration.
3. Set Consecutive failures before alert to 1 for production HTTP and TCP monitors.
4. Assign channels to all monitors.

During planned NGINX Gateway Fabric upgrades (controller image updates, CRD migrations), create a maintenance window:

curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "abc123", "duration_minutes": 15}'

Step 7: Correlate Vigilmon Alerts with Gateway Status

When Vigilmon fires an alert, use these commands to isolate the failure fast:

# Check NGINX Gateway Fabric controller pod
kubectl get pods -n nginx-gateway

# Check Gateway programmed status
kubectl describe gateway prod-gw -n nginx-gateway | grep -A5 Conditions

# Check HTTPRoute status for the failing route
kubectl describe httproute api-route -n production | grep -A10 Status

# Tail NGINX Gateway Fabric controller logs
kubectl logs -n nginx-gateway \
  -l app.kubernetes.io/name=nginx-gateway \
  --since=5m | grep -i error

# Inspect the NGINX config applied to the data plane
kubectl exec -n nginx-gateway \
  $(kubectl get pod -n nginx-gateway -l app.kubernetes.io/name=nginx-gateway -o name | head -1) \
  -- nginx -T 2>/dev/null | grep server_name

A route in Vigilmon showing 502s often means the backend Service has no healthy endpoints — check with:

kubectl get endpoints api-service -n production

If endpoints is empty, the backend pods are down or misselected; Vigilmon's alert told you users are broken while the above shows you where to fix it.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP health | Each HTTPRoute hostname | Route errors, 503s, backend failures, misconfigurations | | HTTP + SSL expiry | HTTPS endpoints | TLS failures, certificate expiry | | TCP | Port 443 / 80 | NGINX data plane crash or LoadBalancer failure | | Cron heartbeat | GitOps/CI sync pipeline | Silent configuration drift or stuck routes |

NGINX Gateway Fabric is the Kubernetes-native gateway managing all your external traffic. Vigilmon watches it from the outside — the same perspective your users have — so you're never last to know when routing breaks.

Get started free at vigilmon.online — no credit card, monitors running in under a minute.