tutorial

Monitoring Nova with Vigilmon: Helm Version Checker Health, Update Server Availability & SSL Certificate Alerts

How to monitor Nova with Vigilmon — ensure your Helm chart and cluster component version checker is operational in CI pipelines, detect update source outages, and get SSL certificate alerts before version drift goes undetected.

Nova is the Fairwinds tool that scans your Kubernetes cluster for outdated Helm charts and cluster add-ons, comparing installed versions against the latest releases from upstream repositories. When Nova can't reach the version databases it queries, your charts appear current even when they're running vulnerable or unsupported versions months behind. When Nova's CI integration breaks, engineering teams lose automated version-drift alerting across their Helm-managed infrastructure — and security vulnerabilities in outdated chart versions accumulate undetected. Vigilmon gives you external visibility into the Nova infrastructure that keeps version checks running: release endpoints, update server APIs, dashboard surfaces, and the SSL certificates that protect them.

What You'll Build

  • An HTTP monitor on Nova's version data sources to detect upstream outages affecting scan accuracy
  • A TCP check on any Nova dashboard or API services you self-host
  • SSL certificate monitoring for all Nova-connected endpoints
  • An alerting configuration that routes findings to the right team by severity

Prerequisites

  • Nova v3.0.0+ installed in your CI pipeline or as a Kubernetes CronJob
  • Helm v3 with releases deployed in your cluster
  • A free account at vigilmon.online

Step 1: Understand Nova's Data Sources

Nova compares your installed Helm chart versions against a versioned JSON index of known charts and their latest releases. By default, Nova queries Fairwinds' hosted version data:

# Run Nova against your cluster
nova find

# Output includes outdated charts with current vs. latest versions
nova find --wide

# Output as JSON for CI processing
nova find -o json

# Check Nova's configured data sources
nova find --show-errored-containers

Nova fetches version data from a remote URL during each scan. If this URL is unreachable, Nova may report no updates found — silently masking outdated components. The key data URL to understand:

# Nova's default version source
https://nova.release.fairwinds.tech

# Charts are indexed here
https://nova.release.fairwinds.tech/v2/index.yaml

Your internal Nova configuration may point to a custom version index if you manage an internal Helm repository:

# nova.yaml
outputFile: nova-results.json
additionalNamespaces:
  - all
helm:
  versionSource: https://nova.release.fairwinds.tech/v2/index.yaml
containers:
  versionSource: https://nova.release.fairwinds.tech/v2/index.yaml

Step 2: Monitor the Nova Version Data Endpoint

The Nova version index is what determines whether your version checks are accurate. If this endpoint returns stale data or is unavailable, Nova produces incorrect "no updates found" results:

  1. Log in to Vigilmon → Add Monitor → HTTP.
  2. URL: https://nova.release.fairwinds.tech/v2/index.yaml.
  3. Check interval: 15 minutes.
  4. Response timeout: 20 seconds.
  5. Expected status: 200.
  6. Keyword: apiVersion (present in all valid Helm index.yaml files).
  7. Label: Nova version index.
  8. Click Save.

This monitor catches:

  • Fairwinds hosted version service outages that cause Nova to report false negatives
  • CDN or proxy failures between your CI environment and the version source
  • SSL/TLS handshake failures if the upstream certificate is renewed incorrectly
  • Rate limiting or IP-based access controls that block CI runner requests

Internal index mirror: If your organization mirrors the Nova version index internally (recommended for air-gapped environments), point this monitor at your internal mirror URL instead. Your internal mirror is the actual critical dependency — upstream availability matters only for the mirror's own sync jobs.

Step 3: Monitor Your Internal Helm Repository

Nova scans Helm releases in your cluster and compares them against chart repositories. If your internal Helm repository (ChartMuseum, Harbor, Nexus, or Artifactory) is down, Nova cannot look up chart metadata for internally hosted charts:

# Check your internal Helm repository health
curl https://charts.example.com/api/charts
# Returns a JSON object of available charts

# Test the Nova-relevant index endpoint
curl https://charts.example.com/index.yaml | head -20
# Should return a valid Helm index

In Vigilmon:

  1. Add Monitor → HTTP.
  2. URL: https://charts.example.com/index.yaml.
  3. Check interval: 5 minutes.
  4. Response timeout: 15 seconds.
  5. Expected status: 200.
  6. Keyword: apiVersion (Helm index signature).
  7. Label: Internal Helm chart repository.
  8. Click Save.

Chart repository outages cause Nova to produce partial scan results — charts from the unavailable repository appear with "unknown" versions instead of the correct current/latest comparison.

Step 4: Monitor Nova's CI Integration Endpoint

If you run Nova in CI pipelines that report results to a central dashboard or Slack integration, the reporting endpoint is part of Nova's operational footprint:

# .github/workflows/nova-scan.yml
name: Chart Version Check
on:
  schedule:
    - cron: '0 8 * * 1-5'  # Weekday mornings
  workflow_dispatch:

jobs:
  nova-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Install Nova
        run: |
          wget https://github.com/FairwindsOps/nova/releases/download/v3.8.0/nova_3.8.0_linux_amd64.tar.gz
          tar xzf nova_3.8.0_linux_amd64.tar.gz
          chmod +x nova
          sudo mv nova /usr/local/bin/

      - name: Run Nova scan
        run: |
          nova find -o json > nova-results.json

      - name: Check for outdated charts
        run: |
          OUTDATED=$(cat nova-results.json | jq '[.helm[] | select(.outdated == true)] | length')
          DEPRECATED=$(cat nova-results.json | jq '[.helm[] | select(.deprecated == true)] | length')
          echo "Outdated charts: $OUTDATED"
          echo "Deprecated charts: $DEPRECATED"
          if [ "$DEPRECATED" -gt 0 ]; then
            echo "ERROR: $DEPRECATED deprecated chart(s) found"
            exit 1
          fi

      - name: Post results to dashboard
        run: |
          curl -X POST https://nova-dashboard.example.com/api/results \
            -H "Content-Type: application/json" \
            -d @nova-results.json

Monitor the dashboard reporting endpoint:

  1. Add Monitor → HTTP.
  2. URL: https://nova-dashboard.example.com/api/health.
  3. Check interval: 2 minutes.
  4. Response timeout: 10 seconds.
  5. Expected status: 200.
  6. Label: Nova results dashboard.
  7. Click Save.

Step 5: Run Nova as a Kubernetes CronJob for Continuous Scanning

For persistent cluster monitoring rather than PR-scoped checks, run Nova as a CronJob that posts results to your observability platform:

# nova-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: nova-version-scan
  namespace: monitoring
spec:
  schedule: "0 */6 * * *"  # Every 6 hours
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: nova-scanner
          containers:
          - name: nova
            image: quay.io/fairwinds/nova:v3.8.0
            command:
            - nova
            - find
            - -o
            - json
            - --output-file
            - /results/nova-results.json
            volumeMounts:
            - name: results
              mountPath: /results
          restartPolicy: OnFailure
          volumes:
          - name: results
            emptyDir: {}

Verify the CronJob is running and producing results:

kubectl get cronjobs -n monitoring nova-version-scan
kubectl get jobs -n monitoring -l app=nova-version-scan --sort-by=.metadata.creationTimestamp
kubectl logs -n monitoring job/nova-version-scan-<timestamp>

You can also create a lightweight HTTP status endpoint in the same namespace that exposes the last scan timestamp — then monitor that endpoint with Vigilmon to detect stale CronJob executions.

Step 6: Monitor SSL Certificates

All Nova-related HTTPS endpoints — your internal Helm repository, Nova dashboard, and version index mirrors — need certificate monitoring:

# Check your internal chart repository certificate
openssl s_client -connect charts.example.com:443 2>/dev/null | openssl x509 -noout -dates

# Check your Nova dashboard certificate
openssl s_client -connect nova-dashboard.example.com:443 2>/dev/null | openssl x509 -noout -dates

In Vigilmon:

  1. Add Monitor → SSL Certificate.
  2. Domain: charts.example.com.
  3. Alert when expiry is within: 30 days.
  4. Alert again: 14 days, 7 days, 3 days, 1 day.
  5. Click Save.

Repeat for nova-dashboard.example.com and your version index mirror domain.

Helm chart repository certificates and CI: Helm clients in CI pipelines validate the certificate of every chart repository during helm repo add and helm repo update. An expired certificate on your internal chart repository causes all Helm operations to fail — including Nova scans that depend on Helm metadata — with x509: certificate has expired.

Step 7: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Nova version index | Non-200 or apiVersion missing | Nova scans will produce false negatives; check network access to Fairwinds endpoints | | Internal Helm repository | Non-200 or keyword missing | Nova cannot resolve internal chart versions; check ChartMuseum/Harbor service health | | Nova dashboard | Non-200 | Results from CI scans are not being stored; check dashboard service pods | | SSL certificate | < 30 days to expiry | Renew certificate; CI Helm operations will fail when certificate expires |

Alert routing: Route Helm repository and version index alerts to the platform/DevOps team. Route Nova dashboard alerts to whoever owns the compliance reporting workflow.

Common Nova Infrastructure Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Fairwinds version index unreachable | HTTP monitor fails; Nova reports false "all charts up to date" | | Internal Helm repository down | Chart index HTTP monitor fails; Nova shows unknown versions for internal charts | | Nova dashboard service OOM killed | Dashboard HTTP monitor fails; scan results lost | | SSL cert expired on Helm repository | SSL monitor alerts at 30 days; Helm operations in CI start failing at expiry | | CI runner network blocks version index | HTTP monitor timeout; same failure CI runners experience | | Nova CronJob suspended or failing | Requires behavioral monitoring — check job completion times in Kubernetes | | Version index mirror sync falls behind | Mirror HTTP monitor is green but data is stale; add a freshness check on index timestamp |

Nova's value comes from its continuous visibility into version drift across your Helm-managed infrastructure — but that visibility depends on version data sources, chart repositories, and reporting pipelines all being available. Vigilmon monitors the external endpoints that Nova depends on so you know immediately when version checks are producing stale or incomplete results, long before a misconfigured or outdated Helm chart causes a production incident.

Start monitoring your Nova infrastructure in under 5 minutes — register free at vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles