Monitoring PipeCD with Vigilmon: API Health, GitOps Sync Heartbeats, Application Status & SSL Alerts

PipeCD is a GitOps-native continuous delivery platform that supports Kubernetes, Terraform, CloudRun, Lambda, and ECS deployments through a unified control plane and piped agents. When the API server becomes unavailable, a piped agent loses connectivity, or application sync drifts, deployments stop flowing and teams have no visibility into rollout state — often without any direct error surfacing to developers. Vigilmon adds the external observability layer PipeCD needs: API health checks, sync heartbeats, application status validation, and SSL certificate alerts.

What You'll Build

• An HTTP monitor for the PipeCD web console
• A health check against the PipeCD API server
• A deployment sync heartbeat for end-to-end GitOps verification
• A piped agent connectivity heartbeat
• SSL certificate expiry alerts
• A TCP port check for the API gRPC server

Prerequisites

• PipeCD control plane deployed (Kubernetes or Docker Compose)
• At least one piped agent connected to the control plane
• A domain configured for your PipeCD console with HTTPS
• A free account at vigilmon.online

Step 1: Monitor the PipeCD Web Console

The PipeCD dashboard shows application deployment status, pipeline stages, and piped agent health. A down console leaves your team unable to track rollout progress or trigger manual approvals:

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://pipecd.yourdomain.com
3. Check interval: 120 seconds.
4. Expected status: 200.
5. Label: PipeCD Web Console
6. Click Save.

PipeCD's frontend is a React single-page app served by the API server. A 200 response confirms the control plane web server is operational and your reverse proxy is routing correctly.

Step 2: Check the PipeCD API Server Health

PipeCD's API server exposes a /healthz endpoint that returns HTTP 200 when the server is healthy and its dependencies are reachable:

1. Add Monitor → HTTP.
2. URL: https://pipecd.yourdomain.com/healthz
3. Check interval: 60 seconds.
4. Expected status: 200.
5. Label: PipeCD API Health
6. Click Save.

The /healthz endpoint exercises the control plane process and its storage backend (Firestore, DynamoDB, or MongoDB depending on your configuration). A failed healthz response while the console still renders indicates a backend storage failure — the most common PipeCD control plane failure mode.

Step 3: Deployment Sync Heartbeat

The most critical PipeCD signal is whether GitOps sync is actually completing. Add a post-deployment step to a representative application to confirm end-to-end delivery:

# .pipe.yaml — in your application repository
apiVersion: pipecd.dev/v1beta1
kind: KubernetesApp
spec:
  name: my-app
  pipelines:
    - name: main
      stages:
        - name: K8S_CANARY_ROLLOUT
          with:
            replicas: 10%
        - name: WAIT_APPROVAL
          with:
            timeout: 30m
        - name: K8S_PRIMARY_ROLLOUT
        - name: K8S_CANARY_CLEAN
        - name: ANALYSIS
          with:
            duration: 10m
            http:
              - url: https://vigilmon.online/api/heartbeat/YOUR-SYNC-HEARTBEAT-ID
                method: POST
                expectedCode: 200

For simpler pipelines without built-in HTTP analysis steps, add a post-deploy script in your CI workflow:

#!/bin/bash
# Run after pipectl trigger-sync completes successfully
pipectl sync --app-id YOUR_APP_ID --wait-status SUCCESS \
  && curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-SYNC-HEARTBEAT-ID

In Vigilmon:

1. Add Monitor → Heartbeat.
2. Expected interval: Match your deployment cadence (e.g., 60 minutes for hourly deploys).
3. Grace period: 30 minutes.
4. Label: PipeCD Deployment Sync

If the sync fails, times out, or PipeCD stops processing pipelines altogether, the heartbeat goes silent and Vigilmon alerts you.

Step 4: Piped Agent Connectivity Heartbeat

PipeCD uses piped agents that run inside your infrastructure and maintain a gRPC stream to the control plane. A disconnected piped agent causes all deployments for that environment to stall without obvious errors in the console:

#!/bin/bash
# /etc/cron.d/pipecd-piped-check — runs every 5 minutes

PIPED_STATUS=$(curl -s \
  -H "Authorization: Bearer YOUR_API_KEY" \
  https://pipecd.yourdomain.com/api/v1/pipeds \
  | python3 -c "
import sys, json
data = json.load(sys.stdin)
pipeds = data.get('pipeds', [])
connected = [p for p in pipeds if p.get('status') == 'ONLINE']
print(len(connected))
")

if [ "${PIPED_STATUS:-0}" -ge 1 ] 2>/dev/null; then
  curl -fsS -X POST https://vigilmon.online/api/heartbeat/YOUR-PIPED-HEARTBEAT-ID
fi

In Vigilmon:

1. Add Monitor → Heartbeat.
2. Expected interval: 5 minutes.
3. Grace period: 15 minutes.
4. Label: PipeCD Piped Agent Connectivity

The script checks that at least one piped agent reports ONLINE status. If all agents disconnect — due to network partitions, TLS certificate issues between piped and the control plane, or pod restarts — the heartbeat stops and Vigilmon alerts within the grace period.

Step 5: SSL Certificate Alerts

PipeCD relies on HTTPS/TLS for the web console, the gRPC API used by piped agents, and any webhook integrations with GitHub or GitLab:

1. Add Monitor → SSL Certificate.
2. Domain: pipecd.yourdomain.com
3. Alert when expiry is within: 30 days.
4. Alert again: 14 days, 7 days, 3 days.
5. Click Save.

An expired TLS certificate breaks the gRPC connection between piped agents and the control plane immediately — piped agents cannot re-establish connection, and all deployments stall. A 30-day lead time is essential.

Step 6: TCP Port Check for the gRPC API

PipeCD's piped agents connect to the control plane over gRPC (typically port 443 or 9080). Monitor the port directly to catch network-level failures before the HTTP layer fails:

1. Add Monitor → TCP.
2. Host: pipecd.yourdomain.com, Port: 443.
3. Check interval: 60 seconds.
4. Label: PipeCD API Port
5. Click Save.

A TCP failure before the HTTP healthz monitor fires indicates an ingress or network-level problem rather than an application failure — critical to distinguish when piped agents start reporting disconnection.

Step 7: Application Status API Check

PipeCD's REST API exposes application and deployment status. Monitor it with a periodic API call to confirm the control plane is serving data correctly:

1. Add Monitor → HTTP.
2. URL: https://pipecd.yourdomain.com/api/v1/applications
3. Request headers: Authorization: Bearer YOUR_API_KEY
4. Check interval: 120 seconds.
5. Expected status: 200.
6. Label: PipeCD Applications API
7. Click Save.

This check exercises the control plane's storage read path and confirms API key authentication is working — failures here often precede piped agent disconnection events.

Common PipeCD Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Control plane API crash | /healthz and web console monitors fire within 60 s | | Storage backend failure | API healthz returns error; applications API fails | | Piped agent disconnection | Piped connectivity heartbeat stops | | GitOps sync stall | Deployment sync heartbeat goes silent | | TLS certificate expires | SSL monitor alerts at 30 days; piped loses gRPC connection | | gRPC port unreachable | TCP check fires immediately | | Webhook delivery failure | Sync heartbeat stops (no new deployments trigger) | | Approval gate stuck | Deployment sync heartbeat exceeds interval | | DNS misconfiguration | All HTTP and SSL monitors fire simultaneously |

PipeCD's GitOps model gives you declarative, auditable continuous delivery across Kubernetes, Terraform, and serverless platforms. Vigilmon ensures the control plane, piped agents, and deployment pipelines all stay healthy — so your GitOps sync keeps flowing on every merge without silent failures blocking production rollouts.

Start monitoring PipeCD in under 5 minutes — register free at vigilmon.online.