Monitoring Spinnaker with Vigilmon: Gate API Health, Deck UI Availability, Clouddriver & Redis Connectivity

Spinnaker is the self-hosted multi-cloud continuous delivery platform used by engineering teams to automate deployment pipelines across AWS, GCP, Azure, Kubernetes, and more. Its microservice architecture — Gate, Deck, Clouddriver, Orca, Front50, and others — means that a failure in any one service can silently degrade or halt deployments without raising an obvious alarm. When Spinnaker is down, your delivery pipeline stops: releases queue, rollbacks become manual, and engineers lose visibility into deployment state. Vigilmon gives you external health checks across Spinnaker's critical services so you catch failures before they block your next release.

What You'll Build

• A monitor on Gate's /health API gateway endpoint
• Deck (web UI) availability monitoring at port :9000
• Clouddriver service health monitoring
• Redis connectivity verification
• SSL certificate monitoring for Gate and Deck
• A heartbeat monitor confirming deployment pipelines complete on schedule

Prerequisites

• A running Spinnaker installation (Halyard or Operator) with Gate exposed at :8084 and Deck at :9000
• Gate and/or Deck accessible over HTTPS (direct or via reverse proxy)
• A free account at vigilmon.online

Step 1: Verify Gate's Health Endpoint

Gate is the API gateway that all Spinnaker clients — including Deck (the web UI) and any external CI integrations — communicate through. Gate exposes a Spring Boot Actuator /health endpoint:

curl https://gate.example.com:8084/health
# or if proxied:
curl https://spinnaker-api.example.com/health

A healthy Gate returns:

{
  "status": "UP"
}

Gate's health endpoint aggregates connectivity to downstream services including Redis, Front50 (persistence), and Orca (pipeline orchestration). A DOWN or degraded status from Gate indicates a problem in Spinnaker's backend services, even if the Deck UI appears to load.

Step 2: Create a Vigilmon HTTP Monitor for Gate

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://spinnaker-api.example.com/health (your Gate URL).
3. Check interval: 60 seconds.
4. Response timeout: 15 seconds.
5. Expected status: 200.
6. Keyword: "UP" (matches the status field).
7. Label: Spinnaker Gate API.
8. Click Save.

Set alerts to trigger after 1 consecutive failure — Gate being down means no deployments can be submitted or monitored through Spinnaker.

Step 3: Monitor Deck (Web UI) Availability

Deck is the Spinnaker web interface served on port :9000. It is a static React application served by a Node.js or nginx process, separate from Gate. Deck being unavailable blocks engineers from viewing pipeline state or triggering deployments:

curl -I https://spinnaker.example.com
# or:
curl -I http://your-spinnaker-host:9000

A running Deck returns 200 OK with HTML content. Add this monitor:

1. Add Monitor → HTTP.
2. URL: https://spinnaker.example.com (your Deck URL).
3. Check interval: 60 seconds.
4. Expected status: 200.
5. Label: Spinnaker Deck UI.
6. Click Save.

Deck and Gate can fail independently. Deck down with Gate healthy means engineers lose the UI but API-driven pipelines continue. Gate down with Deck up means the UI loads but all API calls fail with errors — both combinations are worth detecting.

Step 4: Monitor Clouddriver Service Health

Clouddriver is the Spinnaker service responsible for interacting with cloud providers: deploying to Kubernetes, managing AWS resources, querying GCP, and more. When Clouddriver is degraded, Spinnaker cannot deploy or read infrastructure state.

Clouddriver also exposes a Spring Boot Actuator health endpoint (default port :7002):

curl http://your-spinnaker-host:7002/health

If Clouddriver is exposed internally only, route the check through an internal uptime agent or expose a health URL via your reverse proxy:

1. Add Monitor → HTTP.
2. URL: https://spinnaker-internal.example.com/clouddriver/health (proxied URL).
3. Check interval: 2 minutes.
4. Expected status: 200.
5. Keyword: "UP".
6. Label: Spinnaker Clouddriver.
7. Click Save.

A Clouddriver health failure while Gate is healthy typically means cloud provider credential issues, a kubeconfig problem, or Clouddriver's connection to its Redis/SQL backend is broken.

Step 5: Verify Redis Connectivity via Gate Health

Spinnaker's Gate, Orca, and Clouddriver all depend on Redis for caching and session state. Gate's /health endpoint aggregates Redis connectivity — when Redis is unreachable, Gate reports DOWN or partial health.

If your Gate health monitor is green, Redis connectivity to Gate is confirmed. For an additional explicit check, use Gate's detailed health endpoint:

curl https://spinnaker-api.example.com/health | python3 -m json.tool

Look for a redis key in the response. If the Redis key shows DOWN, add a separate TCP port monitor:

1. Add Monitor → TCP Port.
2. Host: redis.example.com (your Redis host).
3. Port: 6379.
4. Check interval: 60 seconds.
5. Label: Spinnaker Redis.
6. Click Save.

Redis failures are one of the most common causes of Spinnaker degradation — pipelines appear to submit but never progress, or Gate authentication sessions break.

Step 6: Set Up Deployment Pipeline Heartbeat Monitoring

A healthy Spinnaker installation does not guarantee your deployment pipelines are actually completing. Pipeline failures, stage timeouts, and infrastructure errors can stall releases silently. Use Vigilmon heartbeat monitoring to confirm scheduled pipelines run on time:

Step 6a — Create a Heartbeat monitor in Vigilmon:

1. Add Monitor → Heartbeat.
2. Name: Spinnaker nightly deployment pipeline.
3. Expected interval: match your pipeline schedule (e.g., 24 hours).
4. Grace period: 30 minutes.
5. Copy the generated ping URL.

Step 6b — Add a webhook stage to your Spinnaker pipeline:

In the Spinnaker pipeline editor, add a Webhook stage as the final step after all deploy stages succeed:

• Method: GET
• URL: https://vigilmon.online/ping/your-heartbeat-id

Every successful pipeline execution pings Vigilmon. A missed ping within the grace period triggers an alert — whether the cause is a failed stage, a Spinnaker service restart, or a frozen Orca orchestrator.

Step 7: Monitor SSL Certificates

Gate and Deck are both accessed over HTTPS. Certificate expiry breaks API calls from CI systems and blocks engineers from loading the Deck UI:

1. Add Monitor → SSL Certificate.
2. Domain: spinnaker-api.example.com (Gate domain).
3. Alert when expiry is within: 30 days.
4. Alert again at: 14 days, 7 days, 3 days.
5. Repeat with a second SSL monitor for spinnaker.example.com (Deck domain).

Step 8: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | Gate /health | Non-200 or UP missing | Check Gate pod/process; verify Redis and Orca connectivity | | Deck UI | Non-200 | Check Deck pod; may be isolated from Gate failure | | Clouddriver /health | Non-200 or UP missing | Check cloud provider credentials; verify Redis/SQL backend | | Redis TCP | Connection failure | Redis down; Gate and Orca will degrade; restart Redis | | Pipeline heartbeat | No ping within window | Pipeline stalled; check Orca logs and pipeline stage history | | SSL certificate | < 30 days | Renew; verify cert-manager or reverse proxy TLS config |

Common Spinnaker Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Gate process crash | Gate monitor fires; no API access; alert within 60 s | | Redis unreachable | Gate health returns DOWN; Redis TCP monitor fires | | Clouddriver credential expiry | Clouddriver health returns DOWN; deploys fail silently | | Orca orchestrator stalled | Pipeline heartbeat misses; Gate may stay green | | Deck pod OOMKilled | Deck monitor fires; Gate and pipelines continue | | SSL certificate expires | SSL monitor alerts at 30-day threshold | | Kubernetes cluster unreachable | Clouddriver DOWN; all K8s deploys fail | | Pipeline silently fails mid-stage | Heartbeat monitor fires after grace period |

Spinnaker's power comes from automating complex multi-cloud delivery workflows — but its microservice architecture means any single component failure can silently halt releases while the rest of the system appears healthy. Vigilmon's layered monitoring of Gate, Deck, Clouddriver, Redis, and pipeline heartbeats gives you complete external visibility into your CD platform, so you're alerted within minutes of any failure rather than discovering it when a release is hours overdue.

Start monitoring Spinnaker in under 5 minutes — register free at vigilmon.online.