gatus

Tier-1 service health checks for the estate — a small status page (Gatus) at https://gatus.192.168.10.46.sslip.io.

What's here

• config/config.yaml — the source of truth: the endpoint list Gatus polls (grouped by identity, platform, secrets, cmdb, monitoring, core-network, observability, pipeline). Add a service = add an endpoint here.
• deploy/gatus.yaml — the Deployment + Service + Ingress (namespace gatus, image pinned).

Deploy / update

The config is mounted from a ConfigMap built from config/config.yaml:

kubectl create ns gatus --dry-run=client -o yaml | kubectl apply -f -
kubectl -n gatus create configmap gatus-config \
  --from-file=config.yaml=config/config.yaml --dry-run=client -o yaml | kubectl apply -f -
kubectl apply -f deploy/gatus.yaml
kubectl -n gatus rollout restart deploy/gatus   # pick up a config change

Add an endpoint

Append to config/config.yaml under endpoints: (HTTP [STATUS] == 200, or DNS [DNS_RCODE]):

  - name: <service>
    group: <group>
    url: "https://<service>.192.168.10.46.sslip.io/<health-path>"
    interval: 60s
    client: { insecure: true }          # lab-CA certs
    conditions: ["[STATUS] == 200"]

In-cluster targets (no ingress) use the service FQDN, e.g. http://loader.pipelines.svc.cluster.local:8080/healthz.

External endpoints (push-based, gatus #3)

Systems that Gatus can't actively probe push their status in, and Gatus aggregates + alerts on it.

Contract for producers:

POST /api/v1/endpoints/<group>_<name>/external?success=true|false&error=<msg>
Authorization: Bearer <GATUS_PUSH_TOKEN>

• key = <group>_<name> with spaces///_/,/. replaced by - (e.g. batch_base-chain-build).
• token: Infisical /stacks/monitoring GATUS_PUSH_TOKEN (k8s Secret gatus-push-token; injected into Gatus as ${GATUS_PUSH_TOKEN}). Missing/wrong token → 401.

Defined in config/config.yaml under external-endpoints: (token + alerts:). A success=false push flips the endpoint down and fires its alerts (ntfy + incident issue); success=true recovers it.

Producer wired: the weekly base-chain-build CronJob (pipelines, platform #32) pushes success=true on a verified build and success=false on any failure — dashboard tile + single alerting path.

⚠️ No dead-man's-switch yet: Gatus v5.13.1 has no heartbeat/staleness field, so a missing push does NOT auto-mark the endpoint down. The "heartbeat whose absence alerts" bonus needs a Gatus upgrade (≥ the version that adds external-endpoints[].heartbeat). Tracked separately.