KrakenD API Gateway Health & Ingress Latency Sentinel

id: krakend-api-gateway-health-and-ingress-latency-sentinel
namespace: company.platform

description: "Continuously audits KrakenD API Gateway health and ingress
  availability, monitors upstream backend error rates and latency degradation,
  alerts via Slack, and prevents microservice traffic disruption."

inputs:
  - id: krakend_host
    type: STRING
    defaults: "localhost"
    description: "Hostname or IP address of the KrakenD API Gateway instance."

  - id: krakend_port
    type: INT
    defaults: 8080
    description: "HTTP port for the KrakenD gateway ingress service (default: 8080)."

  - id: max_acceptable_latency_ms
    type: INT
    defaults: 1500
    description: "Maximum allowable latency threshold in milliseconds before
      flagging gateway degradation (default: 1500 ms)."

  - id: dry_run
    type: BOOL
    defaults: true
    description: "Safety gate: when true, audits and emits alerts without triggering
      automated configuration reload or container restarts."

  - id: slack_channel
    type: STRING
    defaults: "#gateway-alerts"
    description: "Target Slack channel for KrakenD gateway health outages and canary
      degradation alerts."

triggers:
  - id: periodic_krakend_audit
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true

tasks:
  - id: probe_gateway_health
    type: io.kestra.plugin.core.http.Request
    description: "Polls KrakenD /__health endpoint to verify gateway daemon
      responsiveness and runtime availability."
    uri: "http://{{ inputs.krakend_host }}:{{ inputs.krakend_port }}/__health"
    method: GET
    options:
      timeout:
        readIdleTimeout: PT15S

  - id: probe_gateway_canary
    type: io.kestra.plugin.core.http.Request
    description: "Executes synthetic canary probe against /__echo to evaluate
      ingress pipeline transit and response integrity."
    uri: "http://{{ inputs.krakend_host }}:{{ inputs.krakend_port }}/__echo"
    method: GET
    options:
      timeout:
        readIdleTimeout: PT15S

  - id: classify_gateway_status
    type: io.kestra.plugin.core.flow.Switch
    description: "Categorizes gateway operational health into GATEWAY_OUTAGE,
      CANARY_FAILED, or HEALTHY based on probe responses."
    value: >-
      {% if outputs.probe_gateway_health.code != 200 %} GATEWAY_OUTAGE {% elif
      outputs.probe_gateway_canary.code != 200 or not
      (outputs.probe_gateway_canary.body is defined) %} CANARY_FAILED {% else %}
      HEALTHY {% endif %}
    cases:
      GATEWAY_OUTAGE:
        - id: alert_gateway_outage_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Dispatches critical incident notification when KrakenD health
            check reports service outage or non-200 code."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "channel": "{{ inputs.slack_channel }}",
              "text": ":rotating_light: *KrakenD API Gateway Health Degraded: Service Outage*",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":rotating_light: *KrakenD Gateway Health Outage*\n*Gateway:* `http://{{ inputs.krakend_host }}:{{ inputs.krakend_port }}`\n*Health Code:* `{{ outputs.probe_gateway_health.code }}`\n*Impact:* Inbound client API traffic is failing or being dropped at the ingress tier."
                  }
                }
              ]
            }

      CANARY_FAILED:
        - id: alert_canary_degraded_slack
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Dispatches warning alert when synthetic canary probe indicates
            ingress routing failure or backend timeout."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "channel": "{{ inputs.slack_channel }}",
              "text": ":warning: *KrakenD Gateway Warning: Ingress Canary Route Failed*",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":warning: *KrakenD Synthetic Canary Probe Failure*\n*Gateway:* `http://{{ inputs.krakend_host }}:{{ inputs.krakend_port }}`\n*Canary Code:* `{{ outputs.probe_gateway_canary.code }}`\n*Action:* Inspect downstream backend endpoint availability and routing rules in `krakend.json`."
                  }
                }
              ]
            }

        - id: check_diagnostic_collection
          type: io.kestra.plugin.core.flow.If
          description: "Safeguard check ensuring diagnostic logging only triggers
            according to dry-run configuration."
          condition: "{{ inputs.dry_run == true }}"
          then:
            - id: log_dry_run_diagnostics
              type: io.kestra.plugin.core.log.Log
              message: "Dry-run active: canary probe degradation recorded without triggering
                automated container restart."
          else:
            - id: log_live_remediation_intent
              type: io.kestra.plugin.core.log.Log
              message: "Live mode: gateway canary degraded on {{ inputs.krakend_host }}. Ready
                for automated gateway hot-reload."

      HEALTHY:
        - id: log_healthy_state
          type: io.kestra.plugin.core.log.Log
          description: "Logs nominal status when both health endpoint and synthetic canary
            probes succeed."
          message: "KrakenD API Gateway is healthy on {{ inputs.krakend_host }}:{{
            inputs.krakend_port }}. Ingress routes operational."

  - id: log_sentinel_audit_summary
    type: io.kestra.plugin.core.log.Log
    description: "Emits immutable audit record documenting evaluated status, probe
      codes, and execution lineage."
    message: "KrakenD sentinel audit complete for http://{{ inputs.krakend_host
      }}:{{ inputs.krakend_port }}. Status: {{
      outputs.classify_gateway_status.value | trim }} | Health Code: {{
      outputs.probe_gateway_health.code }} | Execution: {{ execution.id }}"

errors:
  - id: alert_krakend_network_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: "Dispatches emergency Slack alert if the KrakenD gateway container
      is down, unreachable, or network partitioned."
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "channel": "{{ inputs.slack_channel }}",
        "text": ":fire: *KrakenD Gateway Connection Refused Outage*",
        "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": ":fire: *KrakenD Gateway Connection Failure*\nFailed to connect to KrakenD instance at `http://{{ inputs.krakend_host }}:{{ inputs.krakend_port }}`. The gateway process may have crashed, port binding failed, or container terminated."
            }
          }
        ]
      }