Monitoring Cosign with Vigilmon: Sigstore Transparency Log, OIDC Token Endpoint & Registry Health Alerts

Cosign is the Sigstore tool for signing and verifying container images and OCI artifacts. Its signing workflow depends on a chain of external services: Fulcio (the OIDC-based certificate authority), Rekor (the transparency log), and the OCI registry that stores the signature. When any link in this chain becomes unavailable, your CI/CD pipelines can't sign new images, your admission controllers can't verify image signatures before allowing deployments, and your supply chain integrity guarantees collapse. Vigilmon gives you external visibility into every Sigstore service your signing workflow depends on.

What You'll Build

• A monitor on the Rekor transparency log API to detect signing outages
• A check on Fulcio's OIDC certificate issuance endpoint
• A registry availability monitor to confirm signature storage is reachable
• SSL certificate monitoring for any self-hosted Sigstore components
• An alerting table mapping each Sigstore failure mode to its remediation action

Prerequisites

• Cosign configured in your CI/CD pipeline for image signing or policy-based verification
• A Sigstore deployment (public Sigstore, enterprise Sigstore, or self-hosted)
• A free account at vigilmon.online

Step 1: Understand the Cosign Infrastructure Dependencies

A standard cosign sign invocation touches multiple external services:

cosign sign --key <key-or-oidc> registry.example.com/myapp:latest

This command:

1. Requests a short-lived signing certificate from Fulcio (https://fulcio.sigstore.dev) via OIDC
2. Writes the certificate and signature to the OCI registry alongside the image
3. Appends a transparency log entry to Rekor (https://rekor.sigstore.dev)

During cosign verify, the process runs in reverse — Rekor is queried to confirm the signature was logged, Fulcio's root CA is used to validate the signing certificate, and the OCI registry is queried for the signature artifact.

If you use the public Sigstore instance, you are relying on these shared services. If you run a private Sigstore deployment, you own the uptime of all three components.

Step 2: Monitor the Rekor Transparency Log

Rekor is the append-only transparency log that provides non-repudiation for Cosign signatures. Its health endpoint confirms that the log server is running and accepting requests:

curl https://rekor.sigstore.dev/api/v1/log
# Returns JSON with treeSize, treeID, and rootHash

For a self-hosted Rekor instance:

curl https://rekor.example.com/api/v1/log
# Returns: {"treeSize": <n>, "treeID": <id>, "rootHash": "<hash>", ...}

1. Log in to Vigilmon → Add Monitor → HTTP.
2. URL: https://rekor.sigstore.dev/api/v1/log (or your self-hosted Rekor URL).
3. Check interval: 2 minutes.
4. Response timeout: 15 seconds.
5. Expected status: 200.
6. Keyword: treeSize (always present in a healthy Rekor API response).
7. Label: Rekor transparency log.
8. Click Save.

This monitor catches:

• Rekor service outages that prevent cosign sign from recording transparency log entries
• Rekor API failures that cause cosign verify to fail policy checks requiring Rekor inclusion
• Self-hosted Rekor database connectivity failures
• Network partitions between your Sigstore deployment and the Rekor backend

Alert sensitivity: 1 consecutive failure. A Rekor outage means your CI/CD pipeline cannot produce signed images that include a transparency log entry, which most policy engines require.

Step 3: Monitor the Fulcio OIDC Certificate Authority

Fulcio issues short-lived X.509 signing certificates to OIDC identities (GitHub Actions, GitLab CI, Google Cloud identity, etc.). Its health endpoint confirms the CA is running:

curl https://fulcio.sigstore.dev/api/v2/configuration
# Returns: {"oidcIssuers": [...], "metaIssuers": [...]}

For self-hosted Fulcio:

curl https://fulcio.example.com/api/v2/configuration

1. Add Monitor → HTTP.
2. URL: https://fulcio.sigstore.dev/api/v2/configuration (or your self-hosted Fulcio URL).
3. Check interval: 2 minutes.
4. Response timeout: 15 seconds.
5. Expected status: 200.
6. Keyword: oidcIssuers (present in every healthy Fulcio configuration response).
7. Label: Fulcio OIDC CA.
8. Click Save.

Keyless vs key-based signing: If you use cosign sign --key with a static key pair rather than keyless OIDC signing, Fulcio is not required. In that case, skip this monitor and focus on Rekor and your registry. If you use keyless signing (the recommended modern workflow), Fulcio is required for every cosign sign invocation.

Step 4: Monitor the OCI Registry Storing Signatures

Cosign stores signatures as OCI artifacts in the same registry as the images being signed, under a predictable tag derived from the image digest. Registry availability is a prerequisite for both signing and verification:

curl -I https://registry.example.com/v2/
# HTTP 200 or 401 = registry healthy

1. Add Monitor → HTTP.
2. URL: https://registry.example.com/v2/.
3. Check interval: 60 seconds.
4. Response timeout: 15 seconds.
5. Expected status: 200 (or 401 for auth-gated registries).
6. Label: Cosign signature registry.
7. Click Save.

Public registries (GHCR, Docker Hub, GCR): If you sign images stored in a public registry, add a monitor to that registry's API endpoint. Registry outages are infrequent but impactful — during a GHCR or Docker Hub outage, both image pulls and signature verification operations fail simultaneously, blocking deployments across your entire fleet.

Step 5: Monitor SSL Certificates for Self-Hosted Components

If you run a private Sigstore deployment (Rekor, Fulcio, or a Cosign-aware admission controller), TLS certificate expiry will break every signing and verification workflow:

openssl s_client -connect rekor.example.com:443 2>/dev/null | openssl x509 -noout -dates
openssl s_client -connect fulcio.example.com:443 2>/dev/null | openssl x509 -noout -dates

Add an SSL certificate monitor for each self-hosted Sigstore component:

1. Add Monitor → SSL Certificate.
2. Domain: rekor.example.com (repeat for fulcio.example.com and any other components).
3. Alert when expiry is within: 30 days.
4. Alert again: 14 days, 7 days, 3 days, 1 day.
5. Click Save.

Cosign embeds the Sigstore TrustRoot configuration — including the expected root certificate fingerprints — in your policy. If a self-hosted Rekor or Fulcio certificate expires and you reissue with a new CA chain, you must also update all TrustRoot references in your Kubernetes admission policies (e.g., in Kyverno ClusterImagePolicies or Sigstore Policy Controller policies). Certificate changes are therefore more disruptive than in typical HTTPS services.

Step 6: Configure Alerting

In Vigilmon under Settings → Notifications, configure alert channels for each monitor:

| Monitor | Trigger | Remediation action | |---|---|---| | Rekor transparency log | Non-200 or treeSize missing | Check Rekor pod logs; verify Trillian backend; kubectl logs -n rekor-system | | Fulcio OIDC CA | Non-200 or oidcIssuers missing | Check Fulcio pod; verify OIDC provider connectivity; review cert-manager | | Signature registry | Non-200/401 response | Registry outage; check registry pod or contact registry provider | | SSL certificate | < 30 days to expiry | Renew certificate; update TrustRoot in admission policies after reissue |

Alert thresholds: 1 consecutive failure for Rekor and Fulcio — these are synchronous dependencies for every signing invocation. Use 2 consecutive failures for the registry monitor to filter transient 5xx responses.

Common Cosign / Sigstore Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Rekor API is down (public Sigstore outage) | Rekor monitor fires; cosign sign fails with transparency log error | | Fulcio returns 503 (OIDC backend overloaded) | Fulcio monitor fires; keyless signing fails with certificate issuance error | | Registry is unreachable | Registry monitor fires; signatures cannot be pushed or pulled | | Rekor's Trillian backend loses its database | Rekor monitor fires; log server returns errors | | Self-hosted Rekor SSL certificate expires | SSL monitor fires; Cosign CLI rejects connection with TLS error | | Fulcio root CA certificate in policy outdated | Policy verification fails; SSL monitor catches if cert rotated | | Sigstore Policy Controller webhook timeout | Kubernetes admission fails open or closed depending on failurePolicy | | DNS misconfiguration for Sigstore endpoints | All monitors fire simultaneously | | Network policy blocks egress to Sigstore | Cosign fails inside CI; Vigilmon catches registry and log outages |

Cosign enforces supply chain integrity at the boundary between build and deploy — but that boundary only holds when Rekor, Fulcio, and your image registry are all reachable. A Sigstore outage doesn't just prevent new deployments; it can block rollbacks, break admission controllers, and leave your policy enforcement in an undefined state. Vigilmon gives you external eyes on every dependency, so you're the first to know when the signing chain is broken — not your platform team's Slack channel at 2am.

Start monitoring your Cosign infrastructure in under 5 minutes — register free at vigilmon.online.