tutorial

Monitoring Signadot with Vigilmon: Operator Health, Sandbox API Availability, Route Group Status & Test Session Heartbeats

How to monitor Signadot (Kubernetes sandbox environments for integration testing) with Vigilmon — operator health checks, sandbox API availability, route group status, SSL certificate monitoring, and test session heartbeats.

Signadot provides Kubernetes sandbox environments that let development teams test service changes in production-like conditions without deploying to a shared staging environment. The Signadot operator manages sandbox lifecycle, the control plane routes traffic to the correct sandbox variants, and the API server provides visibility into running test sessions. A crashed Signadot operator freezes all new sandbox provisioning, a degraded routing layer silently routes test traffic to the wrong service version, and an unavailable API server leaves developers unable to inspect the state of their test sessions. Vigilmon gives you external visibility into the Signadot operator health, sandbox API availability, route group status, SSL certificates, and test session heartbeats so you catch infrastructure failures before they corrupt your integration tests.

What You'll Build

  • A monitor on the Signadot API server health endpoint
  • A sandbox API availability check via the REST API
  • A route group status check via keyword matching
  • SSL certificate monitoring for the Signadot API endpoint
  • A heartbeat monitor confirming scheduled test session jobs complete on time

Prerequisites

  • A running Signadot installation with the operator deployed in Kubernetes
  • Signadot API server accessible over HTTPS (via an Ingress or the Signadot cloud endpoint)
  • A free account at vigilmon.online

Step 1: Verify the Signadot API Health Endpoint

The Signadot API server exposes a health check confirming the operator and control plane are reachable:

curl https://api.signadot.com/api/v2/orgs/your-org/sandboxes \
  -H "signadot-api-key: your-api-key"

A healthy response returns an array of running sandboxes (or an empty array when none are active):

{"sandboxes":[]}

This confirms the Signadot control plane is alive and authentication is working.

Step 2: Create a Vigilmon HTTP Monitor for the Signadot API

  1. Log in to Vigilmon → Add Monitor → HTTP.
  2. URL: https://api.signadot.com/api/v2/orgs/your-org/sandboxes.
  3. Check interval: 60 seconds.
  4. Response timeout: 15 seconds.
  5. Expected status: 200.
  6. Keyword: sandboxes.
  7. HTTP Headers: signadot-api-key: your-api-key.
  8. Label: Signadot API Health.
  9. Click Save.

Set alerts to trigger after 2 consecutive failures — transient API timeouts occur during control plane updates; two failures indicate a genuine outage.

API key security: Store your Signadot API key as an environment variable or secret. Vigilmon's header configuration keeps it out of URLs and logs.

Step 3: Monitor the Signadot Operator via Webhook Endpoint

When deploying Signadot on-premises or in a self-hosted control plane configuration, the Signadot operator registers admission webhooks that intercept Sandbox resource creation. A degraded webhook blocks sandbox provisioning silently at the admission layer:

curl -k https://signadot-webhook.signadot-system.svc.cluster.local:443/healthz

Expose this endpoint via an Ingress for external monitoring, then:

  1. Add Monitor → HTTP.
  2. URL: https://signadot-webhook.example.com/healthz.
  3. Check interval: 2 minutes.
  4. Expected status: 200.
  5. Label: Signadot Operator Webhook.
  6. Click Save.

Step 4: Monitor Route Group Status

Signadot uses RouteGroups to define traffic routing rules that direct test requests to the correct sandbox variants. When a RouteGroup fails to apply, all test sessions using that group route traffic incorrectly — test results become unreliable without any obvious error:

curl https://api.signadot.com/api/v2/orgs/your-org/routegroups \
  -H "signadot-api-key: your-api-key"

A healthy response contains route groups with their associated status:

{"routeGroups":[{"name":"frontend-routes","status":"Ready"}]}

Add a monitor using keyword matching:

  1. Add Monitor → HTTP.
  2. URL: https://api.signadot.com/api/v2/orgs/your-org/routegroups.
  3. Check interval: 5 minutes.
  4. Expected status: 200.
  5. Keyword: routeGroups.
  6. HTTP Headers: signadot-api-key: your-api-key.
  7. Label: Signadot Route Groups.
  8. Click Save.

Keyword limitation: The routeGroups keyword confirms the endpoint is healthy but does not detect individual route group failures. For deeper health checks, consider pairing with Signadot's Prometheus metrics.

Step 5: Monitor Cluster Registration Status

Signadot registers connected Kubernetes clusters as targets for sandbox deployment. A cluster that loses connectivity to the Signadot control plane cannot receive new sandboxes, and existing sandbox routes become stale:

curl https://api.signadot.com/api/v2/orgs/your-org/clusters \
  -H "signadot-api-key: your-api-key"

A healthy response includes your clusters with their connectivity state:

{"clusters":[{"name":"production-cluster","connected":true}]}
  1. Add Monitor → HTTP.
  2. URL: https://api.signadot.com/api/v2/orgs/your-org/clusters.
  3. Check interval: 5 minutes.
  4. Expected status: 200.
  5. Keyword: clusters.
  6. Label: Signadot Cluster Registration.
  7. Click Save.

Step 6: Set Up Test Session Heartbeat Monitoring

CI/CD pipelines that use Signadot to provision sandboxes for integration tests can silently fail if the sandbox never becomes ready or the test runner exits without cleaning up. Use Vigilmon heartbeat monitoring to confirm test pipelines complete on schedule:

Step 6a — Create a Heartbeat monitor in Vigilmon:

  1. Add Monitor → Heartbeat.
  2. Name: Signadot nightly integration tests.
  3. Expected interval: 24 hours (or match your pipeline schedule).
  4. Grace period: 30 minutes.
  5. Copy the generated ping URL (e.g., https://vigilmon.online/ping/abc123).

Step 6b — Add a ping step to your CI/CD pipeline:

# GitHub Actions example
- name: Run integration tests with Signadot
  run: |
    # Create sandbox and run tests
    signadot sandbox apply --set image.tag=${{ github.sha }}
    signadot sandbox wait --timeout 5m
    pytest tests/integration/
    # Ping Vigilmon only on success
    curl -fsS -m 10 https://vigilmon.online/ping/abc123

- name: Cleanup sandbox
  if: always()
  run: signadot sandbox delete

If the CI job fails before reaching the ping step, or the pipeline is cancelled, Vigilmon fires an alert after the grace period expires.

Step 7: Monitor SSL Certificates

Signadot's API is consumed by CLI tooling, CI/CD pipelines, and developer dashboards. An expired certificate breaks all automated sandbox operations:

  1. Add Monitor → SSL Certificate.
  2. Domain: api.signadot.com (or your self-hosted domain).
  3. Alert when expiry is within: 30 days.
  4. Alert again at: 14 days, 7 days, 3 days, 1 day.
  5. Click Save.

Step 8: Configure Alerting

In Vigilmon under Settings → Notifications, configure your alert channels:

| Monitor | Trigger | Action | |---|---|---| | API health | Non-200 or sandboxes missing | Check Signadot control plane status; contact support | | Operator webhook | Non-200 | Webhook pod down; sandbox admission blocked | | Route groups | Non-200 or routeGroups absent | Routing layer degraded; test sessions may route incorrectly | | Cluster registration | clusters absent | Cluster disconnected; sandbox deployments blocked | | Test session heartbeat | No ping within window | Pipeline failed; check CI logs and sandbox status | | SSL certificate | < 30 days | Renew; verify cert-manager or Signadot cloud TLS |

Common Signadot Failure Modes and What Vigilmon Catches

| Scenario | Vigilmon monitor | |---|---| | Signadot control plane outage | API health unreachable; alert within 60 s | | Operator webhook pod crash | Webhook monitor fires; sandbox creation blocked | | RouteGroup fails to apply | Route group monitor fires; test traffic routes to wrong variant | | Cluster loses control plane connectivity | Cluster monitor fires; new sandboxes cannot deploy | | CI pipeline fails silently | Heartbeat monitor alerts after grace period | | SSL certificate expires | SSL monitor alerts at 30-day threshold | | API key revoked or rotated | All API monitors return 401; alert immediately | | Sandbox provisioning timeout | Test heartbeat misses; pipeline hangs without completing |

Signadot's power comes from its ability to isolate test traffic per sandbox variant — but that isolation depends entirely on the operator, routing layer, and cluster connectivity working together. A silent failure in any one component corrupts test results without triggering any application-level error. Vigilmon's layered monitoring of the API server, operator webhook, route groups, cluster registration, test session heartbeats, and SSL certificates gives you external visibility across every layer of Signadot's testing infrastructure, so you catch failures before they invalidate your integration test suite.

Start monitoring Signadot in under 5 minutes — register free at vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles