Sigstore is the open-source software supply chain security ecosystem — Cosign signs container images, Fulcio issues short-lived signing certificates, and Rekor maintains a tamper-proof transparency log. If any of these components go down, your signing pipeline fails and deployments that require verified signatures are blocked.
In this tutorial you'll set up uptime monitoring for your Sigstore deployment (self-hosted or public infrastructure) using Vigilmon — free tier, no credit card required.
Why Sigstore infrastructure needs external monitoring
Sigstore is not just security tooling — it's a gate in your deployment pipeline. Failures block signed deployments, break policy enforcement, and can silently degrade your supply chain security posture:
- Fulcio CA unavailable — OIDC-based signing workflows fail; developers can't get short-lived certificates; signing steps in CI pipelines return 503 errors
- Rekor transparency log down — signature uploads fail; policy engines like Kyverno or OPA Gatekeeper that verify signatures against Rekor reject all images
- Rekor checkpoint endpoint degraded — monitors relying on signed tree heads (consistency proofs) can't verify log integrity; silent degradation
- TUF (The Update Framework) root rotation missed — Cosign clients using the public good infrastructure fail to fetch updated root metadata when the TUF server is unreachable
- Policy controller webhook failing — Kubernetes admission webhook rejections become unpredictable; either all images are blocked or the webhook fails open, bypassing policy
- CTFE (Certificate Transparency Frontend) degraded — certificate issuance succeeds but the signed timestamp token is missing, breaking timestamp verification in audit workflows
External monitoring gives you an independent view of each layer before failures cascade.
What you'll need
- Access to Sigstore infrastructure (public good at sigstore.dev, or self-hosted Fulcio/Rekor)
- Optional: a self-hosted Sigstore stack on Kubernetes
- A free Vigilmon account (sign up takes 30 seconds)
Step 1: Identify your Sigstore endpoints
Public good infrastructure (sigstore.dev):
Fulcio: https://fulcio.sigstore.dev
Rekor: https://rekor.sigstore.dev
TUF: https://tuf-repo-cdn.sigstore.dev
Self-hosted (example using sigstore/scaffolding Helm charts):
# Get your self-hosted endpoints
kubectl get ingress -n sigstore
# Or LoadBalancer services
kubectl get svc -n sigstore
Verify connectivity:
# Fulcio health check
curl https://fulcio.sigstore.dev/api/v2/configuration
# Rekor health check
curl https://rekor.sigstore.dev/api/v1/log
# Rekor latest checkpoint (signed tree head)
curl https://rekor.sigstore.dev/api/v1/log/proof/checkpoint
Step 2: Monitor Fulcio certificate issuance API
Fulcio's health is exposed through its gRPC-gateway HTTP API. The /api/v2/configuration endpoint returns issuer configuration without requiring authentication.
Log in to Vigilmon and navigate to Monitors → Add Monitor:
| Field | Value |
|-------|-------|
| Monitor type | HTTP |
| Name | Fulcio CA API |
| URL | https://fulcio.sigstore.dev/api/v2/configuration |
| HTTP method | GET |
| Expected status | 200 |
| Response must contain | oidcIssuers |
| Check interval | 1 minute |
| Regions | Select 3+ globally distributed regions |
For self-hosted Fulcio:
| Field | Value |
|-------|-------|
| Monitor type | HTTP |
| Name | Fulcio CA API (self-hosted) |
| URL | https://<your-fulcio-host>/api/v2/configuration |
| Expected status | 200 |
| Response must contain | oidcIssuers |
Step 3: Monitor the Rekor transparency log
Rekor's log API provides both health information and the current signed tree head. Two monitors give you different failure signals:
Monitor A: Rekor log info (basic health)
| Field | Value |
|-------|-------|
| Monitor type | HTTP |
| Name | Rekor Transparency Log |
| URL | https://rekor.sigstore.dev/api/v1/log |
| HTTP method | GET |
| Expected status | 200 |
| Response must contain | treeSize |
| Check interval | 1 minute |
Monitor B: Rekor checkpoint endpoint (log integrity)
The checkpoint endpoint returns a signed tree head. If this fails, log consistency proofs are broken:
| Field | Value |
|-------|-------|
| Monitor type | HTTP |
| Name | Rekor Checkpoint (signed tree head) |
| URL | https://rekor.sigstore.dev/api/v1/log/proof/checkpoint |
| HTTP method | GET |
| Expected status | 200 |
| Response must contain | rekor.sigstore.dev |
| Check interval | 2 minutes |
Step 4: Monitor the TUF metadata server
Cosign clients retrieve root of trust metadata from TUF. If this server is unreachable, clients fall back to bundled roots, which can cause failures when roots have been rotated.
# Verify TUF root is accessible
curl https://tuf-repo-cdn.sigstore.dev/root.json | python3 -m json.tool | head -20
Add a Vigilmon monitor:
| Field | Value |
|-------|-------|
| Monitor type | HTTP |
| Name | Sigstore TUF Root |
| URL | https://tuf-repo-cdn.sigstore.dev/root.json |
| HTTP method | GET |
| Expected status | 200 |
| Response must contain | signed |
| Check interval | 5 minutes |
Step 5: Monitor your Kubernetes policy controller webhook
The Sigstore policy controller runs as a Kubernetes admission webhook. If the webhook becomes unavailable, Kubernetes defaults to failurePolicy: Fail (blocks all images) or Fail (allows everything) depending on your config.
Export webhook endpoint health:
# Check the policy controller pods
kubectl get pods -n cosign-system
# Get the webhook service
kubectl get svc -n cosign-system policy-controller-webhook
Create a health probe deployment that tests the webhook is accepting connections:
# policy-webhook-probe/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: webhook-health-probe
namespace: cosign-system
spec:
replicas: 1
selector:
matchLabels:
app: webhook-health-probe
template:
metadata:
labels:
app: webhook-health-probe
spec:
containers:
- name: probe
image: python:3.11-slim
command: ["python3", "-c"]
args:
- |
import http.server, json, subprocess, socketserver
class Handler(http.server.BaseHTTPRequestHandler):
def do_GET(self):
if self.path == '/health':
try:
result = subprocess.run(
['kubectl', 'get', 'pods', '-n', 'cosign-system',
'-l', 'app=policy-controller', '-o', 'json'],
capture_output=True, text=True, timeout=5
)
pods = json.loads(result.stdout).get('items', [])
running = [p for p in pods
if p['status']['phase'] == 'Running']
status = 200 if running else 503
body = json.dumps({
'status': 'ok' if running else 'degraded',
'running_pods': len(running),
}).encode()
except Exception as e:
status = 503
body = json.dumps({'status': 'error', 'msg': str(e)}).encode()
self.send_response(status)
self.send_header('Content-Type', 'application/json')
self.end_headers()
self.wfile.write(body)
self.log_message = lambda *a: None
with socketserver.TCPServer(('', 9093), Handler) as s:
s.serve_forever()
ports:
- containerPort: 9093
---
apiVersion: v1
kind: Service
metadata:
name: webhook-health-probe-svc
namespace: cosign-system
spec:
type: LoadBalancer
selector:
app: webhook-health-probe
ports:
- port: 80
targetPort: 9093
Add a Vigilmon monitor:
| Field | Value |
|-------|-------|
| Monitor type | HTTP |
| Name | Sigstore Policy Controller Webhook |
| URL | http://<probe-svc-ip>/health |
| Expected status | 200 |
| Response must contain | "status":"ok" |
| Check interval | 1 minute |
Step 6: Monitor signing pipeline via a synthetic smoke test
The most reliable signal that Sigstore is working end-to-end is a synthetic sign-and-verify operation. Schedule this as a cron job in your cluster:
# signing-smoke-test/cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
name: sigstore-smoke-test
namespace: sigstore
spec:
schedule: "*/5 * * * *"
jobTemplate:
spec:
template:
spec:
serviceAccountName: sigstore-smoke-tester
restartPolicy: Never
containers:
- name: smoke-test
image: gcr.io/projectsigstore/cosign:v2.2.0
command: ["/bin/sh", "-c"]
args:
- |
set -e
# Sign a test blob (keyless, using workload identity)
echo "smoke-test-$(date +%s)" > /tmp/testblob.txt
cosign sign-blob --yes /tmp/testblob.txt \
--bundle /tmp/testblob.bundle \
--rekor-url $REKOR_URL \
--fulcio-url $FULCIO_URL
# Report result to health endpoint
if [ $? -eq 0 ]; then
curl -s -X POST http://smoke-test-results-svc/result \
-H 'Content-Type: application/json' \
-d '{"status":"ok","test":"sign-blob"}'
else
curl -s -X POST http://smoke-test-results-svc/result \
-H 'Content-Type: application/json' \
-d '{"status":"failed","test":"sign-blob"}'
fi
env:
- name: REKOR_URL
value: https://rekor.sigstore.dev
- name: FULCIO_URL
value: https://fulcio.sigstore.dev
- name: COSIGN_EXPERIMENTAL
value: "1"
Expose a simple results endpoint that returns the latest smoke test status, then add a Vigilmon HTTP monitor for it.
Step 7: Configure alerts
In Vigilmon, go to Alerts → Alert Channels and configure your notification channels (email, Slack, PagerDuty).
Recommended alert policy:
| Monitor | Alert after | Why | |---------|-------------|-----| | Fulcio CA API | 1 failure | Immediate: signing is broken | | Rekor Transparency Log | 1 failure | Immediate: signature verification fails | | Rekor Checkpoint | 2 failures | Brief: allow one retry before alerting | | TUF Root | 3 failures | TUF CDN can be temporarily slow | | Policy Controller Webhook | 1 failure | Immediate: all image admission is affected |
Enable Recovery alerts on all monitors so you know when the supply chain is healthy again.
Step 8: Create a supply chain security status page
For compliance and audit purposes, maintain a status page for your Sigstore infrastructure:
- In Vigilmon, go to Status Pages → Create Status Page
- Create a page named "Software Supply Chain Security"
- Add monitors grouped as:
- Signing Infrastructure: Fulcio CA, Rekor Log, Rekor Checkpoint
- Trust Metadata: TUF Root
- Policy Enforcement: Policy Controller Webhook
- Share the URL with your security and DevOps teams
What you're monitoring now
| Monitor | What it detects | |---------|-----------------| | Fulcio CA API HTTP | Certificate issuance failures; OIDC-based signing workflows broken | | Rekor Log HTTP | Transparency log unavailable; signature upload and lookup fail | | Rekor Checkpoint HTTP | Log integrity proofs broken; consistency verification fails | | TUF Root HTTP | Root metadata stale; Cosign client trust establishment fails | | Policy Controller HTTP | Admission webhook down; policy enforcement broken or blocking all images |
Conclusion
Sigstore is designed to make your software supply chain secure by default, but the security guarantees only hold when the infrastructure is healthy. Vigilmon lets you monitor every layer — from Fulcio's certificate issuance to Rekor's transparency log to your admission webhook — so supply chain failures are detected in seconds, not discovered during a deployment incident at 2 AM.
Sign up for a free Vigilmon account and start monitoring your software supply chain today.