Notary Project and Ratify: sign in CI, verify at admission

Scroll or pinch to zoom, drag to move, double-click to zoom in 100% SVG PNG Back to the post

Architecture: a build pipeline pushes an image to an OCI registry. The Notation CLI signs the image by digest using a signing key held in a KMS plugin or a certificate, and pushes the signature to the registry next to the image. In the cluster, the Kubernetes API sends pod creation to Gatekeeper, which calls Ratify as an external data provider. Ratify fetches the signature from the registry and verifies it against a trust policy and trust store.