From a signed build to an admitted pod

Scroll or pinch to zoom, drag to move, double-click to zoom in 100% SVG PNG Back to the post

Flow in six steps: the build produces an image digest; Notation signs the digest; the signature is stored in the registry as a referrer; a pod is created and Gatekeeper reviews it; Gatekeeper asks Ratify to verify; Ratify fetches the signature from the registry and returns a result so the pod is admitted or denied.