Ratify is a cloud-native verification engine that checks the security metadata attached to your artifacts — signatures, SBOMs, vulnerability reports — and lets Kubernetes admit only the workloads that comply with your policy.

Welcome to Ratify: Verifying Supply Chain Security in Kubernetes.

Ratify is a CNCF sandbox project that answers a deceptively simple question at deploy time: should this container image be allowed to run? Modern supply-chain security produces a wealth of evidence — Notary Project and cosign signatures, software bills of materials, vulnerability scan reports — but that evidence is worthless unless something checks it before a workload reaches the cluster. Ratify is that something. It pulls the reference artifacts attached to an image, runs pluggable verifiers over them, evaluates the results against a policy you write, and returns a verdict to an admission controller such as OPA Gatekeeper, which admits or denies the pod. This book walks you through the whole picture: the problem Ratify solves, the executor-stores-verifiers-policy architecture, how reference artifacts are discovered, how signatures and SBOMs are verified, how keys and certificates are managed, how Ratify plugs into Gatekeeper as an external data provider, and how to configure, operate, and extend it in practice.

This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.

A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.

We hope it serves you well.

— Shriira Press

Contents

1. Chapter 1 — What Ratify Is
2. Chapter 2 — The Supply Chain Verification Problem
3. Chapter 3 — Architecture: Executor, Stores, Verifiers, Policy
4. Chapter 4 — Reference Artifacts and Stores
5. Chapter 5 — Verifiers: Signatures, SBOMs, and Scans
6. Chapter 6 — Keys, Certificates, and Policy
7. Chapter 7 — Ratify and Gatekeeper Admission Control
8. Chapter 8 — Ratify in Practice