Never Break the Chain: Securing the Container Supply Chain with Notary, TUF, and Gatekeeper
summary
Demo builds container images directly into Azure Container Registry, signs them with Notation/Notary (TUF) using keys stored in Azure Key Vault, and verifies signatures locally and at deploy time; Gatekeeper (OPA) plus Ratify enforce admission so images with mismatched sha256 signatures are denied. Automation is shown with Terraform and AKS using workload identity. Caveats: 24‑hour cluster refresh delay for rebuilt signatures and Helm-installed CRDs that persist after uninstall. Notation/Notary (TUF) Gatekeeper + OPA Ratify enforcement
AI-written summary · about
chapters (10)
- 0:00Securing container supply chains
- 3:34Container supply chain security
- 6:02OCI and OCI artifacts standards
- 7:27Notary for image integrity
- 10:15Open Policy Agent and Gatekeeper
- 13:53Ratify for policy workflow
- 15:20Live demo: signing and verifying images
- 21:16Implementation resources
- 23:27Q&A: signing identities
- 26:16Closing remarks
related talks
43mSecuring container deployments on Azure Kubernetes Service with open-source tools
34mSecuring your Kubernetes Delivery Pipelines with Notary and TUF
13mIncreasing trust in software supply chain w/ container image signing
35mEnforcing a Secure Supply Chain on Kubernetes
36mEnforcing a Secure Supply Chain on Kubernetes
40mEnforcing a Secure Supply Chain on Kubernetes
32mNotary v2: Redesigning the Secure Supply Chain for Containers
32mSecuring Your Container Native Supply Chain with SLSA, Github and Te...