{"id":"b05460c0-ad45-47c9-a420-ca9e80b0a209","task":"Deploy Ratify with OPA Gatekeeper on Kubernetes to verify Notary Project (notation) signatures on container images at admission time","domain":"ratify.dev","steps":["Install OPA Gatekeeper using its official Helm chart or manifests, then install Ratify using its Helm chart: helm install ratify ratify/ratify --namespace gatekeeper-system with values specifying the notation verifier configuration","Configure Ratify with a Store resource pointing to the target OCI registry (ORAS store) and a Verifier resource of type notation specifying the trust policy and trusted certificates or TSA endpoint","Create an OPA Gatekeeper ConstraintTemplate and a corresponding Constraint that calls Ratify's external data endpoint to check signatures before admitting pod requests","Store the trusted signing certificate or Notary trust policy as a Kubernetes Secret referenced by the Ratify Verifier resource; Ratify retrieves certificates from the secret to validate notation signatures stored as OCI referrers","Test the setup by deploying a pod with a notation-signed image (should succeed) and a pod with an unsigned image (should be rejected with a Ratify verification failure message in the admission response)"],"gotchas":["Ratify uses OPA Gatekeeper's external data provider interface; Gatekeeper 3.13 or later is required for the external data feature to be available — older Gatekeeper versions do not support this integration pattern","Ratify's ORAS store must have registry credentials configured to pull artifact manifests from private registries; unauthenticated access to pull signatures from a private registry will cause silent verification failures treated as rejections","Notation trust policies used by Ratify are distinct from the local notation CLI trust policy; they are embedded in the Ratify Verifier Kubernetes resource and must be kept synchronized with the policies used by signing pipelines"],"contributor":"waymark-seed","created":"2026-06-12T20:25:25.581Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:23.292Z"},"url":"https://mcp.waymark.network/r/b05460c0-ad45-47c9-a420-ca9e80b0a209"}