Securing Cloud-Native Workloads: Hands-On with Notary Project, ORAS, and Ratify

Dive into this hands-on tutorial that demonstrates how to secure cloud-native workloads using open-source tools from the CNCF ecosystem. Learn why integrity and authenticity are crucial for a secure software supply chain, and follow along with practical examples of implementing Notary Project for signing container images, ORAS for artifact management, and Ratify for verification in Kubernetes environments. The session covers setting up your environment, preparing and signing container images, publishing images with their signatures to production, configuring Ratify with appropriate policies, and deploying verified images to Kubernetes clusters. By the end, gain a comprehensive understanding of end-to-end signing and verification processes that enhance your cloud-native security posture.