Constraining Container Resources with Kubewarden Kubewarden is a policy framework for Kubernetes that helps you set up tighter guardrails for your Kubernetes cluster. Policies allow you to restrict deployments on your cluster in many ways, like:
control the container images that are used permit only certain users to perform actions limit resources that can be assigned to a deployment. In this tutorial, we cover how to set up Kubewarden and apply a policy providing boundaries and defaults to container resource limits for pods.
Read more...
Hi all! This patch release ships several fixes for the community. One of them addresses a CVE, and the others fix usability issues in the secure supply chain features and improve how Gatekeeper Rego runtime handle errors without representing an actual security failure.
AdmissionPolicy unique-name collision enables cross-namespace webhook confusion Community security researcher Ville Vesilehto found a problem while testing Kubewarden’s namespaced admission policies. These policies should only evaluate resources in their own namespace.
Read more...
Here we are, at the tail end of July. Belugas are migrating up north for the season, green turtles are moving to the islands for nesting, and spawned sardines are moving up the east coast of Africa. Kubewarden doesn’t want to miss this season!
Migration to new single Helm chart admission-controller-6.0.0 Since its inception, the Kubewarden Admission Controller has shipped as 3 separate Helm charts: kubewarden-crds, kubewarden-controller, and kubewarden-defaults.
This was done for flexibility: it allowed cluster operators to install/uninstall CRDs, recommended policies and PolicyServers on its own, and bump each part of the stack separately.
Read more...
We are thrilled to announce the release of SBOMscanner v0.12.0! With this version, SBOMscanner takes a big step forward in its mission to provide a complete, SBOM-based security picture of your Kubernetes clusters. The highlight of this release is the brand new Node Scan feature, which extends visibility from container images all the way down to the nodes that run them.
Why scan nodes? Until now, SBOMscanner focused on what runs inside your cluster: container images pulled from your registries and, more recently, the workloads actually deployed on the cluster.
Read more...
The garden has a new nameplate! Kubewarden 1.36 renames the repository and its container images, changes how PolicyServer deletion works, adds host network support, and ships the docs on a new platform.
Breaking changes Repository and container image rename We renamed the kubewarden-controller repository to adm-controller. The old name stopped making sense once the project grew beyond a single admission controller.
The container images moved too:
kubewarden-controller is now just controller All images live under ghcr.
Read more...
We are happy to announce SBOMscanner v0.11.0. This release introduces an MCP server for AI assistants, a new way to target a subset of a registry from a ScanJob, supply chain hardening with zizmor, and several fixes for race conditions in the storage controller watches.
MCP server SBOMscanner now ships an MCP server that puts everything the controller knows in front of your AI assistant of choice. Instead of crafting kubectl queries across CRDs and joining the results in your head, you can ask Claude, Claude Code, GitHub Copilot, or any other MCP client questions like “which workloads in cluster prod are running an image with a critical CVE?
Read more...
This Admission Controller 1.35 release is one that builds the nest properly: load-bearing branches first, then careful weaving. A moderate security vulnerability has been fixed, and rather than a quick twig stuffed in a gap, the team reinforced the whole structure. This release brings also a new policy, an expansion on our threat model, and a JavaScrypt/TypeScrypt SDK relocation.
Security fix: RBAC reconnaissance and host capability calls Kubewarden makes the following security promise:
Read more...
After the big blooms of 1.33, this release turns its attention to the garden fence: making sure our CI pipelines are sturdy, our supply chain is trustworthy, and a nagging bug in kwctl gets pulled out by the roots. Nothing flashy, but the kind of care that keeps the garden healthy for the long haul. Let’s take a look at what’s new!
Fix for kwctl scaffold command When using kwctl command scaffold manifest with a policy URI that omits an explicit tag (e.
Read more...
The Kubewarden ecosystem continues to expand its supply chain security capabilities! Hot on the heels of the Admission Controller 1.33 release, we are excited to announce SBOMscanner v0.10.0. This release introduces powerful new features and critical stability fixes. Let’s dive in!
Workload Scan Until now, SBOMscanner required explicit Registry configurations to scan images. However, what usually matters most are the images actively running in your cluster.
The new Workload Scan feature automatically discovers and scans container images based on live workloads.
Read more...
The garden is thriving and Kubewarden 1.33 is ready to bloom! Following last release’s big repotting, this one is serious about pruning, including a security issue. It’s not all housekeeping though, fresh flowers are blooming and come with nice features: BYO-PKI landing in the policy-server, field mask filtering for context-aware calls, proxy support, and a few more treats. Let’s dig in!
Security fix: Cross-namespace data access, removal of deprecated API calls In our previous post we explained how our architecture protects namespaced policy users from privilege escalations.
Read more...
