Admission Controller

Stable

Stop unsafe workloads before they enter your cluster.

The Kubewarden Admission Controller is an extensible, Kubernetes-native policy engine. It evaluates built-in and custom resources before admission to your cluster. Your policies can allow a request, modify its resources, or deny it.

Read the docs View on GitHub

Why the Admission Controller?

Write policies your way

Use Rust, Go, Rego, CEL and other familiar technologies.

Distribute like containers

Package and share policies through standard OCI registries.

Build once, run anywhere

Policies are compiled to WebAssembly for portability and isolation.

Start from the community

Use and extend a growing collection of ready-to-use policies.

Built for the people doing the work

For policy authors

Write, test, and share policies as regular software.

Use familiar languages and tooling
Reuse OPA, Gatekeeper and ValidatingAdmissionPolicy policies
Validate and mutate any Kubernetes resource
Test locally with kwctl, publish to any OCI registry

lib.rs

// validate incoming Pods
use kubewarden_policy_sdk as kubewarden;

fn validate(payload: &[u8]) -> CallResult {
    let req: ValidationRequest<Settings> =
        ValidationRequest::new(payload)?;
    // ... your policy logic here
    kubewarden::accept_request()
}

Learn about writing policies

For Kubernetes operators

Deploy and manage policies without extra complexity.

Manage policies as Kubernetes resources, GitOps-ready
Roll out safely in monitor mode before enforcing
Audit running workloads and get PolicyReports
Start from hundreds of ready-to-use policies

policy.yaml

apiVersion: policies.kubewarden.io/v1
kind: ClusterAdmissionPolicy
metadata:
  name: privileged-pods
spec:
  module: ghcr.io/kubewarden/policies/pod-privileged:v1.0.0
  rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["pods"]
      operations: ["CREATE"]

Learn about deploying policies

Ready to try it?

Install the Admission Controller with Helm and deploy your first policy in a few minutes.

# Add the Kubewarden Helm repository
helm repo add kubewarden https://charts.kubewarden.io

# Install the admission controller
helm install --wait -n kubewarden --create-namespace \
  admission-controller kubewarden/admission-controller

Follow the quickstart