Admission Controller on Kubewarden

Preventing containers from sharing the PID namespace with Kubewarden

Wed, 09 Sep 2026 00:00:00 +0000

The PID namespace

A container consists of one or more processes on the host. Kernel primitives, such as namespaces, isolate these processes. A process in a PID (process ID) namespace can see processes in the same namespace and its descendants, but nothing outside of the namespace. For containers, this isolation prevents processes in one container from seeing or interacting with processes in other containers or on the host.

To test the impact of missing PID isolation, try to disable it in Docker or Podman using the --pid=host flag:

Constraining Container Resources with Kubewarden

Mon, 31 Aug 2026 00:00:00 +0000

Kubewarden is a policy framework for Kubernetes that helps you set up tighter guardrails for your Kubernetes cluster. Policies allow you to restrict deployments on your cluster in many ways, like:

control the container images that are used
permit only certain users to perform actions
limit resources that can be assigned to a deployment.

In this tutorial, we cover how to set up Kubewarden and apply a policy providing boundaries and defaults to container resource limits for pods. You need is a running Kubernetes cluster (for example, k3s) and Helm to get started!

Admission controller 1.37.2 Release

Mon, 17 Aug 2026 00:00:00 +0000

Hi all! This patch release ships several fixes for the community. One of them addresses a CVE, and the others fix usability issues in the secure supply chain features and improve how Gatekeeper Rego runtime handle errors without representing an actual security failure.

AdmissionPolicy unique-name collision enables cross-namespace webhook confusion

Community security researcher Ville Vesilehto found a problem while testing Kubewarden’s namespaced admission policies. These policies should only evaluate resources in their own namespace. Ville’s finding shows that wasn’t always true.

Admission Controller 1.37 Release

Mon, 27 Jul 2026 00:00:00 +0000

Here we are, at the tail end of July. Belugas are migrating up north for the season, green turtles are moving to the islands for nesting, and spawned sardines are moving up the east coast of Africa. Kubewarden doesn’t want to miss this season!

Migration to new single Helm chart admission-controller-6.0.0

Since its inception, the Kubewarden Admission Controller has shipped as 3 separate Helm charts: kubewarden-crds, kubewarden-controller, and kubewarden-defaults.

This was done for flexibility: it allowed cluster operators to install/uninstall CRDs, recommended policies and PolicyServers on its own, and bump each part of the stack separately.

Admission Controller 1.36 Release

Tue, 02 Jun 2026 00:00:00 +0000

The garden has a new nameplate! Kubewarden 1.36 renames the repository and its container images, changes how PolicyServer deletion works, adds host network support, and ships the docs on a new platform.

Breaking changes

Repository and container image rename

We renamed the kubewarden-controller repository to adm-controller. The old name stopped making sense once the project grew beyond a single admission controller.

The container images moved too:

kubewarden-controller is now just controller
All images live under ghcr.io/kubewarden/adm-controller/

For example:

Admission Controller 1.35 Release

Mon, 27 Apr 2026 00:00:00 +0000

This Admission Controller 1.35 release is one that builds the nest properly: load-bearing branches first, then careful weaving. A moderate security vulnerability has been fixed, and rather than a quick twig stuffed in a gap, the team reinforced the whole structure. This release brings also a new policy, an expansion on our threat model, and a JavaScrypt/TypeScrypt SDK relocation.

Security fix: RBAC reconnaissance and host capability calls

Kubewarden makes the following security promise:

Kubewarden 1.34 Release

Thu, 09 Apr 2026 00:00:00 +0000

After the big blooms of 1.33, this release turns its attention to the garden fence: making sure our CI pipelines are sturdy, our supply chain is trustworthy, and a nagging bug in kwctl gets pulled out by the roots. Nothing flashy, but the kind of care that keeps the garden healthy for the long haul. Let’s take a look at what’s new!

Fix for `kwctl scaffold` command

When using kwctl command scaffold manifest with a policy URI that omits an explicit tag (e.g. registry://ghcr.io/kubewarden/policies/pod-privileged), users would hit an unexpected error: “Cannot find policy with uri”.

Admission Controller 1.33 Release

Mon, 09 Mar 2026 00:00:00 +0000

The garden is thriving and Kubewarden 1.33 is ready to bloom! Following last release’s big repotting, this one is serious about pruning, including a security issue. It’s not all housekeeping though, fresh flowers are blooming and come with nice features: BYO-PKI landing in the policy-server, field mask filtering for context-aware calls, proxy support, and a few more treats. Let’s dig in!

Security fix: Cross-namespace data access, removal of deprecated API calls

In our previous post we explained how our architecture protects namespaced policy users from privilege escalations. While this still stands, Ville Vesilehto (thevilledev on GitHub) found the following security vulnerability: an attacker with permissions to create AdmissionPolicies could make use of 3 deprecated host-callbacks (kubernetes/ingresses, kubernetes/namespaces, kubernetes/services) to craft a policy that would allow them read access to Ingresses, Namespaces, and Services resources respectively.

Not affected by cross-ns privilege escalation via policy api call

Mon, 16 Feb 2026 00:00:00 +0000

Why Kubewarden is not affected by CVE-2026-22039

The recent vulnerability CVE-2026-22039 is doing the rounds in the Kubernetes security community, with dramatic titles such as “How an admission controller vulnerability turned Kubernetes namespaces into a security illusion”. You can read about people doubting admission controllers, claiming they have too much power, or they represent too high a value target.

In this blogpost, we reassure Kubewarden users that they aren’t affected thanks to our architecture, and explain why.

Kubewarden 1.32 Release

Thu, 05 Feb 2026 00:00:00 +0000

Another year rolls around, and Kubewarden is still growing like a well-watered houseplant! Kubewarden got a New Year’s resolution to tidy up and repot, and has gone full on with digital gardening. This release is a maintenance one, with big moves to monorepos and a refresh in release artifacts.

New Admission Controller monorepo

With the addition of SBOMscanner to the Kubewarden harvest, we saw a great opportunity for cleanup on the Admission Controller side.

The year in review: Kubewarden's progress in 2025

Wed, 07 Jan 2026 00:00:00 +0000

Join us in celebrating a fruitful 2025 for the Kubewarden project!

The team has spent time planting kernels and enjoying the fruit of the grown ideas. Let’s look together at what the basket brings as we say ciao to 2025. Grab anything you like for the trip!

Expanding the Scope: Introducing SBOMScanner

2025 saw Kubewarden expand beyond admission policies with the introduction of SBOMScanner, a new project donated to CNCF under the Kubewarden umbrella.

Kubewarden 1.31 Release

Tue, 25 Nov 2025 00:00:00 +0000

Preparing for season celebrations, Kubewarden grabbed its running shoes and went for a lively jog. This release is about keeping your cluster environment fit and lively: new policy, new Sigstore airgap features, backup support, and new resource limits for our Helm charts and among other things.

The running group is growing too!

New peer project: SBOMScanner

As announced some weeks ago, the Kubewarden family is growing with the addition of SBOMscanner. Have a read of its blog post here.

Introducing the Kubewarden JavaScript/TypeScript SDK

Tue, 18 Nov 2025 00:00:00 +0000

Writing Kubewarden policies is now even more accessible. Today, we’re excited to announce the alpha release of the Kubewarden JavaScript/TypeScript SDK, bringing policy development to the world’s most popular programming language.

Why JavaScript for Kubernetes Policies?

Kubewarden has always been about choice, letting you write policies in the language you’re most comfortable with. The JavaScript/TypeScript SDK opens Kubewarden to an entirely new audience, the millions of developers already familiar with the JavaScript ecosystem. You no longer need to learn a new language just to write a Kubewarden policy.

Expanding Kubewarden Scope

Tue, 11 Nov 2025 00:00:00 +0000

The Kubewarden project was created four years ago at SUSE with the goal of redefining Policy As Code. We built a universal policy engine for Kubernetes and donated it to the CNCF.

When the project started, policies could only be written in Rust and Go. Since then, we’ve worked to increase flexibility. Today, policies can also be written in other programming languages such as C#, and even JavaScript and TypeScript (stay tuned for the upcoming announcement).

Kubewarden 1.30 Release

Thu, 30 Oct 2025 00:00:00 +0000

Today, Kubewarden 1.30 woke up, shook itself, stretched its wings and took off to a cluster near you! This release brings in its beak a bunch of policy features, and performs some future-proofing migrations.

Migration to OpenReports

So far, the Kubewarden Audit Scanner feature has been using the PolicyReports CRDs from policyreports.wgpolicyk8s.io to save its results. These CRDs came from the Kubernetes Policy Working Group and enabled standardized reporting across policy engines.

Policy Server 1.29.2 Patch Release

Fri, 17 Oct 2025 00:00:00 +0000

Earlier this week we published a patch release of Policy Server. The fix was required to avoid a crash at startup time.

The crash was caused by some changes inside the Sigstore TUF repository, specifically the introduction of a new public key for the Rekor service. The Rust library we use to interact with Sigstore could not handle this change, resulting in an error.

The patch we issued on Monday allowed Policy Server to continue operating in a degraded mode. Everything worked as expected except for signature verification, which always failed with an error.

Kubewarden 1.29.1 Patch Release

Mon, 13 Oct 2025 00:00:00 +0000

Today, we released patch updates for both Policy Server and kwctl.

These releases address a startup failure affecting both components, caused by an issue initializing Sigstore’s TUF repository.

With this fix, Policy Server and kwctl will now exit with an error only if policy verification settings are enabled. Policies using image verification settings will reject all images that rely on Sigstore certificate infrastructure (like keyless signatures).

In the meantime, we are collaborating upstream to resolve the Sigstore issue.

Kubewarden 1.29 Release

Wed, 01 Oct 2025 00:00:00 +0000

Straight from the kitchen, Kubewarden 1.29 is served! This release is a poké bowl of healthy stack features, crisp policy improvements, and some fresh fixes, all seasoned with the wholesome flavour of paid-off tech debt.

Removal of Picky dependency and stringent behavior change

We have long depended on the Rust crate picky as the implementation for X.509 and PKI certificates that we use in our cryptographic host capabilities. It allowed us to overcome some limitations in the webpki crate.

Kubewarden 1.28 Release

Wed, 27 Aug 2025 00:00:00 +0000

Kubewarden 1.28 has emerged refreshed from a bath in the lake (just like my dog on the morning walk before writing this post!). This release cycle comes mainly with improvements on policies, though some stack features plus kwctl bugfixes also bubbled up.

Supporting Hauler for air-gap installs

With 1.28, our Helm chart releases now include a Hauler YAML manifest.

Hauler is an Open Source project that provides a declarative way of saving all artifacts needed for air-gap installs, along with a tool (the hauler cli) that works with it without requiring operators to adopt a specific workflow.

Kubewarden 1.27.3 Patch Release

Thu, 14 Aug 2025 00:00:00 +0000

We have just released 1.27.3, a small patch release for kwctl. This newly released kwctl version v1.27.3 fixes a bug on the kwctl run subcommand for ClusterPolicyGroups and PolicyGroups.

When evaluating policies and policy groups, both kwctl and policy-server take care of running the policies in the correct execution mode that the policies have defined via their metadata. This means that Kubewarden policies that are Wasm modules intended to run as WASI are executed as such. The same applies, for example, to Rust policies compiled for WAPC or to OPA policies.

Kubewarden 1.27.2 Patch Release

Tue, 05 Aug 2025 00:00:00 +0000

We have just released 1.27.2, a small patch release for kwctl. This newly released kwctl version v1.27.2 fixes 2 bugs on the kwctl scaffold admission-request subcommand.

On first run, kwctl scaffold admission-request tries to connect to a cluster (if it exists) via kubeconfig, and create a cache of available resource definitions. This allows for scaffolding AdmissionRequests for CRDs in the cluster.

Starting from 1.22, there was a bug where kwctl failed to create the internal client to connect to a running cluster. This wasn’t triggered if you had no available cluster or kubeconfig or if you already had an existing cache. Now, kwctl will correctly create the cache with a valid client if possible.

Writing Kubewarden Policies in TypeScript/JavaScript (Google Summer of Code)

Mon, 04 Aug 2025 00:00:00 +0000

Hi, I’m Esosa Ohangbon, a software engineering student at Carleton University. This summer, I’ve had the incredible opportunity to participate in Google Summer of Code (GSoC) as a contributor to Kubewarden.

My focus has been on developing policy-sdk-js, a JavaScript SDK for writing Kubewarden policies using JavaScript or TypeScript. In this post, I’ll share what the experience has been like so far, some of the challenges I’ve faced, what I’ve learned, and what I’m looking forward to next.

Kubewarden 1.27.1 Patch Release

Fri, 01 Aug 2025 00:00:00 +0000

We have just released 1.27.1, a small patch release for kwctl.

With 1.27, kwctl CLI now performs post-policy processing validations previously only done by the policy-server. This includes checking for the policy mode, as in spec.mode being monitor or protect. This was achieved by refactoring the code in the policy-server and moving it to our library, policy-evaluator.

With this change, we introduced a regression in the command kwctl run, used to run policies. The regression consists in kwctl run expecting the spec.mode as Monitor or Protect, in uppercase instead of lowercase. Given that when spec.mode is not defined, it takes the default value of Protect, this would result in an error.

Kubewarden 1.27 Release

Tue, 29 Jul 2025 00:00:00 +0000

Here’s a look at the key updates and improvements in the latest release.

New High-Risk Service Account Policy

In this release, we’ve introduced a new policy to improve cluster security. The High-Risk Service Account Blocker policy, as its name suggests, blocks workloads that attempt to run with a service account that has excessive permissions.

This policy leverages the Kubernetes authorization API and allows cluster operators to define a list of forbidden permissions. Workloads using a service account with any of these permissions will be blocked. Check out the policy’s repository to learn more about its configuration.

Kubewarden 1.26 Release

Wed, 25 Jun 2025 00:00:00 +0000

Kubewarden 1.26 is fresh out of the oven, with a nice bunch of features.

Running policies from YAML locally with kwctl

Up until now, to run policies with kwctl run one needed to pass the policy module URL, the settings, and the context-aware settings via specific flags. For example:

$ kwctl run \
 --settings-json '{"allowPorts": [80], "denyPorts": [3000]}' \
 --request-path req_pod_with_allowed_capabilities_accept.json \
 registry://ghcr.io/kubewarden/policies/ingress:v0.1.8

Thanks to suggestions from our user community, kwctl now can consume a YAML file containing the Custom Resource Definition of policies, and run the request against them. Using this run mode, kwctl evaluates not only 1 policy, but each policy in the file using the same request.

Adopting of Kubewarden

Fri, 23 May 2025 00:00:00 +0000

Call for Adopters

Kubewarden is showing significant maturity as a Kubernetes policy enforcement solution, with a growing number of organizations adopting it for policy enforcement for their clusters. This trend reflects the increasing need for robust, flexible, and auditable policy enforcement in the Kubernetes ecosystem.

Why Kubewarden?

But why use Kubewarden? Kubewarden has seen a substantial expansion of its policy library. More pre-built policies are available, covering a wider range of security and operational best practices. Kubewarden’s use of WebAssembly (Wasm) allows for policies to be written in various languages, providing developers with flexibility. Wasm offers high performance and efficient resource utilization, which is crucial in Kubernetes environments. Kubewarden can verify policies using SLSA (Supply Chain Levels for Software Artifacts).

Kubewarden 1.25 Release: Priority Class Support and CI Security Enhancements

Thu, 15 May 2025 00:00:00 +0000

Kubewarden 1.25 arrives with:

enhanced Kubernetes Priority Class integration across the stack
improved CI security through GitHub Actions cleanup
usability refinements in the kwctl tool.

Priority Class support

A key feature of this release is the comprehensive integration of Kubernetes Priority Classes across the entire Kubewarden stack. This allows for fine-grained control over the scheduling and resource allocation of Kubewarden components and other workloads in the cluster. The Kubewarden Helm charts now include a new value, .global.priorityClassName. This priorityClassName is applied to the controller deployment pods and the pods of the default policy server. Further details can be found in the official documentation.

Kubewarden joins OpenReports Initiative

Mon, 12 May 2025 00:00:00 +0000

Kubewarden is an open-source CNCF project actively engaged with the wider Kubernetes ecosystem. This informs the use of valuable projects like Policy Reporter. Using Policy Reporter as a default UI for Kubewarden simplifies the user experience, allowing the use of familiar reporting mechanisms. This strategic choice also lets the team concentrate on the Kubewarden core stack.

So, the Kubewarden team participates in the Kubernetes Policy Working Group. We join community meetings and seek opportunities for collaboration, focusing on the future of policy reporting and related resources. The community moved policy reporting to an independent project, the OpenReports project!

Kubewarden 1.24 release

Wed, 30 Apr 2025 00:00:00 +0000

The wait is over, Kubewarden 1.24 has arrived! We have some Easter eggs for you in this one.

Promoting our policies to v1.0.0

In the past, we consciously picked semver 0.X.Y for policy versions as that meant that the policy API for the user (in this case, the policy spec.settings) was not considered stable.

Since the settings of our policies haven’t changed since their initial release, we decided it was time to highlight their stability by promoting them to v1.0.0.

Rego policy library relaunch

Tue, 22 Apr 2025 00:00:00 +0000

We are excited to announce the latest additions to our policy library!

Seventy finely crafted Rego policies are now available for you to use in your Kubernetes clusters.

Rego policy library

The Kubewarden’s Rego policy library is a collection of policies written in Rego, the policy language used by Open Policy Agent (OPA). These policies are designed to help you enforce security and compliance best practices in your Kubernetes clusters.

Ingress-nginx CVE-2025-1974 - how Kubewarden can help you

Thu, 03 Apr 2025 00:00:00 +0000

Last week, a high severity issue CVE-2025-1974 was found affecting ingress-nginx, one of the most used ingress solutions for Kubernetes.

The issue

The issue allows an attacker to execute arbitrary code in the Pod running the controller. The attacker can then steal the Kubernetes identity of the nginx-ingress controller which, by design, has access to all the Secrets defined in the cluster.

The issue is exploited by making http requests against the validating webhook server used by the nginx-ingress controller. Only the Kubernetes API server should be allowed to make requests against the webhook endpoint. However, it was discovered that certain clusters are even exposing this webhook endpoint outside of the cluster, for example by using an Ingress resource.

Kubewarden at KubeCon EU 2025

Thu, 27 Mar 2025 00:00:00 +0000

For those attending KubeCon EU 2025 in London, we’re excited to announce that some of our team will be there!

Here’s where you can catch us:

Tuesday, 9:31 AM: Don’t miss our lightning talk! Learn how to leverage and extend CEL for cluster security. Details here.
Tuesday, 2:00 PM - 5:00 PM, Project Pavilion kiosk: Stop by to chat with us and learn more about Kubewarden.

We can’t wait to see you there!

Kubewarden 1.23 release

Wed, 26 Mar 2025 00:00:00 +0000

The wait is over—Kubewarden 1.23 has arrived! Packed with exciting security enhancements, smoother workflows, and important updates, this release is here to make your Kubernetes experience even better. Let’s dive into what’s new!

Hardening of the admission webhooks

Kubernetes Dynamic Admission Controllers, like Kubewarden, work by providing a webhook server that implements the validation/mutation API defined by the Kubernetes project. These webhook servers are usually deployed within the same cluster as regular Kubernetes workloads. They are exposed internally using Kubernetes’ Service resources.

Watch Kubewarden in the ChatLoopBackOff Webinar

Tue, 18 Mar 2025 00:00:00 +0000

We are happy to highlight a recent CNCF webinar that does a first-dive into Kubewarden.

In this webinar, CNCF Ambassador Carlos Santana explores Kubewarden’s architecture, use cases, and benefits, with a smile in a relaxed environment. You’ll learn how Kubewarden policies can be applied at admission control or runtime to ensure compliance and security.

You can watch the full webinar here.

Thanks Carlos!

Getting in touch

As always, we welcome your feedback and contributions. Feel free to reach out to us on Slack and GitHub discussions.

kwctl 1.22.1 patch release

Tue, 04 Mar 2025 00:00:00 +0000

Today we published the 1.21.1 patch release of kwctl.

This release includes a fix for a bug that, under certain circumstances, could prevent users from pushing policies to a container registry.

The 1.22.0 release introduces the ability to add policy annotations to the manifest of the OCI artifact that is pushed to the container registry. This feature is useful for adding metadata to the OCI artifact that can be utilized by other tools in the CI/CD pipeline.

Kubewarden 1.22 release

Wed, 26 Feb 2025 00:00:00 +0000

We’re excited to announce the release of Kubewarden v1.22! This release brings some improvements to kwctl and the Rust SDK, together with some internal changes to prepare for future work.

Breaking change: PolicyServer health check endpoint change

⚠️ IMPORTANT⚠️ Breaking change: If you have created a custom instance of PolicyServer with a hard-coded .spec.image, you must update it to consume the v1.22.0 tag.

Starting from 1.22, the Policy Server health check endpoint is exposed on port 80 instead of port 443, and Policy Server Deployment objects created by the kubewarden-controller make this assumption.

Beyond Prefix Matching

Wed, 19 Feb 2025 00:00:00 +0000

A recent Aqua Security blog post highlighted the risks of misconfigured Kubernetes policy engines, particularly when dealing with OPA Gatekeeper. The post correctly points out the challenges of managing complex policies and the potential for bypasses due to misconfigurations. However, it also underscores a critical limitation of many policy engines: their reliance on string manipulation, especially when dealing with OCI image references. This is where Kubewarden takes a different, and significantly more robust, approach.

Kubewarden 1.21.1 patch release

Wed, 05 Feb 2025 00:00:00 +0000

Today we published the 1.21.1 patch releases of the kwctl and Policy Server components of the Kubewarden stack.

The release ensures all Sigstore verification capabilities work.

What happened

On Monday, February 3rd, the contents of Sigstore’s TUF repository were updated. During this process, part of the repository metadata wasn’t properly handled. Specifically, one of the KEYIDs of the repository wasn’t updated when the key contents were modified.

The breaking change wasn’t noticed by upstream maintainers as the TUF Go implementation is not performing strict verification of the KEYID.

Kubewarden 1.21 release

Thu, 30 Jan 2025 00:00:00 +0000

We’re excited to announce the release of Kubewarden v1.21, our first release of 2025!

The release addresses two security issues that the Kubewarden team has discovered. Detailed information about them is included below. While these issues do not have a critical impact, we recommend our users upgrade their Kubewarden deployments.

Alongside these security fixes, the 1.21 release includes the usual stream of dependency updates and features some improvements to our documentation.

The Year in Review: Kubewarden's Progress in 2024

Tue, 07 Jan 2025 00:00:00 +0000

It was an exciting year for Kubewarden policy management. We had new features, performance improvements, and have been working towards a regular release schedule.

The year has seen work in these areas:

performance and reliability
scalability improvements to reduce complexity and improve security
adding CEL policies and policy grouping using logical operators
improving community outreach

Kubewarden 1.10 had optimizations for policy server performance. Memory usage was improved, enabling constant consumption even in large deployments. Policy evaluation now operates on-demand, consuming resources only as needed.

Kubewarden 1.20 release

Thu, 19 Dec 2024 00:00:00 +0000

We’re excited to announce the release of Kubewarden v1.20! This release brings a nice improvement for deploying with OpenTelemetry and some bug fixes.

Supporting more OpenTelemetry scenarios

⚠️ IMPORTANT⚠️ The kubewarden-controller Helm chart has changed the values.yml schema for the OpenTelemetry keys, hence this update is not backwards-compatible if you have configured OpenTelemetry. Please adapt your values to the new values.yml format.

This is of course reflected with a major version bump of the chart version.

Kubewarden 1.19 release

Mon, 02 Dec 2024 00:00:00 +0000

We’re excited to announce the release of Kubewarden v1.19! This release brings a host of improvements focused on minor bug fixes, adding tests, and developer tech debt improvements.

Bug Fixes and Dependency Updates

As always, we’ve addressed bugs and updated dependencies to ensure a smooth and reliable experience. Notably, we’ve updated the dependencies for our major components. These updates contribute to the overall stability and security of the Kubewarden stack.

Kubewarden 1.18 release, SLSA level 3

Mon, 04 Nov 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.18.0. For this release we have focused on achieving level 3 of the SLSA standard, in addition to minor bug fixes, adding tests, and developer tech debt improvements.

SLSA level 3

Kubewarden has been at the forefront of Sigstore integration (being co-maintainers of the upstream sigstore-rs Rust library), and have signed our artifacts and provided SBOMs for several years.

For this cycle, we have made the necessary changes to our build pipelines to achieve level 3 of SLSA. SLSA is the standard for describing and improving supply chain security.

Policy Groups deep dive

Wed, 02 Oct 2024 00:00:00 +0000

With v1.17, we introduced a new powerful feature, Policy Groups, enabled by two new Kubernetes Custom Resources:

AdmissionPolicyGroups: Namespaced policy comprised of several policies.
ClusterAdmissionPolicyGroups: Clusterwide policy comprised of several policies.

These new Policy Groups resources define a policy comprised of several policies and their policy settings, and they perform a combined evaluation of those multiple policies using logical operators.

Why are these useful? Because they reuse existing policies, reducing the need for custom policy creation. And they provide complex logic while at the same time reducing complexity as you have all the logic contained in one resource definition.

Kubewarden 1.17 release

Mon, 30 Sep 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.17.0. This release is packed with big features, let’s have a look!

Certificate rotation & removal of cert-manager dependency

Starting from this release, the Kubewarden stack takes care of creating and rotating all the needed TLS certificates and certificate authorities.

Kubewarden, by virtue of connecting to the Kubernetes API server, needs TLS certificates for both the kubewarden-controller (when creating webhooks for its policies) and for the PolicyServers (so they can report their results to the Webhook API server).

Policy Server and kwctl 1.16.1 patch releases

Wed, 04 Sep 2024 00:00:00 +0000

Today we published the 1.16.1 patch release of Policy Server and kwctl.

The release addresses a breaking change inside Sigstore’s TUF repository. The change caused errors while retrieving the contents of the TUF repository, which broke part of Kubewarden’s integration with Sigstore.

More specifically, it was no longer possible to verify the signatures of Kubewarden’s policies and to verify the signatures of the container images used inside of a Kubernetes cluster via policies like verify-image-signatures.

Kubewarden 1.16 release

Mon, 19 Aug 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.16.0! Following the northern hemisphere summer, this version packs some goodies but is a bit more lightweight than usual.

kwctl scaffold for AdmissionRequests

The kwctl cli has learned a new command, kwctl scaffold admission-request, which prints a Kubernetes AdmissionRequest object from the provided Kubernetes resource definition.

This is useful when developing policies (and not only limited to Kubewarden ones). Now, you can scaffold the desired AdmissionRequest the policy would receive, and then end-to-end test a Kubewarden policy against the created AdmissionRequest with kwctl run. For example, here we scaffold a request to create an Ingress object, which then we use to test one of our policies out of cluster:

Kubewarden 1.15 release

Tue, 30 Jul 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.15.0! This version comes packed with CEL policy updates, controller enhancements, and fixes that make Kubewarden even more robust and user-friendly.

Enhanced PolicyServer CRD with Tolerations

One of the standout features of Kubewarden v1.15 is the extension of the PolicyServer Custom Resource Definition (CRD) to include a list of Toleration objects to be used in the deployment created for the Policy Server. This enhancement allows users to specify tolerations directly within the PolicyServer CRD, simplifying the management of taints and tolerations across your Kubernetes cluster. By integrating this directly into the CRD, Kubewarden ensures a more streamlined and consistent approach to handling node tolerations, making it easier to deploy policies in diverse and dynamic environments.

Kubewarden 1.14 release

Tue, 25 Jun 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.14.0! This version comes packed with new capabilities, enhancements, and fixes that make Kubewarden even more robust and user-friendly.

New Host Capability for Container Image Configuration

One of the significant updates in this release is the introduction of a new host capability that allows policies to fetch the container image configuration. This update stems from a user request to enhance the user-group-psp-policy policy by enabling it to check the user defined to run the container in the image configuration. Previously, this information was not accessible through the available host capabilities, as it was not included in the image manifest. Thanks to the functionality provided by the oci-distribution crate, which already has a method to fetch this information, we were able to extend our policy evaluator and SDKs to expose this capability.

Introducing the CEL policy

Mon, 17 Jun 2024 00:00:00 +0000

We are pleased to announce a new policy by the Kubewarden team: cel-policy.

This new policy uses the Common Expression Language (CEL). For those new to CEL, it is a general-purpose expression language designed to be fast, portable, and safe to execute. CEL as a language is memory-safe, side-effect free, terminating (as in “programs cannot loop forever”), and strong & dynamically typed.

CEL is a perfect candidate for extending the Kubernetes API, as CEL expressions can be easily inlined into CRD schemas, and compiled and type-checked “ahead-of-time” (when CRDs are created and updated). With Kubernetes 1.30, CEL features such as ValidatingAdmissionPolicies and other validation rules are now marked as stable.

Kubewarden 1.13 release

Thu, 06 Jun 2024 00:00:00 +0000

I’m pleased to announce a new release of Kubewarden, version 1.13. This release features a series of improvements and bug fixes that contribute to better performance and stability.

Let’s go through the most significant changes.

Policy Server memory usage

A community member reported that the Kubewarden Policy Server was using a lot of memory, especially when running context aware policies on big clusters. The number of resources being accessed by the policies was significantly high, in the order of 3200 Namespaces, 10500 Ingresses, 200 ClusterRoleBindings and 11000 RoleBindings. Under certain circumstances, the amount of memory being used caused the Policy Server to be terminated by the kernel’s OOM killer.

Kubewarden 1.12 release

Wed, 24 Apr 2024 00:00:00 +0000

Today we’re glad to announce the release of Kubewarden 1.12.

This release focuses on optimizations and high availability, both oriented to production.

Optimizing Gatekeeper policies

The previous 1.11 release featured lots of optimizations for context aware policies.

The 1.12 release provides a further optimization for Gatekeeper policies that access Kubernetes resources. This optimization provides an extra 55% performance boost for these policies.

The benefits of this optimization are particularly noticeable when a huge number of Kubernetes resources are accessed by a Gatekeeper policy.

Introducing Kubewarden's Community Repository

Tue, 09 Apr 2024 00:00:00 +0000

The Kubewarden project has recently improved how it shares information and involves others by starting a new community repository. This move was made after a suggestion from the CNCF during their last yearly review. The aim is to bring together all the documentation in one place and make it easier for both new and current contributors to get involved.

This new repository is a place for finding out about the project’s rules, security measures, project components, and what’s happening in each Kubewarden GitHub organization repository.

Retrieving OCI Image Manifests

Mon, 25 Mar 2024 00:00:00 +0000

Kubewarden’s latest version 1.11.0 introduces a new feature enabling policies to retrieve OCI image manifests. This function, supported in both Rust and Go SDKs, enhances the policy enforcement capabilities within Kubernetes environments.

The update provides an additional layer of security inspection for containerized environments. Developers can now write policies using the updated SDKs to access OCI image manifests of container images. This access facilitates more detailed inspections and validations, aligning with security standards and organizational protocols.

Kubewarden 1.11 release

Thu, 21 Mar 2024 00:00:00 +0000

Today we’re glad to announce the release of Kubewarden 1.11.

This release focuses on performance improvements, especially when running on big Kubernetes clusters.

Audit Scanner

A lot of work has been done on the audit scanner. The auditing of resources is now done in parallel, which means less time is required on big clusters to scan all the available resources.

We’ve also changed how we handle Policy Reports. Kubewarden is still using the Policy Report format being defined inside the Kubernetes’s wg-policy group. However, prior to this release, we used to create one PolicyReport per Namespace and one ClusterPolicyReport per cluster. This solution proved to not scale inside clusters with many audited resources. Depending on the number of policies and audited resources, the size of the final report objects could be too big to fit into etcd. Moreover, the amount of memory required by the audit scanner could be significant.

Kubewarden 1.10 release

Fri, 26 Jan 2024 00:00:00 +0000

We have the first release of 2024, Kubewarden 1.10.0! 🎉🥳

And this one contains a nice bag of goodies, let’s have a look!

Reduced memory usage and increased reliability of Policy servers

A nice graph is worth a thousand words!

Note the slightly lower memory consumption, and unchanging consumption when scaling horizontally.

This graph represents the memory consumption of one instance of policy-server, containing 13 policies:

Kubewarden 2023 Wrapped

Wed, 20 Dec 2023 00:00:00 +0000

The end of the year is around the corner. Let’s look at what the Kubewarden project achieved in 2023!

Context-Aware graduation

The context-aware feature graduated to stable during this year. We did this by performing a massive overhaul of the initial iteration. Context-aware policies can access information about Kubernetes resources defined inside the cluster. At evaluation time, these policies can make decisions based on this information. Such an example is the unique ingress host policy.

Raw policies

Tue, 14 Nov 2023 00:00:00 +0000

Kubewarden 1.9.0 has introduced even more features requested by the community, and we are excited to share them with you!

In this blog post, we will introduce the new Raw policy type.

Kubewarden as a generic policy engine

Raw policies allow policy authors to write and execute policies that are not necessarily related to Kubernetes. This means that Kubewarden can be used as a general-purpose policy engine. For instance, you can use Kubewarden to validate any type of artifact: configurations, Terraform plans, test coverage, static analysis or even deploy Kubewarden alongside your web application to validate domain-specific requests.

Kubewarden 1.9.0 release

Fri, 03 Nov 2023 00:00:00 +0000

Not even a month after the 1.8.0 release, today we are happy to announce Kubewarden 1.9.0! 🎉🥳

This release includes two major features that have been requested by our community.

Making Rego policies context-aware

Context-aware policies have been introduced with Kubewarden 1.6.0. These policies can obtain information about other Kubernetes resources at evaluation time. This allows them to make decisions based not only on the information provided by the AdmissionReview object they receive.

Introducing Kubewarden WASI policies

Tue, 24 Oct 2023 00:00:00 +0000

Kubewarden policies can be written using either a traditional programming language (like Go, Rust, C#, Swift, …) or using a domain-specific language like Rego. It is required that the programming language can generate the necessary WebAssembly module for use by Kubewarden.

When using a traditional programming language, the communication between the host executing the policy and the WebAssembly guest (the actual policy) uses the waPC communication protocol. This protocol provides a bidirectional channel between the host and guest. It allows us to expose extra capabilities to policies (like cryptographic signature verification via Sigstore and more). We can also grant read access to selected Kubernetes resources (see context-aware policies).

Kubewarden 1.8.0 release

Wed, 11 Oct 2023 00:00:00 +0000

Today we are happy to announce the release of Kubewarden 1.8.0! 🎉🥳

This is a small release, focused on OpenTelemetry.

The OpenTelemetry Protocol (OTLP) got its first 1.0.0 version in July 2023; several libraries got their first 1.0.0 release, such as the Go metric SDK or the .NET Automatic Instrumentation.

Still, the OpenTelemetry stack is not yet stable, and unannounced backwards-incompatible changes still happen. You can have a look at the status of OpenTelemetry libraries and protocols.

Welcoming the Audit Scanner

Wed, 11 Oct 2023 00:00:00 +0000

Fresh in the already released Kubewarden v1.7.0 stack, we welcome a new module: the Audit Scanner!

Audit Scanner?

Up until the release of Audit Scanner, Kubewarden was strictly a Dynamic Admission Controller, checking requests made against the Kubernetes API server with the deployed policies.

Yet policies evolve over time; new ones are deployed, and existing ones are updated. This can mean that resources that are inside the cluster are no longer compliant. A resource that was compliant some weeks ago, today may not be valid since the introduction of a new policy.

kwctl SHA support

Thu, 28 Sep 2023 00:00:00 +0000

Recently, we have focused on improving the Kubewarden developer experience. We have been implementing features requested by the community.

Reference policies by their SHA

Since kwctl release v1.7.0 we support referencing policies by their SHA.

Container engines such as Docker and Podman allow users to refer to images by their SHA sum.

As Kubewarden policies are distributed as OCI artifacts, we thought it would be a good idea to add the SHA support to kwctl, so that users have a familiar experience.

Kubewarden 1.7.0 release

Thu, 21 Sep 2023 00:00:00 +0000

Today we are delighted to announce the release of Kubewarden 1.7.0! 🎊 🥳 Aside from the bug and stability fixes, this release is packed with new features. This post highlights the main changes, detailed blog entries will come in the next weeks covering each feature in depth.

Audit scanner

A new component has been added to the Kubewarden stack. Its name is audit-scanner and it allows administrators to assess the compliance level of the clusters secured by Kubewarden.

My Experience in the LFX Mentorship Program with the Linux Foundation

Tue, 30 May 2023 00:00:00 +0000

This text was originally written by Khaled Emara on his blog.

Hi, I’m Khaled Emara, a software developer with a background in Go and Rust programming. In this blog post, I’m excited to share my experience in the LFX mentorship program with the Linux Foundation and my work on the Kubewarden project enhancing the Go SDK to bring it parity with the Rust SDK.

The Kubewarden project is a security policy engine for Kubernetes, a popular container orchestration platform. As more and more businesses move their applications to the cloud, containers have become an increasingly popular way to manage and deploy applications. However, with this rise in popularity, there has also been a corresponding rise in security concerns. The Kubewarden project addresses these concerns by providing a way to enforce security policies in Kubernetes.

Telemetry enhancements released!

Tue, 09 May 2023 00:00:00 +0000

We are excited to announce a variety of updates, fixes, and enhancements for Kubewarden components!

This release primarily focuses on improvements to Kubewarden telemetry and dependency updates.

Telemetry Enhancements and Fixes

The Kubewarden controller has received several fixes and improvements in the telemetry department. These include a streamlined process for users to deploy a policy server with telemetry enabled, as well as a bug fix related to the controller’s available metrics.

Kubewarden 1.6.0 is released!

Mon, 17 Apr 2023 00:00:00 +0000

We are pleased to announce the availability of the Kubewarden 1.6.0 stack.

This release brings stability, performance and security improvements. All packed with a new major feature. Let’s dig into the changes!

Security Improvements

The Kubewarden controller is ran using a dedicated Service Account. Prior to this release, the Service Account had access to a series of Kubernetes resources across the entire cluster.

Starting from this release, the Kubewarden controller Service Account has a more limited access to the cluster. Access to some resources is now tied to the Namespace inside of which the controller is deployed.

Kubewarden UI 1.0.0 is released!

Thu, 09 Feb 2023 00:00:00 +0000

We are excited to announce that the Kubewarden UI 1.0.0 has been released!

The UI is an Extension for Rancher Manager, now you will be able to enable Kubewarden policies for your Kubernetes clusters with a streamlined user experience. You can find the latest releases of the extension Helm chart, the release provides a Github Pages deployment which can be used when adding the UI as a Helm repository.

Currently Rancher is required to run this extension, however, in the future it will be possible to deploy the same UI as a stand-alone platform.

Kubewarden 1.5.0 release

Fri, 20 Jan 2023 00:00:00 +0000

Today we’re pleased to announce the availability of Kubewarden 1.5.0!

This release brings the usual amount of small bug fixes, dependency updates, and a major security enhancement. Let’s take a closer look!

Policy evaluation timeout

The Kubewarden team is constantly working to improve the security posture of the project. As part of these efforts, we’re excited to introduce the new “policy evaluation timeout” feature.

Starting from this release, Policy Server will interrupt the evaluation of admission requests after a certain amount of time has elapsed. This security feature, which is enabled by default, prevents a Policy Server from running out of computing resources because one or more of its policy evaluations are stuck in infinite loops. This mitigates a type of Denial Of Service (DOS) attacks against the Policy Server.

Kubewarden 2022 Wrapped

Thu, 29 Dec 2022 00:00:00 +0000

With 2022 almost over, it’s time to look back at what happened within the Kubewarden project during the last year.

The 1.0 release

A significant milestone for the project in 2022 was the release of Kubewarden v1.0.0 during the month of June.

With this release, the Kubewarden team committed to the stability of all the public interfaces of the project and all its Kubernetes Custom Resource Definitions.

Moreover, the project was considered ready to be used in production environments.

Community meeting is coming!

Tue, 20 Dec 2022 00:00:00 +0000

Community meetings have been a recurring demand from different sides and with the new year approaching, it’s time to make our first good resolution.

To improve community feedback, the Kubewarden project has decided to organize a monthly community meeting. The first community meeting to be held is scheduled for January 12th, 2023 at 4 PM UTC.

In addition to GitHub Discussions, GitHub issues, and the #kubewarden channel on the Kubernetes Slack, the community meeting is an additional avenue for the community to discuss Kubewarden and shape its future together.

Kubewarden 1.4.0 release

Mon, 05 Dec 2022 00:00:00 +0000

Today we’re pleased to announce the availability of Kubewarden 1.4.0.

This version brings some minor fixes to our controller and helm charts and two new interesting features.

Sigstore certificate verification

Kubewarden integration with Sigstore keeps growing. Starting from this release it’s possible to verify signatures that have been produced with certificates.

This can be useful to organizations that are using hardware tokens and KMS solutions to sign their container images via Sigstore.

Support for sigstore certificate signing

Mon, 05 Dec 2022 00:00:00 +0000

Secure supply chain is one of the hottest topics right now. Many organizations are implementing strategies to verify the provenance of their software starting from the development phase up to the deployment in production.

Sigstore is an open source project that makes incredibly easy to sign and verify assets. Lots of open source projects and organizations are using it to sign and verify their container images, system packages and any kind of binary artifact. It’s no secret we are Sigstore enthusiasts.

Installing and Running Kubewarden In Air-Gapped Environments

Tue, 29 Nov 2022 00:00:00 +0000

We are glad to announce that deploying Kubewarden in air gap environments has been simplified and documented! For that, you will need a private OCI registry accessible by your Kubernetes cluster. Kubewarden policies are WebAssembly modules; therefore they can be stored inside an OCI-compliant registry as OCI artifacts. For an air gap installation you need to download all the Kubewarden container images and policies in your workstation, then move them to your private OCI registry. Check the Kubewarden docs for a step-by-step guide.

Keeping track of Kubernetes deprecated resources

Wed, 09 Nov 2022 00:00:00 +0000

It’s fact of life: as the Kubernetes API evolves, it’s periodically reorganized or upgraded. This means some Kubernetes resources can be deprecated and later removed.

We deserve to easily keep track of those deprecations and removals. For that, we have just released the deprecated-api-versions policy.

A look at the deprecated-api-versions policy

This policy detects the usage of Kubernetes resources that have been deprecated or removed from the Kubernetes API.

The policy has two settings:

Securing the usage of volumeMounts

Thu, 03 Nov 2022 00:00:00 +0000

We present to you the new volumeMounts Policy: It inspects containers, init containers, and ephemeral containers, and restricts their usage of volumes by checking the volume name being used in the containers’ volumeMounts[*].name.

You can find it published in Artifact Hub. As usual, its artifact is signed with Sigstore in keyless mode, and if you are curious, you can peek into the policy’s implementation in Rust here.

This new policy joins the already existing volumes-psp policy, which provides an allowlist of volume types, and hostpaths-psp policy, with an allowlist of hostPath volumes.

Enforcing compliance of container's environment variables

Mon, 31 Oct 2022 00:00:00 +0000

We’re glad to present the new environment-variable-policy to Kubewarden users. With this policy, you will now be able to inspect init containers and ephemeral containers. You can also restrict their usage by reviewing the names and values defined under the containers’ env[*] field.

As always, the policy can be found in ArtifactHub and all the artifacts, including the BOM files, are signed with Sigstore.

What is so useful about the new environment-variable policy?

This policy complements the recently released env-variable-secrets-scanner policy. Both policies focus on validating the environment values provided to Kubernetes Pod objects. In this new policy, users can validate which variables name and values their resources can have.

Kubewarden 1.3 is out!

Thu, 27 Oct 2022 00:00:00 +0000

The Kubewarden development team is happy to announce the release of the Kubewarden 1.3 stack.

In addition to the usual amount of small fixes, this release focused on the following themes.

Improve end users confidence

We want our users to feel confident about using Kubewarden, knowing that good development and security practices are being followed by the Kubewarden project. We think this is particularly relevant to Kubewarden, given our users trust us to keep their Kubernetes clusters secure and compliant.

Scanning secrets in environment variables

Mon, 24 Oct 2022 00:00:00 +0000

We are thrilled to announce you can now scan your environment variables for secrets with the new env-variable-secrets-scanner-policy! This policy rejects a Pod or workload resources such as Deployments, ReplicaSets, DaemonSets , ReplicationControllers, Jobs, CronJobs etc. if a secret is found in the environment variable within a container, init container, or ephemeral container. Secrets that are leaked in plain text or in base64 encoded variables are detected.

This policy uses rusty hog, an open source secret scanner from New Relic. The policy looks for the following secrets being leaked: RSA private keys, SSH private keys and API tokens for different services like Slack, Facebook tokens, AWS, Google, New Relic Keys, etc

v1.1.1 is out 🎉

Wed, 27 Jul 2022 00:00:00 +0000

We are happy to announce the first minor release of v1.0: v1.1.1 is now available!

Apart from being a nice looking number, v1.1.1 includes:

Improved the policies API for Sigstore verification by adding new backwards-compatible WaPC host callback v2/verify functions to the API. Check them out here to add support for your language of choice.

This has been used in the verify-image-signatures policy to simplify verification of GitHub Actions signatures and others. Read about it in this blog post.

Kubewarden policies, now on Artifact Hub!

Fri, 22 Jul 2022 00:00:00 +0000

Today we’re happy to announce that Artifact Hub now supports Kubewarden policies! 🤯 🥳

Artifact Hub is the de-facto place where Cloud Native users search for helm charts, container images, and other kinds of artifacts and configurations of different CNCF projects. That’s why we are super excited and honored to have Kubewarden policies listed on Artifact Hub.

This would not have been possible without the work done by the Artifact Hub team. They have been extremely helpful with us, thanks a lot folks! 🤗

Verify image signatures with GitHub Actions and KeylessPrefix

Thu, 21 Jul 2022 00:00:00 +0000

With the latest releases of Kubewarden v1.1.0 and the verify-image-signatures policy, it’s now possible to use GithubActions or KeylessPrefix for verifying images. Read our previous blog post if you want to learn more about how to verify container images with Sigstore using Kubewarden.

Let’s see it in action!

We want to verify the image ghcr.io/raulcabello/app-example which was built and signed inside a GitHub action using this GitHub Action.

Out of the box, GitHub Actions have a specially crafted environment that makes Sigstore keyless signing work in a non-interactive way. The signatures produced in this way contain unique secure information that allow us to identify the GitHub owner (be it an individual or an organization) and the GitHub repository inside of which the GitHub Action has been executed.

Migrate your PSPs to Kubewarden policies!

Wed, 13 Jul 2022 00:00:00 +0000

Warning: the code snippets shown inside of this blog post have become outdated. For up-to-date information checkout this section of the Kubewarden documentation.

As announced in past blog posts, Kubewarden has 100% coverage of the deprecated, and soon to be removed, Kubernetes PSPs. If everything goes as expected the PSPs will be removed in Kubernetes v1.25 due for release on 23rd August 2022.

The Kubewarden team has written a script that leverages the migration tool written by AppVia, to migrate PSP automatically. The tool is capable of reading PSPs YAML and can generate the equivalent policies in many different policy engines. Our simple script migrates your PSPs to their equivalent Kubewarden policies.

Kubewarden reaches 1.0.0 release 🎉

Wed, 22 Jun 2022 00:00:00 +0000

Kubewarden is a policy engine for Kubernetes that is part of CNCF Sandbox.

Never heard of Kubewarden before? Do you want to know what makes Kubewarden stand out among similar solutions? This is a high level overview of Kubewarden’s unique points:

Boost Policy Authors’ productivity: write policies using your favorite programming language. Leverage your knowledge, skills and tools.
Policies are portable WebAssembly modules
Reuse your existing Open Policy Agent / Gatekeeper policies
Distribute policies using regular container registries
Secure supply chain, leverage Sigstore to sign and verify policies

Today, a year and a half since its conception, we’re thrilled to announce the release of Kubewarden v1.0.0! 🎊 🥳

CNCF Sandbox admission 🎊

Wed, 15 Jun 2022 00:00:00 +0000

Today the whole Kubewarden team is overjoyed because the Kubewarden project has just been accepted into the CNCF Sandbox!!! 🥳

This is a great achievement for the whole team and is the beginning of our journey into CNCF. Also, many thanks to the CNCF TOC for the feedback they provided during the project evaluation.

What’s next?

The admission happens at an interesting time since we are currently testing the 1.0.0-rc1 release of Kubewarden.

Secure Supply Chain: Verifying image signatures

Fri, 20 May 2022 00:00:00 +0000

After these last releases Kubewarden now has support for verifying the integrity and authenticity of artifacts within Kubewarden using the Sigstore project. In this post, we shall focus on verifying container image signatures using the new verify-image-signatures policy.

To learn more about how Sigstore works, take a look at our previous post

Verify Image Signatures Policy

This policy validates Pods by checking their container images for signatures (that is, containers, init containers and ephemeral containers in the pod)

Have you migrated your Kubernetes PodSecurityPolicy?

Thu, 12 May 2022 00:00:00 +0000

If you use a version of Kubernetes (< v1.24) that supports the deprecated PodSecurityPolicy (a.k.a PSP), you would be wondering what to do after the Kubernetes v1.25 version when the PSP will be removed. With this in mind, the Kuberwarden team wrote a documentation to help users migrate away from PSPs to Kuberwarden policies.

As you know, the original Pod Security Policies had many configuration knobs. The Kubewarden team created a series of policies that offer a 100% feature parity with all the soon to be dropped Pod Security Policies. This section of our documentation highlights all these policies and guides you through their recommended settings.

Introducing the Monitor mode

Fri, 06 May 2022 00:00:00 +0000

Policies are a core component of a Kubernetes cluster story that involves security, compliance and consistency.

Being this process an iterative one, it’s common for new policies to potentially reject operations that we might be issuing today in our production clusters.

As an example, we might have decided that it’s not possible to change certain annotations on existing resources after the fact. In this case, we don’t want to revoke UPDATE rights completely, but just to define an inalterable set of annotations after the resource has been created.

Secure Supply Chain with Kubewarden: securing Kubewarden policies

Mon, 02 May 2022 00:00:00 +0000

With recent releases, the Kubewarden stack supports verifying the integrity and authenticity of content using the Sigstore project.

In this post, we focus on Kubewarden Policies and how to create a Secure Supply Chain for them.

Sigstore?

Since a full Sigstore dive is not within the scope for this post, we recommend checking out their nice docs.

In short, Sigstore provides an automatable workflow to match the distributed Open Source development model. The workflow specifies how to digitally sign and verify artifacts which in our case are Kubewarden Policies. It also provides a transparency log to monitor such signatures. The workflow allows to sign artifacts with traditional Public-Private key pairs, or in Keyless mode.

CRI-O CVE-2022-0811 Mitigation

Tue, 29 Mar 2022 00:00:00 +0000

Recently a severe CVE in the CRI-O container engine come to public. The flaw in CRI-O allows bad actors to gain root access and run arbitrary code in the host machine.

A fix for the issue is already available and you should update your cluster to avoid any headache in the future. But if you cannot do that right away, use Kubewarden to mitigate the impact of this issue. It’s possible to prevent pods with sysctl configuration to run in the cluster with the policy sysctl-psp available in the Policy Hub.

Introducing the AdmissionPolicy

Wed, 16 Mar 2022 00:00:00 +0000

Up till now, the only way to define a policy in Kubewarden was to use the ClusterAdmissionPolicy resource that would be applied to cluster-wide resources across all namespaces.

That’s why we’re thrilled to announce the new AdmissionPolicy resource. This new resource is created inside a namespace and the policies will only process the requests that are targeting the namespace where the AdmissionPolicy is defined. Except from being a “namespaced” resource, AdmissionPolicy works exactly the same as the ClusterAdmissionPolicy.

Multiplatform Kubewarden

Fri, 04 Feb 2022 00:00:00 +0000

The Kubewarden team is glad to announce that in the spirit of helping Policy Authors and Cluster Administrators, the project is now officially multiplatform.

The list of supported platforms as of now are:

Policy Server, as a container image:
- linux/amd64 (with the musl libc)
- linux/arm64 (with the musl libc)
kwctl, as a standalone binary:
- darwin (x86_64)
- linux (aarch64, with the musl libc)
- linux (x86_64, with the musl libc)
- windows (x86_64, with MSVC)

We have prioritized the usage of the same dependencies and toolchain on platforms where we were able to do so.

Kubewarden policies cover all the Kubernetes Pod Security Policies

Mon, 31 Jan 2022 00:00:00 +0000

The Kubewarden team worked tirelessly to create equivalent Kubewarden policies for all the deprecated Pod Security Policies (PSP). In order to reach this very important milestone, the team wrote the policies with the same validations available in the Kubernetes PSPs, and we counted on the community help to map and validate the policies.

This will allow our users to replace deprecated PSPs while continuing to enforce their security rules.

The Kubewarden policies which replace all the Kubernetes PSPs, are available in the Policy Hub, and you can find them by typing the keyword “PSP”. And, to have the exact same behavior of the Kubernetes PSPs is necessary a minimum version for some of the Kubewarden components, which are:

Policy Server on aarch64

Fri, 21 Jan 2022 00:00:00 +0000

We recently got notified that the policy-server was crashing in an aarch64 environment. The moment in which it got a request from the API server, it crashed immediately with a SIGSEGV signal.

We figured out that this was only happening when the request was a TLS one, and that the problem was related to the OpenSSL stack and the way we were producing the final image of the policy-server with the OpenSSL stack.

First year of Kubewarden

Wed, 22 Dec 2021 00:00:00 +0000

Year 2021 is almost over. Let’s take that as a chance to look back at what has been achieved during the 1st year of life of the Kubewarden project.

Finally, I’ll also talk about what we plan to do during the next one.

2021 Highlights

Project Announcement

The Kubewarden project has been introduced to the masses for the 1st time during KubeCon Europe 2021. During this presentation, Rafael and I explained what lead us to rethink how Kubernetes policies could be written and distributed. Watch the KubeCon Europe 2021 talk recording to better understand Kubewarden’s mission.

Deep Dive into policy logging

Mon, 15 Nov 2021 00:00:00 +0000

Policies are regular programs. As such they often have the need to log information. In general, we are used to make our programs log into standard output (stdout) and standard error (stderr) outputs.

However, policies run in a confined WebAssembly environment. For this mechanism to work as usual Kubewarden would need to set up the runtime environment in a way that the policy can write to stdout and stderr file descriptors, and upon completion, Kubewarden can check them – or stream log messages as they pop up.

A new architecture to ease Kubewarden administrators' lives

Fri, 01 Oct 2021 00:00:00 +0000

We are pleased to announce a new architecture for the Kubewarden stack, in line with its journey to maturity:

The introduction of a PolicyServer Custom Resource Definition (CRD) which allows users to describe a policy-server Deployment, together with binding ClusterAdmissionPolicies to a specific PolicyServer instance.

These 2 changes are accompanied by a multitude of improvements to make Kubewarden more comfortable for Kubernetes Administrators, such as validation for Kuberwarden Custom Resources, improvements in Helm Charts, Status and Conditions for ClusterAdmissionPolicies.

Towards a universal policy platform

Tue, 21 Sep 2021 00:00:00 +0000

Kubewarden is a policy framework for Kubernetes. It can be used to secure your clusters and to ensure they stay compliant with the rules your organization establishes over time.

By leveraging the power of WebAssembly, Kubewarden allows policy authors to write policies using traditional programming languages such as Rust, Go, AssemblyScript and Swift.

Kubewarden policies, once compiled into WebAssembly modules, are then distributed using regular OCI registries. This allows Operators to have a consistent way to securely distribute both container images and policies.

WebAssembly is coming to Cloud Native

Fri, 16 Jul 2021 00:00:00 +0000

Is the title of this post a pun inspired by Christmas or by the Games of Thrones? I can’t decide…
Are my dad jokes as bad as my daughters claim? Probably…
Is WebAssembly spreading inside of the Cloud Native ecosystem? 💯 I have no doubts about that!

First of all, why am I so excited about seeing WebAssembly flourish inside of the Cloud Native ecosystem? Well, it’s no secret that I’m a huge fan of it. After all, WebAssembly is at the heart of Kubewarden.

Let's learn Kubewarden - Streaming Event

Tue, 13 Jul 2021 00:00:00 +0000

In case you missed, CNCF Ambassador Saiyam Pathak recently hosted a live streaming event on his YouTube channel about Kubewarden. Flavio had the pleasure to join Saiyam and give an overview of the project.

We spoke about Kubernetes Admission Controllers, why we started the Kubewarden project and how it differentiates from other existing open source projects such as Open Policy Agent and Kyverno.

The talk features also a brief overview of WebAssembly, what it is and what are the benefits it provides to Kubewarden.

Introducing the PSP host namespaces policy

Fri, 11 Jun 2021 00:00:00 +0000

As you probably know, Kubernetes Pod Security Policies (PSPs) are being deprecated in Kubernetes 1.21 – although these APIs will be served until Kubernetes 1.25 it’s a good time to start thinking about what you will use to replace them.

At Kubewarden we have an ongoing effort to replace the Pod Security Policies with small, targeted Kubewarden policies.

Up until now, we have implemented some policies that replace some Pod Security Policies:

Introducing kwctl to Kubernetes Administrators

Wed, 09 Jun 2021 00:00:00 +0000

We are pleased to announce the availability of a new tool within the Kubewarden project: kwctl.

kwctl is a command line utility designed to help both policy authors and Kubernetes administrators.

This blog post focuses on the user experience of Kubernetes administrators. Future ones will cover the policy developer side of the story.

A Real-World Example: Controlling Container Capabilities

The main character of today’s story is Alice. Alice is a Kubernetes administrator who wants to keep her Kubernetes cluster secure.

Writing your first policy with Kubewarden

Wed, 02 Jun 2021 00:00:00 +0000

Kubewarden is a project focused on security and compliance. Its main goal is to allow you to write, test, distribute and run policies using the tooling that you already know and master, with a focus on controlling Kubernetes inner behaviors.

Policies are written in one of the supported languages, and the target object is a WebAssembly binary artifact. This is how Kubewarden can ensure that no matter where you built the policy, it can run on all platforms without any kind of adaptation.