Community on Kubewarden

The year in review: Kubewarden's progress in 2025

Wed, 07 Jan 2026 00:00:00 +0000

Join us in celebrating a fruitful 2025 for the Kubewarden project!

The team has spent time planting kernels and enjoying the fruit of the grown ideas. Let’s look together at what the basket brings as we say ciao to 2025. Grab anything you like for the trip!

Expanding the Scope: Introducing SBOMScanner

2025 saw Kubewarden expand beyond admission policies with the introduction of SBOMScanner, a new project donated to CNCF under the Kubewarden umbrella.

Introducing the Kubewarden JavaScript/TypeScript SDK

Tue, 18 Nov 2025 00:00:00 +0000

Writing Kubewarden policies is now even more accessible. Today, we’re excited to announce the alpha release of the Kubewarden JavaScript/TypeScript SDK, bringing policy development to the world’s most popular programming language.

Why JavaScript for Kubernetes Policies?

Kubewarden has always been about choice, letting you write policies in the language you’re most comfortable with. The JavaScript/TypeScript SDK opens Kubewarden to an entirely new audience, the millions of developers already familiar with the JavaScript ecosystem. You no longer need to learn a new language just to write a Kubewarden policy.

Expanding Kubewarden Scope

Tue, 11 Nov 2025 00:00:00 +0000

The Kubewarden project was created four years ago at SUSE with the goal of redefining Policy As Code. We built a universal policy engine for Kubernetes and donated it to the CNCF.

When the project started, policies could only be written in Rust and Go. Since then, we’ve worked to increase flexibility. Today, policies can also be written in other programming languages such as C#, and even JavaScript and TypeScript (stay tuned for the upcoming announcement).

Writing Kubewarden Policies in TypeScript/JavaScript (Google Summer of Code)

Mon, 04 Aug 2025 00:00:00 +0000

Hi, I’m Esosa Ohangbon, a software engineering student at Carleton University. This summer, I’ve had the incredible opportunity to participate in Google Summer of Code (GSoC) as a contributor to Kubewarden.

My focus has been on developing policy-sdk-js, a JavaScript SDK for writing Kubewarden policies using JavaScript or TypeScript. In this post, I’ll share what the experience has been like so far, some of the challenges I’ve faced, what I’ve learned, and what I’m looking forward to next.

Adopting of Kubewarden

Fri, 23 May 2025 00:00:00 +0000

Call for Adopters

Kubewarden is showing significant maturity as a Kubernetes policy enforcement solution, with a growing number of organizations adopting it for policy enforcement for their clusters. This trend reflects the increasing need for robust, flexible, and auditable policy enforcement in the Kubernetes ecosystem.

Why Kubewarden?

But why use Kubewarden? Kubewarden has seen a substantial expansion of its policy library. More pre-built policies are available, covering a wider range of security and operational best practices. Kubewarden’s use of WebAssembly (Wasm) allows for policies to be written in various languages, providing developers with flexibility. Wasm offers high performance and efficient resource utilization, which is crucial in Kubernetes environments. Kubewarden can verify policies using SLSA (Supply Chain Levels for Software Artifacts).

Kubewarden joins OpenReports Initiative

Mon, 12 May 2025 00:00:00 +0000

Kubewarden is an open-source CNCF project actively engaged with the wider Kubernetes ecosystem. This informs the use of valuable projects like Policy Reporter. Using Policy Reporter as a default UI for Kubewarden simplifies the user experience, allowing the use of familiar reporting mechanisms. This strategic choice also lets the team concentrate on the Kubewarden core stack.

So, the Kubewarden team participates in the Kubernetes Policy Working Group. We join community meetings and seek opportunities for collaboration, focusing on the future of policy reporting and related resources. The community moved policy reporting to an independent project, the OpenReports project!

Kubewarden at KubeCon EU 2025

Thu, 27 Mar 2025 00:00:00 +0000

For those attending KubeCon EU 2025 in London, we’re excited to announce that some of our team will be there!

Here’s where you can catch us:

Tuesday, 9:31 AM: Don’t miss our lightning talk! Learn how to leverage and extend CEL for cluster security. Details here.
Tuesday, 2:00 PM - 5:00 PM, Project Pavilion kiosk: Stop by to chat with us and learn more about Kubewarden.

We can’t wait to see you there!

Watch Kubewarden in the ChatLoopBackOff Webinar

Tue, 18 Mar 2025 00:00:00 +0000

We are happy to highlight a recent CNCF webinar that does a first-dive into Kubewarden.

In this webinar, CNCF Ambassador Carlos Santana explores Kubewarden’s architecture, use cases, and benefits, with a smile in a relaxed environment. You’ll learn how Kubewarden policies can be applied at admission control or runtime to ensure compliance and security.

You can watch the full webinar here.

Thanks Carlos!

Getting in touch

As always, we welcome your feedback and contributions. Feel free to reach out to us on Slack and GitHub discussions.

Beyond Prefix Matching

Wed, 19 Feb 2025 00:00:00 +0000

A recent Aqua Security blog post highlighted the risks of misconfigured Kubernetes policy engines, particularly when dealing with OPA Gatekeeper. The post correctly points out the challenges of managing complex policies and the potential for bypasses due to misconfigurations. However, it also underscores a critical limitation of many policy engines: their reliance on string manipulation, especially when dealing with OCI image references. This is where Kubewarden takes a different, and significantly more robust, approach.

The Year in Review: Kubewarden's Progress in 2024

Tue, 07 Jan 2025 00:00:00 +0000

It was an exciting year for Kubewarden policy management. We had new features, performance improvements, and have been working towards a regular release schedule.

The year has seen work in these areas:

performance and reliability
scalability improvements to reduce complexity and improve security
adding CEL policies and policy grouping using logical operators
improving community outreach

Kubewarden 1.10 had optimizations for policy server performance. Memory usage was improved, enabling constant consumption even in large deployments. Policy evaluation now operates on-demand, consuming resources only as needed.

Introducing Kubewarden's Community Repository

Tue, 09 Apr 2024 00:00:00 +0000

The Kubewarden project has recently improved how it shares information and involves others by starting a new community repository. This move was made after a suggestion from the CNCF during their last yearly review. The aim is to bring together all the documentation in one place and make it easier for both new and current contributors to get involved.

This new repository is a place for finding out about the project’s rules, security measures, project components, and what’s happening in each Kubewarden GitHub organization repository.

Kubewarden 2023 Wrapped

Wed, 20 Dec 2023 00:00:00 +0000

The end of the year is around the corner. Let’s look at what the Kubewarden project achieved in 2023!

Context-Aware graduation

The context-aware feature graduated to stable during this year. We did this by performing a massive overhaul of the initial iteration. Context-aware policies can access information about Kubernetes resources defined inside the cluster. At evaluation time, these policies can make decisions based on this information. Such an example is the unique ingress host policy.

Raw policies

Tue, 14 Nov 2023 00:00:00 +0000

Kubewarden 1.9.0 has introduced even more features requested by the community, and we are excited to share them with you!

In this blog post, we will introduce the new Raw policy type.

Kubewarden as a generic policy engine

Raw policies allow policy authors to write and execute policies that are not necessarily related to Kubernetes. This means that Kubewarden can be used as a general-purpose policy engine. For instance, you can use Kubewarden to validate any type of artifact: configurations, Terraform plans, test coverage, static analysis or even deploy Kubewarden alongside your web application to validate domain-specific requests.

Introducing Kubewarden WASI policies

Tue, 24 Oct 2023 00:00:00 +0000

Kubewarden policies can be written using either a traditional programming language (like Go, Rust, C#, Swift, …) or using a domain-specific language like Rego. It is required that the programming language can generate the necessary WebAssembly module for use by Kubewarden.

When using a traditional programming language, the communication between the host executing the policy and the WebAssembly guest (the actual policy) uses the waPC communication protocol. This protocol provides a bidirectional channel between the host and guest. It allows us to expose extra capabilities to policies (like cryptographic signature verification via Sigstore and more). We can also grant read access to selected Kubernetes resources (see context-aware policies).

kwctl SHA support

Thu, 28 Sep 2023 00:00:00 +0000

Recently, we have focused on improving the Kubewarden developer experience. We have been implementing features requested by the community.

Reference policies by their SHA

Since kwctl release v1.7.0 we support referencing policies by their SHA.

Container engines such as Docker and Podman allow users to refer to images by their SHA sum.

As Kubewarden policies are distributed as OCI artifacts, we thought it would be a good idea to add the SHA support to kwctl, so that users have a familiar experience.

My Experience in the LFX Mentorship Program with the Linux Foundation

Tue, 30 May 2023 00:00:00 +0000

This text was originally written by Khaled Emara on his blog.

Hi, I’m Khaled Emara, a software developer with a background in Go and Rust programming. In this blog post, I’m excited to share my experience in the LFX mentorship program with the Linux Foundation and my work on the Kubewarden project enhancing the Go SDK to bring it parity with the Rust SDK.

The Kubewarden project is a security policy engine for Kubernetes, a popular container orchestration platform. As more and more businesses move their applications to the cloud, containers have become an increasingly popular way to manage and deploy applications. However, with this rise in popularity, there has also been a corresponding rise in security concerns. The Kubewarden project addresses these concerns by providing a way to enforce security policies in Kubernetes.

Kubewarden 2022 Wrapped

Thu, 29 Dec 2022 00:00:00 +0000

With 2022 almost over, it’s time to look back at what happened within the Kubewarden project during the last year.

The 1.0 release

A significant milestone for the project in 2022 was the release of Kubewarden v1.0.0 during the month of June.

With this release, the Kubewarden team committed to the stability of all the public interfaces of the project and all its Kubernetes Custom Resource Definitions.

Moreover, the project was considered ready to be used in production environments.

Community meeting is coming!

Tue, 20 Dec 2022 00:00:00 +0000

Community meetings have been a recurring demand from different sides and with the new year approaching, it’s time to make our first good resolution.

To improve community feedback, the Kubewarden project has decided to organize a monthly community meeting. The first community meeting to be held is scheduled for January 12th, 2023 at 4 PM UTC.

In addition to GitHub Discussions, GitHub issues, and the #kubewarden channel on the Kubernetes Slack, the community meeting is an additional avenue for the community to discuss Kubewarden and shape its future together.

Keeping track of Kubernetes deprecated resources

Wed, 09 Nov 2022 00:00:00 +0000

It’s fact of life: as the Kubernetes API evolves, it’s periodically reorganized or upgraded. This means some Kubernetes resources can be deprecated and later removed.

We deserve to easily keep track of those deprecations and removals. For that, we have just released the deprecated-api-versions policy.

A look at the deprecated-api-versions policy

This policy detects the usage of Kubernetes resources that have been deprecated or removed from the Kubernetes API.

The policy has two settings:

Kubewarden 1.3 is out!

Thu, 27 Oct 2022 00:00:00 +0000

The Kubewarden development team is happy to announce the release of the Kubewarden 1.3 stack.

In addition to the usual amount of small fixes, this release focused on the following themes.

Improve end users confidence

We want our users to feel confident about using Kubewarden, knowing that good development and security practices are being followed by the Kubewarden project. We think this is particularly relevant to Kubewarden, given our users trust us to keep their Kubernetes clusters secure and compliant.

v1.1.1 is out 🎉

Wed, 27 Jul 2022 00:00:00 +0000

We are happy to announce the first minor release of v1.0: v1.1.1 is now available!

Apart from being a nice looking number, v1.1.1 includes:

Improved the policies API for Sigstore verification by adding new backwards-compatible WaPC host callback v2/verify functions to the API. Check them out here to add support for your language of choice.

This has been used in the verify-image-signatures policy to simplify verification of GitHub Actions signatures and others. Read about it in this blog post.

Kubewarden policies, now on Artifact Hub!

Fri, 22 Jul 2022 00:00:00 +0000

Today we’re happy to announce that Artifact Hub now supports Kubewarden policies! 🤯 🥳

Artifact Hub is the de-facto place where Cloud Native users search for helm charts, container images, and other kinds of artifacts and configurations of different CNCF projects. That’s why we are super excited and honored to have Kubewarden policies listed on Artifact Hub.

This would not have been possible without the work done by the Artifact Hub team. They have been extremely helpful with us, thanks a lot folks! 🤗

CNCF Sandbox admission 🎊

Wed, 15 Jun 2022 00:00:00 +0000

Today the whole Kubewarden team is overjoyed because the Kubewarden project has just been accepted into the CNCF Sandbox!!! 🥳

This is a great achievement for the whole team and is the beginning of our journey into CNCF. Also, many thanks to the CNCF TOC for the feedback they provided during the project evaluation.

What’s next?

The admission happens at an interesting time since we are currently testing the 1.0.0-rc1 release of Kubewarden.

Kubewarden policies cover all the Kubernetes Pod Security Policies

Mon, 31 Jan 2022 00:00:00 +0000

The Kubewarden team worked tirelessly to create equivalent Kubewarden policies for all the deprecated Pod Security Policies (PSP). In order to reach this very important milestone, the team wrote the policies with the same validations available in the Kubernetes PSPs, and we counted on the community help to map and validate the policies.

This will allow our users to replace deprecated PSPs while continuing to enforce their security rules.

The Kubewarden policies which replace all the Kubernetes PSPs, are available in the Policy Hub, and you can find them by typing the keyword “PSP”. And, to have the exact same behavior of the Kubernetes PSPs is necessary a minimum version for some of the Kubewarden components, which are:

Policy Server on aarch64

Fri, 21 Jan 2022 00:00:00 +0000

We recently got notified that the policy-server was crashing in an aarch64 environment. The moment in which it got a request from the API server, it crashed immediately with a SIGSEGV signal.

We figured out that this was only happening when the request was a TLS one, and that the problem was related to the OpenSSL stack and the way we were producing the final image of the policy-server with the OpenSSL stack.

First year of Kubewarden

Wed, 22 Dec 2021 00:00:00 +0000

Year 2021 is almost over. Let’s take that as a chance to look back at what has been achieved during the 1st year of life of the Kubewarden project.

Finally, I’ll also talk about what we plan to do during the next one.

2021 Highlights

Project Announcement

The Kubewarden project has been introduced to the masses for the 1st time during KubeCon Europe 2021. During this presentation, Rafael and I explained what lead us to rethink how Kubernetes policies could be written and distributed. Watch the KubeCon Europe 2021 talk recording to better understand Kubewarden’s mission.

WebAssembly is coming to Cloud Native

Fri, 16 Jul 2021 00:00:00 +0000

Is the title of this post a pun inspired by Christmas or by the Games of Thrones? I can’t decide…
Are my dad jokes as bad as my daughters claim? Probably…
Is WebAssembly spreading inside of the Cloud Native ecosystem? 💯 I have no doubts about that!

First of all, why am I so excited about seeing WebAssembly flourish inside of the Cloud Native ecosystem? Well, it’s no secret that I’m a huge fan of it. After all, WebAssembly is at the heart of Kubewarden.

Let's learn Kubewarden - Streaming Event

Tue, 13 Jul 2021 00:00:00 +0000

In case you missed, CNCF Ambassador Saiyam Pathak recently hosted a live streaming event on his YouTube channel about Kubewarden. Flavio had the pleasure to join Saiyam and give an overview of the project.

We spoke about Kubernetes Admission Controllers, why we started the Kubewarden project and how it differentiates from other existing open source projects such as Open Policy Agent and Kyverno.

The talk features also a brief overview of WebAssembly, what it is and what are the benefits it provides to Kubewarden.