Deep-Dive on Kubewarden

Rego policy library relaunch

Tue, 22 Apr 2025 00:00:00 +0000

We are excited to announce the latest additions to our policy library!

Seventy finely crafted Rego policies are now available for you to use in your Kubernetes clusters.

Rego policy library

The Kubewarden’s Rego policy library is a collection of policies written in Rego, the policy language used by Open Policy Agent (OPA). These policies are designed to help you enforce security and compliance best practices in your Kubernetes clusters.

Securing the usage of volumeMounts

Thu, 03 Nov 2022 00:00:00 +0000

We present to you the new volumeMounts Policy: It inspects containers, init containers, and ephemeral containers, and restricts their usage of volumes by checking the volume name being used in the containers’ volumeMounts[*].name.

You can find it published in Artifact Hub. As usual, its artifact is signed with Sigstore in keyless mode, and if you are curious, you can peek into the policy’s implementation in Rust here.

This new policy joins the already existing volumes-psp policy, which provides an allowlist of volume types, and hostpaths-psp policy, with an allowlist of hostPath volumes.

Migrate your PSPs to Kubewarden policies!

Wed, 13 Jul 2022 00:00:00 +0000

Warning: the code snippets shown inside of this blog post have become outdated. For up-to-date information checkout this section of the Kubewarden documentation.

As announced in past blog posts, Kubewarden has 100% coverage of the deprecated, and soon to be removed, Kubernetes PSPs. If everything goes as expected the PSPs will be removed in Kubernetes v1.25 due for release on 23rd August 2022.

The Kubewarden team has written a script that leverages the migration tool written by AppVia, to migrate PSP automatically. The tool is capable of reading PSPs YAML and can generate the equivalent policies in many different policy engines. Our simple script migrates your PSPs to their equivalent Kubewarden policies.

Multiplatform Kubewarden

Fri, 04 Feb 2022 00:00:00 +0000

The Kubewarden team is glad to announce that in the spirit of helping Policy Authors and Cluster Administrators, the project is now officially multiplatform.

The list of supported platforms as of now are:

Policy Server, as a container image:
- linux/amd64 (with the musl libc)
- linux/arm64 (with the musl libc)
kwctl, as a standalone binary:
- darwin (x86_64)
- linux (aarch64, with the musl libc)
- linux (x86_64, with the musl libc)
- windows (x86_64, with MSVC)

We have prioritized the usage of the same dependencies and toolchain on platforms where we were able to do so.

Towards a universal policy platform

Tue, 21 Sep 2021 00:00:00 +0000

Kubewarden is a policy framework for Kubernetes. It can be used to secure your clusters and to ensure they stay compliant with the rules your organization establishes over time.

By leveraging the power of WebAssembly, Kubewarden allows policy authors to write policies using traditional programming languages such as Rust, Go, AssemblyScript and Swift.

Kubewarden policies, once compiled into WebAssembly modules, are then distributed using regular OCI registries. This allows Operators to have a consistent way to securely distribute both container images and policies.