Release on Kubewarden

Admission controller 1.37.2 Release

Mon, 17 Aug 2026 00:00:00 +0000

Hi all! This patch release ships several fixes for the community. One of them addresses a CVE, and the others fix usability issues in the secure supply chain features and improve how Gatekeeper Rego runtime handle errors without representing an actual security failure.

AdmissionPolicy unique-name collision enables cross-namespace webhook confusion

Community security researcher Ville Vesilehto found a problem while testing Kubewarden’s namespaced admission policies. These policies should only evaluate resources in their own namespace. Ville’s finding shows that wasn’t always true.

Admission Controller 1.37 Release

Mon, 27 Jul 2026 00:00:00 +0000

Here we are, at the tail end of July. Belugas are migrating up north for the season, green turtles are moving to the islands for nesting, and spawned sardines are moving up the east coast of Africa. Kubewarden doesn’t want to miss this season!

Migration to new single Helm chart admission-controller-6.0.0

Since its inception, the Kubewarden Admission Controller has shipped as 3 separate Helm charts: kubewarden-crds, kubewarden-controller, and kubewarden-defaults.

This was done for flexibility: it allowed cluster operators to install/uninstall CRDs, recommended policies and PolicyServers on its own, and bump each part of the stack separately.

SBOMscanner 0.12 Release: Full-Stack Security with Node Scanning

Tue, 07 Jul 2026 00:00:00 +0000

We are thrilled to announce the release of SBOMscanner v0.12.0! With this version, SBOMscanner takes a big step forward in its mission to provide a complete, SBOM-based security picture of your Kubernetes clusters. The highlight of this release is the brand new Node Scan feature, which extends visibility from container images all the way down to the nodes that run them.

Why scan nodes?

Until now, SBOMscanner focused on what runs inside your cluster: container images pulled from your registries and, more recently, the workloads actually deployed on the cluster. That is a big part of the story, but it is not the whole story.

Admission Controller 1.36 Release

Tue, 02 Jun 2026 00:00:00 +0000

The garden has a new nameplate! Kubewarden 1.36 renames the repository and its container images, changes how PolicyServer deletion works, adds host network support, and ships the docs on a new platform.

Breaking changes

Repository and container image rename

We renamed the kubewarden-controller repository to adm-controller. The old name stopped making sense once the project grew beyond a single admission controller.

The container images moved too:

kubewarden-controller is now just controller
All images live under ghcr.io/kubewarden/adm-controller/

For example:

SBOMscanner 0.11.0 release

Wed, 06 May 2026 00:00:00 +0000

We are happy to announce SBOMscanner v0.11.0. This release introduces an MCP server for AI assistants, a new way to target a subset of a registry from a ScanJob, supply chain hardening with zizmor, and several fixes for race conditions in the storage controller watches.

MCP server

SBOMscanner now ships an MCP server that puts everything the controller knows in front of your AI assistant of choice. Instead of crafting kubectl queries across CRDs and joining the results in your head, you can ask Claude, Claude Code, GitHub Copilot, or any other MCP client questions like “which workloads in cluster prod are running an image with a critical CVE?”, “give me the top ten most vulnerable images across all my registries”, or “open a scan for the new tag I just pushed to library/nginx”. The assistant calls into SBOMscanner to list registries, scan jobs and workloads, inspect specific CVEs, follow scan progress, manage VEX hubs, and (when you want it to) create, update, or delete the corresponding resources for you.

Admission Controller 1.35 Release

Mon, 27 Apr 2026 00:00:00 +0000

This Admission Controller 1.35 release is one that builds the nest properly: load-bearing branches first, then careful weaving. A moderate security vulnerability has been fixed, and rather than a quick twig stuffed in a gap, the team reinforced the whole structure. This release brings also a new policy, an expansion on our threat model, and a JavaScrypt/TypeScrypt SDK relocation.

Security fix: RBAC reconnaissance and host capability calls

Kubewarden makes the following security promise:

Kubewarden 1.34 Release

Thu, 09 Apr 2026 00:00:00 +0000

After the big blooms of 1.33, this release turns its attention to the garden fence: making sure our CI pipelines are sturdy, our supply chain is trustworthy, and a nagging bug in kwctl gets pulled out by the roots. Nothing flashy, but the kind of care that keeps the garden healthy for the long haul. Let’s take a look at what’s new!

Fix for `kwctl scaffold` command

When using kwctl command scaffold manifest with a policy URI that omits an explicit tag (e.g. registry://ghcr.io/kubewarden/policies/pod-privileged), users would hit an unexpected error: “Cannot find policy with uri”.

SBOMscanner 0.10 Release

Tue, 10 Mar 2026 00:00:00 +0000

The Kubewarden ecosystem continues to expand its supply chain security capabilities! Hot on the heels of the Admission Controller 1.33 release, we are excited to announce SBOMscanner v0.10.0. This release introduces powerful new features and critical stability fixes. Let’s dive in!

Workload Scan

Until now, SBOMscanner required explicit Registry configurations to scan images. However, what usually matters most are the images actively running in your cluster.

The new Workload Scan feature automatically discovers and scans container images based on live workloads.

Admission Controller 1.33 Release

Mon, 09 Mar 2026 00:00:00 +0000

The garden is thriving and Kubewarden 1.33 is ready to bloom! Following last release’s big repotting, this one is serious about pruning, including a security issue. It’s not all housekeeping though, fresh flowers are blooming and come with nice features: BYO-PKI landing in the policy-server, field mask filtering for context-aware calls, proxy support, and a few more treats. Let’s dig in!

Security fix: Cross-namespace data access, removal of deprecated API calls

In our previous post we explained how our architecture protects namespaced policy users from privilege escalations. While this still stands, Ville Vesilehto (thevilledev on GitHub) found the following security vulnerability: an attacker with permissions to create AdmissionPolicies could make use of 3 deprecated host-callbacks (kubernetes/ingresses, kubernetes/namespaces, kubernetes/services) to craft a policy that would allow them read access to Ingresses, Namespaces, and Services resources respectively.

Kubewarden 1.32 Release

Thu, 05 Feb 2026 00:00:00 +0000

Another year rolls around, and Kubewarden is still growing like a well-watered houseplant! Kubewarden got a New Year’s resolution to tidy up and repot, and has gone full on with digital gardening. This release is a maintenance one, with big moves to monorepos and a refresh in release artifacts.

New Admission Controller monorepo

With the addition of SBOMscanner to the Kubewarden harvest, we saw a great opportunity for cleanup on the Admission Controller side.

Kubewarden 1.31 Release

Tue, 25 Nov 2025 00:00:00 +0000

Preparing for season celebrations, Kubewarden grabbed its running shoes and went for a lively jog. This release is about keeping your cluster environment fit and lively: new policy, new Sigstore airgap features, backup support, and new resource limits for our Helm charts and among other things.

The running group is growing too!

New peer project: SBOMScanner

As announced some weeks ago, the Kubewarden family is growing with the addition of SBOMscanner. Have a read of its blog post here.

Kubewarden 1.30 Release

Thu, 30 Oct 2025 00:00:00 +0000

Today, Kubewarden 1.30 woke up, shook itself, stretched its wings and took off to a cluster near you! This release brings in its beak a bunch of policy features, and performs some future-proofing migrations.

Migration to OpenReports

So far, the Kubewarden Audit Scanner feature has been using the PolicyReports CRDs from policyreports.wgpolicyk8s.io to save its results. These CRDs came from the Kubernetes Policy Working Group and enabled standardized reporting across policy engines.

Policy Server 1.29.2 Patch Release

Fri, 17 Oct 2025 00:00:00 +0000

Earlier this week we published a patch release of Policy Server. The fix was required to avoid a crash at startup time.

The crash was caused by some changes inside the Sigstore TUF repository, specifically the introduction of a new public key for the Rekor service. The Rust library we use to interact with Sigstore could not handle this change, resulting in an error.

The patch we issued on Monday allowed Policy Server to continue operating in a degraded mode. Everything worked as expected except for signature verification, which always failed with an error.

Kubewarden 1.29.1 Patch Release

Mon, 13 Oct 2025 00:00:00 +0000

Today, we released patch updates for both Policy Server and kwctl.

These releases address a startup failure affecting both components, caused by an issue initializing Sigstore’s TUF repository.

With this fix, Policy Server and kwctl will now exit with an error only if policy verification settings are enabled. Policies using image verification settings will reject all images that rely on Sigstore certificate infrastructure (like keyless signatures).

In the meantime, we are collaborating upstream to resolve the Sigstore issue.

Kubewarden 1.29 Release

Wed, 01 Oct 2025 00:00:00 +0000

Straight from the kitchen, Kubewarden 1.29 is served! This release is a poké bowl of healthy stack features, crisp policy improvements, and some fresh fixes, all seasoned with the wholesome flavour of paid-off tech debt.

Removal of Picky dependency and stringent behavior change

We have long depended on the Rust crate picky as the implementation for X.509 and PKI certificates that we use in our cryptographic host capabilities. It allowed us to overcome some limitations in the webpki crate.

Kubewarden 1.28 Release

Wed, 27 Aug 2025 00:00:00 +0000

Kubewarden 1.28 has emerged refreshed from a bath in the lake (just like my dog on the morning walk before writing this post!). This release cycle comes mainly with improvements on policies, though some stack features plus kwctl bugfixes also bubbled up.

Supporting Hauler for air-gap installs

With 1.28, our Helm chart releases now include a Hauler YAML manifest.

Hauler is an Open Source project that provides a declarative way of saving all artifacts needed for air-gap installs, along with a tool (the hauler cli) that works with it without requiring operators to adopt a specific workflow.

Kubewarden 1.27.3 Patch Release

Thu, 14 Aug 2025 00:00:00 +0000

We have just released 1.27.3, a small patch release for kwctl. This newly released kwctl version v1.27.3 fixes a bug on the kwctl run subcommand for ClusterPolicyGroups and PolicyGroups.

When evaluating policies and policy groups, both kwctl and policy-server take care of running the policies in the correct execution mode that the policies have defined via their metadata. This means that Kubewarden policies that are Wasm modules intended to run as WASI are executed as such. The same applies, for example, to Rust policies compiled for WAPC or to OPA policies.

Kubewarden 1.27.2 Patch Release

Tue, 05 Aug 2025 00:00:00 +0000

We have just released 1.27.2, a small patch release for kwctl. This newly released kwctl version v1.27.2 fixes 2 bugs on the kwctl scaffold admission-request subcommand.

On first run, kwctl scaffold admission-request tries to connect to a cluster (if it exists) via kubeconfig, and create a cache of available resource definitions. This allows for scaffolding AdmissionRequests for CRDs in the cluster.

Starting from 1.22, there was a bug where kwctl failed to create the internal client to connect to a running cluster. This wasn’t triggered if you had no available cluster or kubeconfig or if you already had an existing cache. Now, kwctl will correctly create the cache with a valid client if possible.

Kubewarden 1.27.1 Patch Release

Fri, 01 Aug 2025 00:00:00 +0000

We have just released 1.27.1, a small patch release for kwctl.

With 1.27, kwctl CLI now performs post-policy processing validations previously only done by the policy-server. This includes checking for the policy mode, as in spec.mode being monitor or protect. This was achieved by refactoring the code in the policy-server and moving it to our library, policy-evaluator.

With this change, we introduced a regression in the command kwctl run, used to run policies. The regression consists in kwctl run expecting the spec.mode as Monitor or Protect, in uppercase instead of lowercase. Given that when spec.mode is not defined, it takes the default value of Protect, this would result in an error.

Kubewarden 1.27 Release

Tue, 29 Jul 2025 00:00:00 +0000

Here’s a look at the key updates and improvements in the latest release.

New High-Risk Service Account Policy

In this release, we’ve introduced a new policy to improve cluster security. The High-Risk Service Account Blocker policy, as its name suggests, blocks workloads that attempt to run with a service account that has excessive permissions.

This policy leverages the Kubernetes authorization API and allows cluster operators to define a list of forbidden permissions. Workloads using a service account with any of these permissions will be blocked. Check out the policy’s repository to learn more about its configuration.

Kubewarden 1.26 Release

Wed, 25 Jun 2025 00:00:00 +0000

Kubewarden 1.26 is fresh out of the oven, with a nice bunch of features.

Running policies from YAML locally with kwctl

Up until now, to run policies with kwctl run one needed to pass the policy module URL, the settings, and the context-aware settings via specific flags. For example:

$ kwctl run \
 --settings-json '{"allowPorts": [80], "denyPorts": [3000]}' \
 --request-path req_pod_with_allowed_capabilities_accept.json \
 registry://ghcr.io/kubewarden/policies/ingress:v0.1.8

Thanks to suggestions from our user community, kwctl now can consume a YAML file containing the Custom Resource Definition of policies, and run the request against them. Using this run mode, kwctl evaluates not only 1 policy, but each policy in the file using the same request.

Kubewarden 1.25 Release: Priority Class Support and CI Security Enhancements

Thu, 15 May 2025 00:00:00 +0000

Kubewarden 1.25 arrives with:

enhanced Kubernetes Priority Class integration across the stack
improved CI security through GitHub Actions cleanup
usability refinements in the kwctl tool.

Priority Class support

A key feature of this release is the comprehensive integration of Kubernetes Priority Classes across the entire Kubewarden stack. This allows for fine-grained control over the scheduling and resource allocation of Kubewarden components and other workloads in the cluster. The Kubewarden Helm charts now include a new value, .global.priorityClassName. This priorityClassName is applied to the controller deployment pods and the pods of the default policy server. Further details can be found in the official documentation.

Kubewarden 1.24 release

Wed, 30 Apr 2025 00:00:00 +0000

The wait is over, Kubewarden 1.24 has arrived! We have some Easter eggs for you in this one.

Promoting our policies to v1.0.0

In the past, we consciously picked semver 0.X.Y for policy versions as that meant that the policy API for the user (in this case, the policy spec.settings) was not considered stable.

Since the settings of our policies haven’t changed since their initial release, we decided it was time to highlight their stability by promoting them to v1.0.0.

Kubewarden 1.23 release

Wed, 26 Mar 2025 00:00:00 +0000

The wait is over—Kubewarden 1.23 has arrived! Packed with exciting security enhancements, smoother workflows, and important updates, this release is here to make your Kubernetes experience even better. Let’s dive into what’s new!

Hardening of the admission webhooks

Kubernetes Dynamic Admission Controllers, like Kubewarden, work by providing a webhook server that implements the validation/mutation API defined by the Kubernetes project. These webhook servers are usually deployed within the same cluster as regular Kubernetes workloads. They are exposed internally using Kubernetes’ Service resources.

kwctl 1.22.1 patch release

Tue, 04 Mar 2025 00:00:00 +0000

Today we published the 1.21.1 patch release of kwctl.

This release includes a fix for a bug that, under certain circumstances, could prevent users from pushing policies to a container registry.

The 1.22.0 release introduces the ability to add policy annotations to the manifest of the OCI artifact that is pushed to the container registry. This feature is useful for adding metadata to the OCI artifact that can be utilized by other tools in the CI/CD pipeline.

Kubewarden 1.22 release

Wed, 26 Feb 2025 00:00:00 +0000

We’re excited to announce the release of Kubewarden v1.22! This release brings some improvements to kwctl and the Rust SDK, together with some internal changes to prepare for future work.

Breaking change: PolicyServer health check endpoint change

⚠️ IMPORTANT⚠️ Breaking change: If you have created a custom instance of PolicyServer with a hard-coded .spec.image, you must update it to consume the v1.22.0 tag.

Starting from 1.22, the Policy Server health check endpoint is exposed on port 80 instead of port 443, and Policy Server Deployment objects created by the kubewarden-controller make this assumption.

Kubewarden 1.21.1 patch release

Wed, 05 Feb 2025 00:00:00 +0000

Today we published the 1.21.1 patch releases of the kwctl and Policy Server components of the Kubewarden stack.

The release ensures all Sigstore verification capabilities work.

What happened

On Monday, February 3rd, the contents of Sigstore’s TUF repository were updated. During this process, part of the repository metadata wasn’t properly handled. Specifically, one of the KEYIDs of the repository wasn’t updated when the key contents were modified.

The breaking change wasn’t noticed by upstream maintainers as the TUF Go implementation is not performing strict verification of the KEYID.

Kubewarden 1.21 release

Thu, 30 Jan 2025 00:00:00 +0000

We’re excited to announce the release of Kubewarden v1.21, our first release of 2025!

The release addresses two security issues that the Kubewarden team has discovered. Detailed information about them is included below. While these issues do not have a critical impact, we recommend our users upgrade their Kubewarden deployments.

Alongside these security fixes, the 1.21 release includes the usual stream of dependency updates and features some improvements to our documentation.

Kubewarden 1.20 release

Thu, 19 Dec 2024 00:00:00 +0000

We’re excited to announce the release of Kubewarden v1.20! This release brings a nice improvement for deploying with OpenTelemetry and some bug fixes.

Supporting more OpenTelemetry scenarios

⚠️ IMPORTANT⚠️ The kubewarden-controller Helm chart has changed the values.yml schema for the OpenTelemetry keys, hence this update is not backwards-compatible if you have configured OpenTelemetry. Please adapt your values to the new values.yml format.

This is of course reflected with a major version bump of the chart version.

Kubewarden 1.19 release

Mon, 02 Dec 2024 00:00:00 +0000

We’re excited to announce the release of Kubewarden v1.19! This release brings a host of improvements focused on minor bug fixes, adding tests, and developer tech debt improvements.

Bug Fixes and Dependency Updates

As always, we’ve addressed bugs and updated dependencies to ensure a smooth and reliable experience. Notably, we’ve updated the dependencies for our major components. These updates contribute to the overall stability and security of the Kubewarden stack.

Kubewarden 1.18 release, SLSA level 3

Mon, 04 Nov 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.18.0. For this release we have focused on achieving level 3 of the SLSA standard, in addition to minor bug fixes, adding tests, and developer tech debt improvements.

SLSA level 3

Kubewarden has been at the forefront of Sigstore integration (being co-maintainers of the upstream sigstore-rs Rust library), and have signed our artifacts and provided SBOMs for several years.

For this cycle, we have made the necessary changes to our build pipelines to achieve level 3 of SLSA. SLSA is the standard for describing and improving supply chain security.

Kubewarden 1.17 release

Mon, 30 Sep 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.17.0. This release is packed with big features, let’s have a look!

Certificate rotation & removal of cert-manager dependency

Starting from this release, the Kubewarden stack takes care of creating and rotating all the needed TLS certificates and certificate authorities.

Kubewarden, by virtue of connecting to the Kubernetes API server, needs TLS certificates for both the kubewarden-controller (when creating webhooks for its policies) and for the PolicyServers (so they can report their results to the Webhook API server).

Policy Server and kwctl 1.16.1 patch releases

Wed, 04 Sep 2024 00:00:00 +0000

Today we published the 1.16.1 patch release of Policy Server and kwctl.

The release addresses a breaking change inside Sigstore’s TUF repository. The change caused errors while retrieving the contents of the TUF repository, which broke part of Kubewarden’s integration with Sigstore.

More specifically, it was no longer possible to verify the signatures of Kubewarden’s policies and to verify the signatures of the container images used inside of a Kubernetes cluster via policies like verify-image-signatures.

Kubewarden 1.16 release

Mon, 19 Aug 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.16.0! Following the northern hemisphere summer, this version packs some goodies but is a bit more lightweight than usual.

kwctl scaffold for AdmissionRequests

The kwctl cli has learned a new command, kwctl scaffold admission-request, which prints a Kubernetes AdmissionRequest object from the provided Kubernetes resource definition.

This is useful when developing policies (and not only limited to Kubewarden ones). Now, you can scaffold the desired AdmissionRequest the policy would receive, and then end-to-end test a Kubewarden policy against the created AdmissionRequest with kwctl run. For example, here we scaffold a request to create an Ingress object, which then we use to test one of our policies out of cluster:

Kubewarden 1.15 release

Tue, 30 Jul 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.15.0! This version comes packed with CEL policy updates, controller enhancements, and fixes that make Kubewarden even more robust and user-friendly.

Enhanced PolicyServer CRD with Tolerations

One of the standout features of Kubewarden v1.15 is the extension of the PolicyServer Custom Resource Definition (CRD) to include a list of Toleration objects to be used in the deployment created for the Policy Server. This enhancement allows users to specify tolerations directly within the PolicyServer CRD, simplifying the management of taints and tolerations across your Kubernetes cluster. By integrating this directly into the CRD, Kubewarden ensures a more streamlined and consistent approach to handling node tolerations, making it easier to deploy policies in diverse and dynamic environments.

Kubewarden 1.14 release

Tue, 25 Jun 2024 00:00:00 +0000

We are thrilled to announce the release of Kubewarden v1.14.0! This version comes packed with new capabilities, enhancements, and fixes that make Kubewarden even more robust and user-friendly.

New Host Capability for Container Image Configuration

One of the significant updates in this release is the introduction of a new host capability that allows policies to fetch the container image configuration. This update stems from a user request to enhance the user-group-psp-policy policy by enabling it to check the user defined to run the container in the image configuration. Previously, this information was not accessible through the available host capabilities, as it was not included in the image manifest. Thanks to the functionality provided by the oci-distribution crate, which already has a method to fetch this information, we were able to extend our policy evaluator and SDKs to expose this capability.

Kubewarden 1.13 release

Thu, 06 Jun 2024 00:00:00 +0000

I’m pleased to announce a new release of Kubewarden, version 1.13. This release features a series of improvements and bug fixes that contribute to better performance and stability.

Let’s go through the most significant changes.

Policy Server memory usage

A community member reported that the Kubewarden Policy Server was using a lot of memory, especially when running context aware policies on big clusters. The number of resources being accessed by the policies was significantly high, in the order of 3200 Namespaces, 10500 Ingresses, 200 ClusterRoleBindings and 11000 RoleBindings. Under certain circumstances, the amount of memory being used caused the Policy Server to be terminated by the kernel’s OOM killer.

Kubewarden 1.12 release

Wed, 24 Apr 2024 00:00:00 +0000

Today we’re glad to announce the release of Kubewarden 1.12.

This release focuses on optimizations and high availability, both oriented to production.

Optimizing Gatekeeper policies

The previous 1.11 release featured lots of optimizations for context aware policies.

The 1.12 release provides a further optimization for Gatekeeper policies that access Kubernetes resources. This optimization provides an extra 55% performance boost for these policies.

The benefits of this optimization are particularly noticeable when a huge number of Kubernetes resources are accessed by a Gatekeeper policy.

Kubewarden 1.11 release

Thu, 21 Mar 2024 00:00:00 +0000

Today we’re glad to announce the release of Kubewarden 1.11.

This release focuses on performance improvements, especially when running on big Kubernetes clusters.

Audit Scanner

A lot of work has been done on the audit scanner. The auditing of resources is now done in parallel, which means less time is required on big clusters to scan all the available resources.

We’ve also changed how we handle Policy Reports. Kubewarden is still using the Policy Report format being defined inside the Kubernetes’s wg-policy group. However, prior to this release, we used to create one PolicyReport per Namespace and one ClusterPolicyReport per cluster. This solution proved to not scale inside clusters with many audited resources. Depending on the number of policies and audited resources, the size of the final report objects could be too big to fit into etcd. Moreover, the amount of memory required by the audit scanner could be significant.

Kubewarden 1.10 release

Fri, 26 Jan 2024 00:00:00 +0000

We have the first release of 2024, Kubewarden 1.10.0! 🎉🥳

And this one contains a nice bag of goodies, let’s have a look!

Reduced memory usage and increased reliability of Policy servers

A nice graph is worth a thousand words!

Note the slightly lower memory consumption, and unchanging consumption when scaling horizontally.

This graph represents the memory consumption of one instance of policy-server, containing 13 policies:

Kubewarden 1.9.0 release

Fri, 03 Nov 2023 00:00:00 +0000

Not even a month after the 1.8.0 release, today we are happy to announce Kubewarden 1.9.0! 🎉🥳

This release includes two major features that have been requested by our community.

Making Rego policies context-aware

Context-aware policies have been introduced with Kubewarden 1.6.0. These policies can obtain information about other Kubernetes resources at evaluation time. This allows them to make decisions based not only on the information provided by the AdmissionReview object they receive.

Kubewarden 1.8.0 release

Wed, 11 Oct 2023 00:00:00 +0000

Today we are happy to announce the release of Kubewarden 1.8.0! 🎉🥳

This is a small release, focused on OpenTelemetry.

The OpenTelemetry Protocol (OTLP) got its first 1.0.0 version in July 2023; several libraries got their first 1.0.0 release, such as the Go metric SDK or the .NET Automatic Instrumentation.

Still, the OpenTelemetry stack is not yet stable, and unannounced backwards-incompatible changes still happen. You can have a look at the status of OpenTelemetry libraries and protocols.

Kubewarden 1.7.0 release

Thu, 21 Sep 2023 00:00:00 +0000

Today we are delighted to announce the release of Kubewarden 1.7.0! 🎊 🥳 Aside from the bug and stability fixes, this release is packed with new features. This post highlights the main changes, detailed blog entries will come in the next weeks covering each feature in depth.

Audit scanner

A new component has been added to the Kubewarden stack. Its name is audit-scanner and it allows administrators to assess the compliance level of the clusters secured by Kubewarden.

Telemetry enhancements released!

Tue, 09 May 2023 00:00:00 +0000

We are excited to announce a variety of updates, fixes, and enhancements for Kubewarden components!

This release primarily focuses on improvements to Kubewarden telemetry and dependency updates.

Telemetry Enhancements and Fixes

The Kubewarden controller has received several fixes and improvements in the telemetry department. These include a streamlined process for users to deploy a policy server with telemetry enabled, as well as a bug fix related to the controller’s available metrics.

Kubewarden 1.6.0 is released!

Mon, 17 Apr 2023 00:00:00 +0000

We are pleased to announce the availability of the Kubewarden 1.6.0 stack.

This release brings stability, performance and security improvements. All packed with a new major feature. Let’s dig into the changes!

Security Improvements

The Kubewarden controller is ran using a dedicated Service Account. Prior to this release, the Service Account had access to a series of Kubernetes resources across the entire cluster.

Starting from this release, the Kubewarden controller Service Account has a more limited access to the cluster. Access to some resources is now tied to the Namespace inside of which the controller is deployed.

Kubewarden UI 1.0.0 is released!

Thu, 09 Feb 2023 00:00:00 +0000

We are excited to announce that the Kubewarden UI 1.0.0 has been released!

The UI is an Extension for Rancher Manager, now you will be able to enable Kubewarden policies for your Kubernetes clusters with a streamlined user experience. You can find the latest releases of the extension Helm chart, the release provides a Github Pages deployment which can be used when adding the UI as a Helm repository.

Currently Rancher is required to run this extension, however, in the future it will be possible to deploy the same UI as a stand-alone platform.

Kubewarden 1.5.0 release

Fri, 20 Jan 2023 00:00:00 +0000

Today we’re pleased to announce the availability of Kubewarden 1.5.0!

This release brings the usual amount of small bug fixes, dependency updates, and a major security enhancement. Let’s take a closer look!

Policy evaluation timeout

The Kubewarden team is constantly working to improve the security posture of the project. As part of these efforts, we’re excited to introduce the new “policy evaluation timeout” feature.

Starting from this release, Policy Server will interrupt the evaluation of admission requests after a certain amount of time has elapsed. This security feature, which is enabled by default, prevents a Policy Server from running out of computing resources because one or more of its policy evaluations are stuck in infinite loops. This mitigates a type of Denial Of Service (DOS) attacks against the Policy Server.

Kubewarden 1.4.0 release

Mon, 05 Dec 2022 00:00:00 +0000

Today we’re pleased to announce the availability of Kubewarden 1.4.0.

This version brings some minor fixes to our controller and helm charts and two new interesting features.

Sigstore certificate verification

Kubewarden integration with Sigstore keeps growing. Starting from this release it’s possible to verify signatures that have been produced with certificates.

This can be useful to organizations that are using hardware tokens and KMS solutions to sign their container images via Sigstore.

Kubewarden 1.3 is out!

Thu, 27 Oct 2022 00:00:00 +0000

The Kubewarden development team is happy to announce the release of the Kubewarden 1.3 stack.

In addition to the usual amount of small fixes, this release focused on the following themes.

Improve end users confidence

We want our users to feel confident about using Kubewarden, knowing that good development and security practices are being followed by the Kubewarden project. We think this is particularly relevant to Kubewarden, given our users trust us to keep their Kubernetes clusters secure and compliant.

v1.1.1 is out 🎉

Wed, 27 Jul 2022 00:00:00 +0000

We are happy to announce the first minor release of v1.0: v1.1.1 is now available!

Apart from being a nice looking number, v1.1.1 includes:

Improved the policies API for Sigstore verification by adding new backwards-compatible WaPC host callback v2/verify functions to the API. Check them out here to add support for your language of choice.

This has been used in the verify-image-signatures policy to simplify verification of GitHub Actions signatures and others. Read about it in this blog post.

Kubewarden reaches 1.0.0 release 🎉

Wed, 22 Jun 2022 00:00:00 +0000

Kubewarden is a policy engine for Kubernetes that is part of CNCF Sandbox.

Never heard of Kubewarden before? Do you want to know what makes Kubewarden stand out among similar solutions? This is a high level overview of Kubewarden’s unique points:

Boost Policy Authors’ productivity: write policies using your favorite programming language. Leverage your knowledge, skills and tools.
Policies are portable WebAssembly modules
Reuse your existing Open Policy Agent / Gatekeeper policies
Distribute policies using regular container registries
Secure supply chain, leverage Sigstore to sign and verify policies

Today, a year and a half since its conception, we’re thrilled to announce the release of Kubewarden v1.0.0! 🎊 🥳