Tutorial on Kubewarden

Preventing containers from sharing the PID namespace with Kubewarden

Wed, 09 Sep 2026 00:00:00 +0000

The PID namespace

A container consists of one or more processes on the host. Kernel primitives, such as namespaces, isolate these processes. A process in a PID (process ID) namespace can see processes in the same namespace and its descendants, but nothing outside of the namespace. For containers, this isolation prevents processes in one container from seeing or interacting with processes in other containers or on the host.

To test the impact of missing PID isolation, try to disable it in Docker or Podman using the --pid=host flag:

Constraining Container Resources with Kubewarden

Mon, 31 Aug 2026 00:00:00 +0000

Kubewarden is a policy framework for Kubernetes that helps you set up tighter guardrails for your Kubernetes cluster. Policies allow you to restrict deployments on your cluster in many ways, like:

control the container images that are used
permit only certain users to perform actions
limit resources that can be assigned to a deployment.

In this tutorial, we cover how to set up Kubewarden and apply a policy providing boundaries and defaults to container resource limits for pods. You need is a running Kubernetes cluster (for example, k3s) and Helm to get started!

Policy Groups deep dive

Wed, 02 Oct 2024 00:00:00 +0000

With v1.17, we introduced a new powerful feature, Policy Groups, enabled by two new Kubernetes Custom Resources:

AdmissionPolicyGroups: Namespaced policy comprised of several policies.
ClusterAdmissionPolicyGroups: Clusterwide policy comprised of several policies.

These new Policy Groups resources define a policy comprised of several policies and their policy settings, and they perform a combined evaluation of those multiple policies using logical operators.

Why are these useful? Because they reuse existing policies, reducing the need for custom policy creation. And they provide complex logic while at the same time reducing complexity as you have all the logic contained in one resource definition.

Introducing the CEL policy

Mon, 17 Jun 2024 00:00:00 +0000

We are pleased to announce a new policy by the Kubewarden team: cel-policy.

This new policy uses the Common Expression Language (CEL). For those new to CEL, it is a general-purpose expression language designed to be fast, portable, and safe to execute. CEL as a language is memory-safe, side-effect free, terminating (as in “programs cannot loop forever”), and strong & dynamically typed.

CEL is a perfect candidate for extending the Kubernetes API, as CEL expressions can be easily inlined into CRD schemas, and compiled and type-checked “ahead-of-time” (when CRDs are created and updated). With Kubernetes 1.30, CEL features such as ValidatingAdmissionPolicies and other validation rules are now marked as stable.

Retrieving OCI Image Manifests

Mon, 25 Mar 2024 00:00:00 +0000

Kubewarden’s latest version 1.11.0 introduces a new feature enabling policies to retrieve OCI image manifests. This function, supported in both Rust and Go SDKs, enhances the policy enforcement capabilities within Kubernetes environments.

The update provides an additional layer of security inspection for containerized environments. Developers can now write policies using the updated SDKs to access OCI image manifests of container images. This access facilitates more detailed inspections and validations, aligning with security standards and organizational protocols.

Welcoming the Audit Scanner

Wed, 11 Oct 2023 00:00:00 +0000

Fresh in the already released Kubewarden v1.7.0 stack, we welcome a new module: the Audit Scanner!

Audit Scanner?

Up until the release of Audit Scanner, Kubewarden was strictly a Dynamic Admission Controller, checking requests made against the Kubernetes API server with the deployed policies.

Yet policies evolve over time; new ones are deployed, and existing ones are updated. This can mean that resources that are inside the cluster are no longer compliant. A resource that was compliant some weeks ago, today may not be valid since the introduction of a new policy.

Support for sigstore certificate signing

Mon, 05 Dec 2022 00:00:00 +0000

Secure supply chain is one of the hottest topics right now. Many organizations are implementing strategies to verify the provenance of their software starting from the development phase up to the deployment in production.

Sigstore is an open source project that makes incredibly easy to sign and verify assets. Lots of open source projects and organizations are using it to sign and verify their container images, system packages and any kind of binary artifact. It’s no secret we are Sigstore enthusiasts.

Installing and Running Kubewarden In Air-Gapped Environments

Tue, 29 Nov 2022 00:00:00 +0000

We are glad to announce that deploying Kubewarden in air gap environments has been simplified and documented! For that, you will need a private OCI registry accessible by your Kubernetes cluster. Kubewarden policies are WebAssembly modules; therefore they can be stored inside an OCI-compliant registry as OCI artifacts. For an air gap installation you need to download all the Kubewarden container images and policies in your workstation, then move them to your private OCI registry. Check the Kubewarden docs for a step-by-step guide.

Enforcing compliance of container's environment variables

Mon, 31 Oct 2022 00:00:00 +0000

We’re glad to present the new environment-variable-policy to Kubewarden users. With this policy, you will now be able to inspect init containers and ephemeral containers. You can also restrict their usage by reviewing the names and values defined under the containers’ env[*] field.

As always, the policy can be found in ArtifactHub and all the artifacts, including the BOM files, are signed with Sigstore.

What is so useful about the new environment-variable policy?

This policy complements the recently released env-variable-secrets-scanner policy. Both policies focus on validating the environment values provided to Kubernetes Pod objects. In this new policy, users can validate which variables name and values their resources can have.

Scanning secrets in environment variables

Mon, 24 Oct 2022 00:00:00 +0000

We are thrilled to announce you can now scan your environment variables for secrets with the new env-variable-secrets-scanner-policy! This policy rejects a Pod or workload resources such as Deployments, ReplicaSets, DaemonSets , ReplicationControllers, Jobs, CronJobs etc. if a secret is found in the environment variable within a container, init container, or ephemeral container. Secrets that are leaked in plain text or in base64 encoded variables are detected.

This policy uses rusty hog, an open source secret scanner from New Relic. The policy looks for the following secrets being leaked: RSA private keys, SSH private keys and API tokens for different services like Slack, Facebook tokens, AWS, Google, New Relic Keys, etc

Verify image signatures with GitHub Actions and KeylessPrefix

Thu, 21 Jul 2022 00:00:00 +0000

With the latest releases of Kubewarden v1.1.0 and the verify-image-signatures policy, it’s now possible to use GithubActions or KeylessPrefix for verifying images. Read our previous blog post if you want to learn more about how to verify container images with Sigstore using Kubewarden.

Let’s see it in action!

We want to verify the image ghcr.io/raulcabello/app-example which was built and signed inside a GitHub action using this GitHub Action.

Out of the box, GitHub Actions have a specially crafted environment that makes Sigstore keyless signing work in a non-interactive way. The signatures produced in this way contain unique secure information that allow us to identify the GitHub owner (be it an individual or an organization) and the GitHub repository inside of which the GitHub Action has been executed.

Secure Supply Chain: Verifying image signatures

Fri, 20 May 2022 00:00:00 +0000

After these last releases Kubewarden now has support for verifying the integrity and authenticity of artifacts within Kubewarden using the Sigstore project. In this post, we shall focus on verifying container image signatures using the new verify-image-signatures policy.

To learn more about how Sigstore works, take a look at our previous post

Verify Image Signatures Policy

This policy validates Pods by checking their container images for signatures (that is, containers, init containers and ephemeral containers in the pod)

Have you migrated your Kubernetes PodSecurityPolicy?

Thu, 12 May 2022 00:00:00 +0000

If you use a version of Kubernetes (< v1.24) that supports the deprecated PodSecurityPolicy (a.k.a PSP), you would be wondering what to do after the Kubernetes v1.25 version when the PSP will be removed. With this in mind, the Kuberwarden team wrote a documentation to help users migrate away from PSPs to Kuberwarden policies.

As you know, the original Pod Security Policies had many configuration knobs. The Kubewarden team created a series of policies that offer a 100% feature parity with all the soon to be dropped Pod Security Policies. This section of our documentation highlights all these policies and guides you through their recommended settings.

Introducing the Monitor mode

Fri, 06 May 2022 00:00:00 +0000

Policies are a core component of a Kubernetes cluster story that involves security, compliance and consistency.

Being this process an iterative one, it’s common for new policies to potentially reject operations that we might be issuing today in our production clusters.

As an example, we might have decided that it’s not possible to change certain annotations on existing resources after the fact. In this case, we don’t want to revoke UPDATE rights completely, but just to define an inalterable set of annotations after the resource has been created.

Secure Supply Chain with Kubewarden: securing Kubewarden policies

Mon, 02 May 2022 00:00:00 +0000

With recent releases, the Kubewarden stack supports verifying the integrity and authenticity of content using the Sigstore project.

In this post, we focus on Kubewarden Policies and how to create a Secure Supply Chain for them.

Sigstore?

Since a full Sigstore dive is not within the scope for this post, we recommend checking out their nice docs.

In short, Sigstore provides an automatable workflow to match the distributed Open Source development model. The workflow specifies how to digitally sign and verify artifacts which in our case are Kubewarden Policies. It also provides a transparency log to monitor such signatures. The workflow allows to sign artifacts with traditional Public-Private key pairs, or in Keyless mode.

Introducing the AdmissionPolicy

Wed, 16 Mar 2022 00:00:00 +0000

Up till now, the only way to define a policy in Kubewarden was to use the ClusterAdmissionPolicy resource that would be applied to cluster-wide resources across all namespaces.

That’s why we’re thrilled to announce the new AdmissionPolicy resource. This new resource is created inside a namespace and the policies will only process the requests that are targeting the namespace where the AdmissionPolicy is defined. Except from being a “namespaced” resource, AdmissionPolicy works exactly the same as the ClusterAdmissionPolicy.

Deep Dive into policy logging

Mon, 15 Nov 2021 00:00:00 +0000

Policies are regular programs. As such they often have the need to log information. In general, we are used to make our programs log into standard output (stdout) and standard error (stderr) outputs.

However, policies run in a confined WebAssembly environment. For this mechanism to work as usual Kubewarden would need to set up the runtime environment in a way that the policy can write to stdout and stderr file descriptors, and upon completion, Kubewarden can check them – or stream log messages as they pop up.

A new architecture to ease Kubewarden administrators' lives

Fri, 01 Oct 2021 00:00:00 +0000

We are pleased to announce a new architecture for the Kubewarden stack, in line with its journey to maturity:

The introduction of a PolicyServer Custom Resource Definition (CRD) which allows users to describe a policy-server Deployment, together with binding ClusterAdmissionPolicies to a specific PolicyServer instance.

These 2 changes are accompanied by a multitude of improvements to make Kubewarden more comfortable for Kubernetes Administrators, such as validation for Kuberwarden Custom Resources, improvements in Helm Charts, Status and Conditions for ClusterAdmissionPolicies.

Introducing the PSP host namespaces policy

Fri, 11 Jun 2021 00:00:00 +0000

As you probably know, Kubernetes Pod Security Policies (PSPs) are being deprecated in Kubernetes 1.21 – although these APIs will be served until Kubernetes 1.25 it’s a good time to start thinking about what you will use to replace them.

At Kubewarden we have an ongoing effort to replace the Pod Security Policies with small, targeted Kubewarden policies.

Up until now, we have implemented some policies that replace some Pod Security Policies:

Introducing kwctl to Kubernetes Administrators

Wed, 09 Jun 2021 00:00:00 +0000

We are pleased to announce the availability of a new tool within the Kubewarden project: kwctl.

kwctl is a command line utility designed to help both policy authors and Kubernetes administrators.

This blog post focuses on the user experience of Kubernetes administrators. Future ones will cover the policy developer side of the story.

A Real-World Example: Controlling Container Capabilities

The main character of today’s story is Alice. Alice is a Kubernetes administrator who wants to keep her Kubernetes cluster secure.

Writing your first policy with Kubewarden

Wed, 02 Jun 2021 00:00:00 +0000

Kubewarden is a project focused on security and compliance. Its main goal is to allow you to write, test, distribute and run policies using the tooling that you already know and master, with a focus on controlling Kubernetes inner behaviors.

Policies are written in one of the supported languages, and the target object is a WebAssembly binary artifact. This is how Kubewarden can ensure that no matter where you built the policy, it can run on all platforms without any kind of adaptation.