A universal policy engine for Kubernetes, where the rules that guard your cluster are ordinary programs compiled to WebAssembly.

Welcome to Kubewarden: Policy as WebAssembly for Kubernetes.

Every Kubernetes cluster needs a gatekeeper: something that decides whether a Pod may run as root, whether an image may come from an untrusted registry, whether a label is missing or a resource limit absent. Kubewarden answers that need with a striking idea — rather than inventing yet another policy language, it runs admission policies as WebAssembly modules, so they can be written in Rust, Go, CEL, or Rego and distributed like container images through OCI registries. This book begins with the problem of admission control and the Kubernetes webhook machinery that makes it possible, then walks through Kubewarden's architecture: the controller that reconciles custom resources, the Rust-based Policy Server that evaluates requests, and the sandbox that isolates each policy. From there it explores how Wasm policies are written and shipped, how the ClusterAdmissionPolicy, AdmissionPolicy, and PolicyServer resources fit together, how context-aware policies and policy groups express richer rules, and how the audit scanner, supply-chain verification, and monitor mode round out day-two operations. A closing chapter places Kubewarden among its peers and offers guidance for adopting it well.

This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.

A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.

We hope it serves you well.

— Shriira Press

Contents

1. Chapter 1 — A Universal Policy Engine
2. Chapter 2 — Admission Control in Kubernetes
3. Chapter 3 — The Kubewarden Architecture
4. Chapter 4 — Policies as WebAssembly
5. Chapter 5 — The Policy Custom Resources
6. Chapter 6 — Writing and Distributing Policies
7. Chapter 7 — Context-Aware Policies and Policy Groups
8. Chapter 8 — Auditing, Supply Chain, and Day-Two Operations
9. Chapter 9 — Kubewarden in Practice