- Home
- Kubernetes Security Software
- Kubewarden
Kubewarden
What it is
Kubewarden is a free, open-source security platform for managing Kubernetes workload policies across the workload lifecycle. Its stable Admission Controller can stop unsafe workloads before they enter a cluster. Operators can manage policies as Kubernetes resources, test them in monitor mode before enforcement, and audit workloads through PolicyReports. Policies can be written in WebAssembly-compatible languages including Rust, Go, CEL, and Rego, and policies from OPA, Gatekeeper, and ValidatingAdmissionPolicy can be reused. The platform also offers a beta SBOM Scanner for container-image vulnerabilities and a beta Runtime Enforcer to control what runs inside pods. Its experimental Network Enforcer observes traffic and can produce Kubernetes NetworkPolicy or Istio AuthorizationPolicy rules. Components can be used together or independently, and policies can be distributed through OCI-compliant registries. Kubewarden supports Linux, macOS, Windows, and self-hosted deployment; its kwctl CLI has installation instructions for Linux, macOS, and Windows. Component pages provide Helm installation instructions, and optional observability integrations include OpenTelemetry, Prometheus, Jaeger, and Policy Reporter.
For and against
For
- Free and open source.
- Policies support multiple WebAssembly-compatible languages.
- Can reuse OPA and Gatekeeper policies.
- Monitor mode and PolicyReports support policy operations.
- Components can be used together or independently.
Against
- Runtime Enforcer and SBOM Scanner are beta.
- Network Enforcer is experimental.
- Network Enforcer provider support requires Kubernetes 1.30 or newer.
The verdict
Kubewarden covers admission control, auditing, and additional runtime, image, and network enforcement components, with maturity varying by component. Teams should account for the beta and experimental status of several components when choosing what to deploy.
Who it suits
Kubewarden suits Kubernetes operators who need policy enforcement and auditing, as well as teams writing or reusing workload policies.
On the record
- Admission control
- The stable Admission Controller evaluates built-in and custom Kubernetes resources before admission and can allow, modify, or deny requests.kubewarden.io · read 2 Oct 2026
- Audit scanner
- The audit scanner actively and continuously checks policy enforcement over time.docs.kubewarden.io · read 1 Oct 2026
- CLI platforms
- The kwctl CLI has installation instructions for Linux, macOS, and Windows.docs.kubewarden.io · read 1 Oct 2026
- Components
- Its components are the Admission Controller, Network Enforcer, Runtime Enforcer, and SBOM Scanner, which can be used together or independently.docs.kubewarden.io · read 2 Oct 2026
- Deployment
- The component pages provide Helm installation instructions for deploying Kubewarden components to Kubernetes.kubewarden.io · read 2 Oct 2026
- Enterprise support
- SUSE provides full enterprise support through the SUSE Security Admission Controller, a curated version of Kubewarden.docs.kubewarden.io · read 1 Oct 2026
- Governance
- Kubewarden was accepted into the CNCF Sandbox on June 17, 2022.cncf.io · read 1 Oct 2026
- Network enforcement
- Its Network Enforcer is experimental and discovers network activity to secure communication between workloads.kubewarden.io · read 1 Oct 2026
- Network integrations
- Network Enforcer works with Calico, Cilium, or Istio Ambient to observe traffic and produce native Kubernetes NetworkPolicy or Istio AuthorizationPolicy rules.kubewarden.io · read 2 Oct 2026
- Network providers
- The Network Enforcer supports Istio ambient, Calico, and Cilium providers on x86_64 and aarch64 architectures with Kubernetes 1.30 or newer.docs.kubewarden.io · read 1 Oct 2026
- Observability integrations
- Optional integrations include OpenTelemetry, Prometheus, Jaeger, and Policy Reporter.docs.kubewarden.io · read 1 Oct 2026
- Policy compatibility
- The Admission Controller supports reusing OPA, Gatekeeper, and ValidatingAdmissionPolicy policies.kubewarden.io · read 2 Oct 2026
- Policy distribution
- Policies are compiled to WebAssembly and can be packaged and shared through standard OCI registries.kubewarden.io · read 2 Oct 2026
- Policy languages
- Policies can be written in Rust, Go, Rego, CEL, and other familiar technologies.kubewarden.io · read 2 Oct 2026
- Policy operations
- Operators can manage policies as Kubernetes resources, use monitor mode before enforcement, and audit workloads with PolicyReports.kubewarden.io · read 2 Oct 2026
- Policy reuse
- Kubewarden supports reusing policies from other policy engines without rewriting them.docs.kubewarden.io · read 1 Oct 2026
- Product type
- Kubewarden is an open source security platform for Kubernetes.kubewarden.io · read 1 Oct 2026
- Project status
- Kubewarden is a CNCF Sandbox Project; its Admission Controller is marked stable, Runtime Enforcer and SBOM Scanner beta, and Network Enforcer experimental.kubewarden.io · read 2 Oct 2026
