Kubewarden is an open source security platform for Kubernetes: a set of complementary components to secure your workloads across the entire lifecycle. From admission, to runtime, and beyond.
Use the components you need, together or independently.
| Component | What it does | Status | Repository |
|---|---|---|---|
| Admission Controller | Stop unsafe workloads before they enter your cluster | Stable | adm-controller |
| Network Enforcer | Discover network activity and secure the communication between your workloads | Experimental | network-enforcer |
| Runtime Enforcer | Control what can run inside your Kubernetes pods | Beta | runtime-enforcer |
| SBOM Scanner | Find vulnerabilities in the container images running inside your cluster | Beta | sbomscanner |
- Documentation
- Blog
- Community: social channels, Slack and the calendar of our monthly community meetings
- kubewarden/community: governance, repository scopes and maturity levels of the project
The Admission Controller is an extensible, Kubernetes-native policy engine. Policies can allow a request, mutate its resources, or deny it.
Policies are written using regular programming languages (Rust, Go, ...) or Domain Specific Languages (Rego, CEL, ...). They are compiled into WebAssembly modules and distributed using standard OCI container registries.
Discover ready to use policies on ArtifactHub.
Interested in writing your own policy? These resources will get you started:
- Step-by-step tutorials inside of our documentation
- Policy SDKs: overview of the Policy SDKs available, and their maturity level
- Policy templates: boilerplate code to help you get started
Use these GitHub topics to find policy repositories over all GitHub:
| Purpose | Topic |
|---|---|
| Policy | kubewarden-policy |
| Policy SDK | kubewarden-policy-sdk |
| Policy Template | kubewarden-policy-template |
Check our general CONTRIBUTING.md docs.
Quick links to the core projects:
| Project | Scope | Language |
|---|---|---|
adm-controller |
Admission Controller | Go, Rust |
helm-charts |
Helm charts for all components | Helm |
network-enforcer |
Network Enforcer | Go |
runtime-enforcer |
Runtime Enforcer | Go |
sbomscanner |
SBOM Scanner | Go |