Kubewarden is a free, open-source security platform for Kubernetes workloads. Its stable Admission Controller can stop unsafe workloads before they enter a cluster. Operators can manage policies as Kubernetes resources, use monitor mode before enforcement, and audit workloads with PolicyReports. Policies can be written in WebAssembly-compatible languages including Rust, Go, CEL, and Rego; policies from OPA, Gatekeeper, and ValidatingAdmissionPolicy can be reused. Components include a beta SBOM Scanner for container-image vulnerabilities and a beta Runtime Enforcer that controls what can run inside pods. Its experimental Network Enforcer observes traffic and can produce Kubernetes NetworkPolicy or Istio AuthorizationPolicy rules. Components can be used together or independently, and policies can be distributed through OCI-compliant registries. The SBOM Scanner supports VEX to identify findings that do not affect software. The project documents Helm installation, signed artifacts, software bills of materials, and SLSA-based verification. Optional observability integrations include OpenTelemetry, Prometheus, Jaeger, and Policy Reporter. Kubewarden links to community meetings and a Kubernetes Slack community; SUSE provides enterprise support through its curated SUSE Security Admission Controller.
Who it is for
Kubewarden suits teams operating Kubernetes clusters that need policy controls across admission, runtime, software bills of materials, or network activity. It may also suit operators who want to reuse policies from OPA, Gatekeeper, or ValidatingAdmissionPolicy.
What is good
- Stable Admission Controller blocks unsafe workloads before entry.
- Policies can use Rust, Go, CEL, or Rego.
- Existing OPA and Gatekeeper policies can be reused.
- Components can be deployed together or independently.
- Policy audit reports are supported.
What to know first
- SBOM Scanner is beta.
- Runtime Enforcer is beta.
- Network Enforcer is experimental.
- Network Enforcer requires Kubernetes 1.30 or newer.
Verdict
Kubewarden provides Kubernetes policy controls alongside components for image vulnerabilities, runtime behavior, and network activity. Its component maturity varies: the Admission Controller is stable, two components are beta, and the Network Enforcer is experimental.
Compared on infrastructure policy as code tools
- Free plan
- Yes
