Freedom251 › Cloud Governance Software
Kubewarden
What Kubewarden is
Kubewarden is a free, open-source security platform for Kubernetes workloads. Its stable Admission Controller can stop unsafe workloads before they enter a cluster. Operators can manage policies as Kubernetes resources, use monitor mode before enforcement, and audit workloads with PolicyReports. Policies can be written in WebAssembly-compatible languages including Rust, Go, CEL, and Rego; policies from OPA, Gatekeeper, and ValidatingAdmissionPolicy can be reused. Components include a beta SBOM Scanner for container-image vulnerabilities and a beta Runtime Enforcer that controls what can run inside pods. Its experimental Network Enforcer observes traffic and can produce Kubernetes NetworkPolicy or Istio AuthorizationPolicy rules. Components can be used together or independently, and policies can be distributed through OCI-compliant registries. The SBOM Scanner supports VEX to identify findings that do not affect software. The project documents Helm installation, signed artifacts, software bills of materials, and SLSA-based verification. Optional observability integrations include OpenTelemetry, Prometheus, Jaeger, and Policy Reporter. Kubewarden links to community meetings and a Kubernetes Slack community; SUSE provides enterprise support through its curated SUSE Security Admission Controller.
Who it suits
Kubewarden suits teams operating Kubernetes clusters that need policy controls across admission, runtime, software bills of materials, or network activity. It may also suit operators who want to reuse policies from OPA, Gatekeeper, or ValidatingAdmissionPolicy.
What it does well
- Stable Admission Controller blocks unsafe workloads before entry.
- Policies can use Rust, Go, CEL, or Rego.
- Existing OPA and Gatekeeper policies can be reused.
- Components can be deployed together or independently.
- Policy audit reports are supported.
What to know first
- SBOM Scanner is beta.
- Runtime Enforcer is beta.
- Network Enforcer is experimental.
- Network Enforcer requires Kubernetes 1.30 or newer.
Getting started
- Visit the Kubewarden website.
- Choose Linux, macOS, Windows, or self-hosted use.
- Follow the component's Helm installation instructions to deploy it to Kubernetes.
- Install the kwctl CLI using the instructions for Linux, macOS, or Windows.
- Manage policies as Kubernetes resources and use monitor mode before enforcement.
Verdict
Kubewarden provides Kubernetes policy controls alongside components for image vulnerabilities, runtime behavior, and network activity. Its component maturity varies: the Admission Controller is stable, two components are beta, and the Network Enforcer is experimental.
Questions
How much does Kubewarden cost?
Kubewarden is free and has a free plan.
Which operating systems and deployment options does it support?
The listed platforms are Linux, macOS, Windows, and self-hosted. Its kwctl CLI has installation instructions for Linux, macOS, and Windows.
Is Kubewarden open source?
Yes. Kubewarden is an open source security platform for Kubernetes and a CNCF Sandbox Project.
Which policy languages can I use?
Policies can use any language that generates WebAssembly binaries, including Rust, Go, CEL, and Rego.
Can I reuse policies from other policy engines?
Yes. The Admission Controller supports policies from OPA, Gatekeeper, and ValidatingAdmissionPolicy.
What support does the project offer?
The project offers open monthly community meetings and links to its Kubernetes Slack community. SUSE provides enterprise support through the SUSE Security Admission Controller, a curated version of Kubewarden.
Facts from Kubewarden's own pages
- Admission control
- The stable Admission Controller evaluates built-in and custom Kubernetes resources before admission and can allow, modify, or deny requests. · kubewarden.io, 2 Oct 2026
- Audit scanner
- The audit scanner actively and continuously checks policy enforcement over time. · docs.kubewarden.io, 1 Oct 2026
- CLI platforms
- The kwctl CLI has installation instructions for Linux, macOS, and Windows. · docs.kubewarden.io, 1 Oct 2026
- Components
- Its components are the Admission Controller, Network Enforcer, Runtime Enforcer, and SBOM Scanner, which can be used together or independently. · docs.kubewarden.io, 2 Oct 2026
- Deployment
- The component pages provide Helm installation instructions for deploying Kubewarden components to Kubernetes. · kubewarden.io, 2 Oct 2026
- Enterprise support
- SUSE provides full enterprise support through the SUSE Security Admission Controller, a curated version of Kubewarden. · docs.kubewarden.io, 1 Oct 2026
- Governance
- Kubewarden was accepted into the CNCF Sandbox on June 17, 2022. · cncf.io, 1 Oct 2026
- Network enforcement
- Its Network Enforcer is experimental and discovers network activity to secure communication between workloads. · kubewarden.io, 1 Oct 2026
- Network integrations
- Network Enforcer works with Calico, Cilium, or Istio Ambient to observe traffic and produce native Kubernetes NetworkPolicy or Istio AuthorizationPolicy rules. · kubewarden.io, 2 Oct 2026
- Network providers
- The Network Enforcer supports Istio ambient, Calico, and Cilium providers on x86_64 and aarch64 architectures with Kubernetes 1.30 or newer. · docs.kubewarden.io, 1 Oct 2026
- Observability integrations
- Optional integrations include OpenTelemetry, Prometheus, Jaeger, and Policy Reporter. · docs.kubewarden.io, 1 Oct 2026
- Policy compatibility
- The Admission Controller supports reusing OPA, Gatekeeper, and ValidatingAdmissionPolicy policies. · kubewarden.io, 2 Oct 2026
- Policy distribution
- Policies are compiled to WebAssembly and can be packaged and shared through standard OCI registries. · kubewarden.io, 2 Oct 2026
- Policy languages
- Policies can be written in Rust, Go, Rego, CEL, and other familiar technologies. · kubewarden.io, 2 Oct 2026
- Policy operations
- Operators can manage policies as Kubernetes resources, use monitor mode before enforcement, and audit workloads with PolicyReports. · kubewarden.io, 2 Oct 2026
- Policy reuse
- Kubewarden supports reusing policies from other policy engines without rewriting them. · docs.kubewarden.io, 1 Oct 2026
- Product type
- Kubewarden is an open source security platform for Kubernetes. · kubewarden.io, 1 Oct 2026
- Project status
- Kubewarden is a CNCF Sandbox Project; its Admission Controller is marked stable, Runtime Enforcer and SBOM Scanner beta, and Network Enforcer experimental. · kubewarden.io, 2 Oct 2026
- Purpose
- Kubewarden is an open source security platform for Kubernetes that secures workloads across their lifecycle. · kubewarden.io, 2 Oct 2026
- Risk context
- SBOM Scanner supports VEX to identify findings that do not affect software; its page says KEV and EPSS support is on the way. · kubewarden.io, 2 Oct 2026
- Runtime enforcement
- The beta Runtime Enforcer uses Linux kernel eBPF to learn process execution and block executables outside a workload's allow-list. · kubewarden.io, 2 Oct 2026
- SBOM scanning
- The beta SBOM Scanner generates software bills of materials and vulnerability reports for container registries, running workloads, and cluster nodes. · kubewarden.io, 2 Oct 2026
- Supply-chain security
- Kubewarden documents SLSA-based verification and publishes signed artifacts and software bills of materials. · docs.kubewarden.io, 1 Oct 2026
- Support
- The project offers open monthly community meetings and links to its Kubernetes Slack community. · kubewarden.io, 2 Oct 2026
Where Kubewarden stands on Freedom251
- Cloud Governance Software#8 of 26
- Kubernetes Security Software#13 of 27
- Infrastructure Policy as Code Tools#14 of 25