Skip to content
SPECIFICTION
Get listed

Kubewarden

kubewarden.io

WindowsmacOSLinuxSelf-hosted
Visit kubewarden.io
Spec score 7.5 #15 of 25 in Infrastructure Policy as Code Tools

What it is

Kubewarden is an open-source security platform for Kubernetes workloads, with components that can be used together or separately. Its stable Admission Controller can block unsafe workloads before they enter a cluster. Operators can manage policies as Kubernetes resources, use monitor mode before enforcement, and audit workloads with PolicyReports. Policies can be written in WebAssembly-compatible languages such as Rust, Go, CEL, and Rego, while policies from OPA, Gatekeeper, and ValidatingAdmissionPolicy can be reused. The beta SBOM Scanner finds vulnerabilities in container images and supports VEX to identify findings that do not affect software. The beta Runtime Enforcer controls what can run inside pods. Its experimental Network Enforcer observes traffic and can produce Kubernetes NetworkPolicy or Istio AuthorizationPolicy rules. Policies can be distributed through OCI-compliant registries. Kubewarden is free; its kwctl CLI has installation instructions for Linux, macOS, and Windows. Helm deployment instructions, community meetings, and a Kubernetes Slack community are also listed.

Spec sheet

Purpose
Kubewarden is an open source security platform for Kubernetes that secures workloads across their lifecycle.Read 2 Oct 2026 · kubewarden.io
Deployment
The component pages provide Helm installation instructions for deploying Kubewarden components to Kubernetes.Read 2 Oct 2026 · kubewarden.io
Support
The project offers open monthly community meetings and links to its Kubernetes Slack community.Read 2 Oct 2026 · kubewarden.io
Admission control
The stable Admission Controller evaluates built-in and custom Kubernetes resources before admission and can allow, modify, or deny requests.Read 2 Oct 2026 · kubewarden.io
Audit scanner
The audit scanner actively and continuously checks policy enforcement over time.Read 1 Oct 2026 · docs.kubewarden.io
CLI platforms
The kwctl CLI has installation instructions for Linux, macOS, and Windows.Read 1 Oct 2026 · docs.kubewarden.io
Components
Its components are the Admission Controller, Network Enforcer, Runtime Enforcer, and SBOM Scanner, which can be used together or independently.Read 2 Oct 2026 · docs.kubewarden.io
Enterprise support
SUSE provides full enterprise support through the SUSE Security Admission Controller, a curated version of Kubewarden.Read 1 Oct 2026 · docs.kubewarden.io
Governance
Kubewarden was accepted into the CNCF Sandbox on June 17, 2022.Read 1 Oct 2026 · cncf.io
Network enforcement
Its Network Enforcer is experimental and discovers network activity to secure communication between workloads.Read 1 Oct 2026 · kubewarden.io
Network integrations
Network Enforcer works with Calico, Cilium, or Istio Ambient to observe traffic and produce native Kubernetes NetworkPolicy or Istio AuthorizationPolicy rules.Read 2 Oct 2026 · kubewarden.io
Network providers
The Network Enforcer supports Istio ambient, Calico, and Cilium providers on x86_64 and aarch64 architectures with Kubernetes 1.30 or newer.Read 1 Oct 2026 · docs.kubewarden.io
Observability integrations
Optional integrations include OpenTelemetry, Prometheus, Jaeger, and Policy Reporter.Read 1 Oct 2026 · docs.kubewarden.io
Policy compatibility
The Admission Controller supports reusing OPA, Gatekeeper, and ValidatingAdmissionPolicy policies.Read 2 Oct 2026 · kubewarden.io
Policy distribution
Policies are compiled to WebAssembly and can be packaged and shared through standard OCI registries.Read 2 Oct 2026 · kubewarden.io
Policy languages
Policies can be written in Rust, Go, Rego, CEL, and other familiar technologies.Read 2 Oct 2026 · kubewarden.io
Policy operations
Operators can manage policies as Kubernetes resources, use monitor mode before enforcement, and audit workloads with PolicyReports.Read 2 Oct 2026 · kubewarden.io
Policy reuse
Kubewarden supports reusing policies from other policy engines without rewriting them.Read 1 Oct 2026 · docs.kubewarden.io
Product type
Kubewarden is an open source security platform for Kubernetes.Read 1 Oct 2026 · kubewarden.io
Project status
Kubewarden is a CNCF Sandbox Project; its Admission Controller is marked stable, Runtime Enforcer and SBOM Scanner beta, and Network Enforcer experimental.Read 2 Oct 2026 · kubewarden.io
Risk context
SBOM Scanner supports VEX to identify findings that do not affect software; its page says KEV and EPSS support is on the way.Read 2 Oct 2026 · kubewarden.io
Runtime enforcement
The beta Runtime Enforcer uses Linux kernel eBPF to learn process execution and block executables outside a workload's allow-list.Read 2 Oct 2026 · kubewarden.io
SBOM scanning
The beta SBOM Scanner generates software bills of materials and vulnerability reports for container registries, running workloads, and cluster nodes.Read 2 Oct 2026 · kubewarden.io
Supply-chain security
Kubewarden documents SLSA-based verification and publishes signed artifacts and software bills of materials.Read 1 Oct 2026 · docs.kubewarden.io

Strong points and limits

Strong points

  • Stable Admission Controller blocks unsafe workloads before entry
  • Policies can use WebAssembly-compatible languages
  • Reuses OPA, Gatekeeper, and ValidatingAdmissionPolicy policies
  • Free, with CLI instructions for Linux, macOS, and Windows

Limits

  • SBOM Scanner is in beta
  • Runtime Enforcer is in beta
  • Network Enforcer is experimental

Who it suits

Kubewarden suits Kubernetes operators who want to manage workload policies and audit enforcement. Its components and policy-language support may also fit teams that want to combine admission controls with image, runtime, or network enforcement.

Verdict

Kubewarden offers Kubernetes policy controls alongside components for image, runtime, and network security. Check component maturity before relying on beta or experimental features.

Where Specifiction places it

Alternatives to KubewardenAll alternatives →