Kubewarden 1.6: WebAssembly Policy Engine Evolution

Introduction

Kubewarden 1.6, released on May 10, 2023, is most relevant if you’re hardening clusters without turning every deploy into a support ticket. The real value is in rollout safety: tighter controls with fewer false positives, clearer policy outcomes, and smoother day-2 response when something is blocked.

WebAssembly Policy Improvements

• Policy performance optimizations reduce overhead and improve evaluation speed.
• Policy development improvements simplify creating and testing WebAssembly policies.
• Policy libraries expansion provides more pre-built policies for common use cases.
• Policy versioning enables better policy management and updates.

Language Support

1. Rust support improvements provide better SDK and development experience.
2. Go support enhancements expand policy development options.
3. AssemblyScript improvements enable TypeScript-based policy development.
4. Policy templates provide scaffolding for common policy patterns.

Performance Improvements

• Evaluation performance optimizations reduce latency for policy decisions.
• Memory usage improvements reduce resource footprint.
• Concurrent evaluation enables better handling of high-traffic scenarios.
• Caching improvements reduce redundant policy evaluations.

Kubernetes Integration

• Admission control integration provides policy enforcement at resource creation time.
• Audit logging tracks all policy decisions and violations.
• Metrics expansion exposes detailed policy metrics for Prometheus.
• Operator improvements simplify Kubewarden installation and management.

Getting Started

helm repo add kubewarden https://charts.kubewarden.io
helm install kubewarden-controller kubewarden/kubewarden-controller
helm install kubewarden-defaults kubewarden/kubewarden-defaults

Create a policy:

apiVersion: policies.kubewarden.io/v1
kind: ClusterAdmissionPolicy
metadata:
  name: psp-capabilities
spec:
  policyServer: default
  module: registry://ghcr.io/kubewarden/policies/psp-capabilities:latest
  rules:
  - apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
    operations:
    - CREATE
    - UPDATE
  mutating: false

Summary

Kubewarden 1.6 provides teams with flexible policy enforcement capabilities using WebAssembly for secure and efficient policy evaluation.