Building a universal policy platform for Kubernetes - Victor Cuadrado Juan
summary
Kubewarden is a CNCF project that runs policies as WebAssembly so policies become portable OCI artifacts and can be pulled from registries; it ships a policy server, a Kubernetes controller, and a local runner kwctl CLI for CI. Policies can be authored as Rego, YAML config, language SDKs (Go, Rust, C, Swift, TypeScript), or experimental WASI; version 1.6.0 is stable and 1.7.0 adds WASI. A proof‑of‑concept compiles Kerno to WASI producing a 90 MB compiled Kerno proof-of-concept (vs 0.5–2 MB for typical WASM), slower startup but functional; audit scanner and more SDKs are planned.
AI-written summary · about
chapters (20)
- 0:00Introduction to policy platforms
- 1:06Kubernetes challenges and WASM
- 3:13What is a policy platform?
- 4:38Policy as code benefits
- 5:40Understanding policy personas
- 7:47WebAssembly for policy engines
- 10:34Introducing Qen (QWen) project
- 11:36Writing policies in Qen
- 12:38Rego and OPA compatibility
- 14:03SDKs for custom policies
- 15:50WASI for advanced policies
- 17:17Kerno DSL policy demo
- 20:06Challenges of WASI policies
- 22:40Future of Qen and features
- 25:08Audit scanner module
- 26:16Alternative DSLs like Cell
- 26:59Integrating Qen into Kubernetes
- 28:01Beyond Kubernetes use cases
- 28:42Conclusion and next steps
- 29:50Q&A session
related talks
20mLeveraging WebAssembly to Write Kubernetes Admission Policies
41mKubernetes Policy As Code using WebAssembly
41mLeveraging WebAssembly to Write Kubernetes Admission Policies
03mKubewarden: Leveraging and Extending CEL for your Cluster...
29mCompliance in Kubernetes: Enforcing and Visualizing
36mKubernetes Policy, Governance, And Compliance: A WG Policy Update
16mDeep Dive: Kubernetes Policy WG
23mWhat If... Kubernetes Core Pieces Could Be Extended with Pluggable WebAssembly Modules?