Kubernetes Policy As Code using WebAssembly
summary
A Kubernetes policy engine executes policies compiled to WebAssembly modules so policies can be written in Go, Rust, Rego or TypeScript, packaged as OCI artifacts and stored in OCI registries. The system supports loading multiple WASM policies, traces policy evaluations with OpenTelemetry, provides a Docker-like CLI for local testing, and includes a demo that accepts or rejects real admission requests; the project selection had 60 submissions and 460 review cards.
AI-written summary · about
chapters (7)
- 0:00Start
- 7:40Admission Controller: overview
- 20:02What is WebAssembly? Portable
- 23:06Policy distribution
- 24:09Observability: tracing
- 26:02OPA and Gatekeeper
- 28:01Kubewarden: the Universal Policy Platform
related talks
41mLeveraging WebAssembly to Write Kubernetes Admission Policies
20mLeveraging WebAssembly to Write Kubernetes Admission Policies
23mWhat If... Kubernetes Core Pieces Could Be Extended with Pluggable WebAssembly Modules?
26mWhat If... Kube-Apiserver Could be Extended Via WebAssembly?
36mBuilding a universal policy platform for Kubernetes - Victor Cuadrado Juan
20mTrust but Verify
29mCompliance in Kubernetes: Enforcing and Visualizing
50mWebAssembly: A Recovering Kubernetes Engineer's View of the Future