Leveraging WebAssembly to Write Kubernetes Admission Policies
summary
Uses WebAssembly modules to run Kubernetes admission policies with a Wasmtime sandbox, Rust/Go/Swift SDKs and the kwctl CLI for local testing and deployment. Policies live as tiny OCI artifacts (example sizes: 100 KB Rust module, ~300 KB Go, ~9.5 MB Swift) and carry metadata and docs. Demonstrates pulling a policy from the policy hub, deploying it via OCI registries, enforcing a cert-manager Let's Encrypt production annotation (rejects staging, accepts production) and emitting OpenTelemetry traces to Jaeger.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:38Survey
- 0:58Compliance
- 1:54Kubernetes Policies
- 3:52Admission Controllers
- 6:01Dynamic Admission Controllers
- 7:12Policy Frameworks
- 7:56Expectations
- 9:01WebAssembly Overview
- 12:10Writing Kubernetes Admission Policies
- 13:13Advantages of WebAssembly
- 15:12Policy Documentation
- 16:48Security
- 18:52Other Policies
- 19:33Policy Server
- 22:01Defining the problem
- 23:40The Policy Hub
- 24:25kwctl
- 26:03pull
- 26:51inspection
- 30:47deployment
- 32:35generate manifest
- 35:11Required labels
- 36:23Build the policy
- 38:46Invalid request
related talks
20mLeveraging WebAssembly to Write Kubernetes Admission Policies
41mKubernetes Policy As Code using WebAssembly
23mWhat If... Kubernetes Core Pieces Could Be Extended with Pluggable WebAssembly Modules?
20mMaking Dynamic Admission Control Even More Dynamic Using...
26mWhat If... Kube-Apiserver Could be Extended Via WebAssembly?
20mMaking Dynamic Admission Control Even More Dynamic Using...
52mEnable all your infrastructure’s power with Rust & Wasm
29mCompliance in Kubernetes: Enforcing and Visualizing