Leveraging WebAssembly to Write Kubernetes Admission Policies
Talkat Cloud Native Wasm Day North America 2021 · on Tuesday, 2021-10-12· at 11:40· Room 501 ABC + Online·
summary
Kubewarden uses WebAssembly to run Kubernetes admission policies as portable WASM binaries, enforcing accept/reject/mutate decisions inside a sandboxed policy server that registers dynamic admission webhooks with the API server. Policies carry annotations via WASM custom sections, publish as OCI artifacts using OCI registries, and run with tracing (OpenTelemetry/Jaeger) and Prometheus metrics. Demo enforces ingress cert issuer annotations (rejecting staging values), reuses OPA/rego builds targeted to WASM, and shows local kwctl testing and successful policy responses. WebAssembly policies as WASM binaries OCI distribution for policies
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:16What is Kubewarden?
- 1:22Dynamic Admission Controllers
- 2:32Why WebAssembly?
- 4:59Policy Frameworks: state of the art
- 6:35Universal Policy Framework
- 11:13Cloud Native intersection
- 13:11Demo
- 18:18Shoutouts
- 18:49Join the community
related talks
41mLeveraging WebAssembly to Write Kubernetes Admission Policies
41mKubernetes Policy As Code using WebAssembly
29mCompliance in Kubernetes: Enforcing and Visualizing
23mWhat If... Kubernetes Core Pieces Could Be Extended with Pluggable WebAssembly Modules?
36mBuilding a universal policy platform for Kubernetes - Victor Cuadrado Juan
26mWhat If... Kube-Apiserver Could be Extended Via WebAssembly?
20mMaking Dynamic Admission Control Even More Dynamic Using...
20mMaking Dynamic Admission Control Even More Dynamic Using...