What If... Kube-Apiserver Could be Extended Via WebAssembly?
summary
Prototype patches the API server (a patched k3s binary) and adds a feature gate that downloads policies pulled from container registries as WebAssembly modules, running them in-process via wasmtime bindings then a pure-Go runtime (wazero). Policies for pods (example: rejects privileged pods in default namespace; blocks images from Docker Hub) run synchronously, emit Kubernetes events, and work in the demo. Limitations: no mutating policies, no Sigstore verification of modules, and no performance benchmarking yet.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:15What is WebAssembly
- 4:23Use Cases
- 5:30Dynamic Admission Controllers
- 8:14The Idea
- 8:46Predict
- 8:56Failure Policy
- 10:54CPU Memory
- 13:00Disclaimer
- 14:25Proof of Concept
- 18:45Challenges
- 22:24Missing Features
- 24:35What Should We Do Next
- 25:25Outro
related talks
23mWhat If... Kubernetes Core Pieces Could Be Extended with Pluggable WebAssembly Modules?
41mLeveraging WebAssembly to Write Kubernetes Admission Policies
41mKubernetes Policy As Code using WebAssembly
20mLeveraging WebAssembly to Write Kubernetes Admission Policies
32mA Tale of Two Plugins: Safely Extending the Kubernetes Scheduler with WebAssembly
31mA Tale of Two Plugins Safely Extending the Kubernetes Scheduler with WebAssembly
50mWebAssembly: A Recovering Kubernetes Engineer's View of the Future
40mWebAssembly - The Future of Distributed Computing