kubewarden/adm-controller

Kubewarden Admission Controller is a Kubernetes Dynamic Admission Controller that uses policies written in WebAssembly to manage admission control in your cluster.

The tool solves the problem of managing admission policies across Kubernetes clusters by providing a unified system that dynamically registers policies and reconciles them with the cluster's webhook infrastructure. It works by running policies compiled to WebAssembly, which are evaluated by a policy server component at admission time. This approach allows policies to be written in multiple languages that compile to WebAssembly, including those using CEL and Rego syntax compatible with existing policy frameworks.

Teams should adopt this tool if they need flexible, language-agnostic admission control without being locked into a single policy language. It suits organizations already familiar with policy-as-code approaches through Open Policy Agent or Gatekeeper, as it provides similar capabilities through a WebAssembly-based runtime. The project includes an audit scanner component for validating existing cluster resources against registered policies, and a CLI tool for testing policies before deployment. Namespaced policies can be restricted to target only approved resource types, providing security boundaries for multi-tenant clusters. The unified Helm chart consolidates what were previously three separate charts, simplifying deployment and lifecycle management.

The project maintains active development with regular updates to its core components. The codebase is written primarily in Rust, indicating a focus on performance and safety in the admission controller runtime. Documentation is comprehensive and centralized, with dedicated guides for each component and migration paths for users transitioning from legacy deployment approaches. The project provides clear configuration options for default policy servers and recommended policies, with explicit controls over which resources namespaced policies can target.