kubewarden/policies

Kubewarden Policies is a collection of ready-to-use security policies for Kubernetes clusters that run as WebAssembly modules.

The tool addresses the need to enforce security and compliance rules across Kubernetes environments without requiring custom policy development. Kubewarden policies work by compiling policy code into WebAssembly binaries that the Kubewarden admission controller executes to validate or mutate Kubernetes resources. This approach allows policies to run safely in isolation while maintaining high performance and language flexibility.

Organizations should adopt this collection if they need curated, officially maintained policies for common Kubernetes security scenarios rather than building policies from scratch. The repository suits teams already using or evaluating Kubewarden as their policy engine. The policies are discoverable and documented through Artifact Hub, which provides an interface for browsing capabilities, configuration parameters, and version history. The repository distinguishes itself by offering policies that are actively maintained by the Kubewarden team to stay current with Kubernetes API changes and security best practices.

The project maintains a clear separation between released and staging policies, with released policies in the policies directory receiving full CI treatment including building, testing, and release automation, while staging policies in a separate directory remain under development until ready for promotion. The repository provides local development tooling through kwctl for testing policies against Kubernetes resources without requiring a cluster, and all policies include test coverage with Makefile targets for validation. The CONTRIBUTING guide documents the process for moving policies from staging to release status and for developing policy changes.