Skip to main content
CPEBuddy
Govern Kubernetes with Kubewarden and WASM Admission Controllers

Govern Kubernetes with Kubewarden and WASM Admission Controllers

Source: YouTube · DevOps & AI Toolkit · published Jan 15, 2024 · 21:01

Cloud Security
No ratings yet Log in to rate
Transcript Available
Description

[BLUF: Cube Warden allows writing Kubernetes admission policies in any language that compiles to WebAssembly, offering flexibility but with some limitations compared to established tools like Kyverno and OPA 0:15]

Key Takeaways:
• Cube Warden combines WASM's cross-platform compatibility with Kubernetes admission controllers to create flexible policy enforcement 0:15
• Unlike Kyverno (YAML) and OPA (Rego), Cube Warden allows policies to be written in any language that compiles to WASM 16:56
• Policies are distributed as container images and can be found on Artifact Hub 5:47
• Key drawbacks include policy server restarts on new policy deployment and lack of Kubernetes events for observability 11:08

[Cube Warden's main advantage is policy language flexibility, but whether this outweighs its immaturity compared to established tools depends on your specific needs]

Sources:

  • 0:15 Introduction to Cube Warden combining WASM and Kubernetes admission controllers
  • 16:56 Comparison with Kyverno and OPA policy writing approaches
  • 5:47 Finding policies on Artifact Hub
  • 11:08 Criticisms of policy server restarts and lack of events

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

[Music] what do you get if you take VM in one hand and kubernetes admission controllers in another and smash them together vasm gives us the ability to write code in any language we want and compile it to a binary that can run in any operating system and any architecture admission controllers on the other hand give us the ability to intercept requests to kubernetes API and either accept reject or mutate those requests now I am not going to explain either of those two concepts if you're curious about wasm watch that video and if you would like to know more about kubernetes submission controllers and web hooks watch that video we will look into a tool that allows us to write policies in any language that can be compiled to wasm and we will run them in kubernetes as admission controllers or a…