Overview

Kubewarden is an open-source security platform for Kubernetes, aimed at teams that want to apply workload policies throughout a cluster’s lifecycle. Its strongest case is the stable Admission Controller; the surrounding security components add useful scope, but are at earlier stages of maturity.

Teams can adopt the components together or independently. Kubewarden is a CNCF Sandbox project, accepted on June 17, 2022, and SUSE offers enterprise support through its curated SUSE Security Admission Controller.

It belongs in Kubernetes Security Software, Cloud Governance Software, and Infrastructure Policy as Code Tools.

Key features

Admission policies and compatibility

The stable Admission Controller blocks unsafe workloads before they enter a cluster. Operators manage policies as Kubernetes resources and can use monitor mode before enforcing them, a practical way to assess policy effects before making them blocking rules. Policies can be written in WebAssembly-compatible languages such as Rust, Go, CEL, and Rego. Support for OPA, Gatekeeper, and ValidatingAdmissionPolicy policies can reduce migration work for teams already using those systems.

Policies can be distributed through OCI-compliant registries, and the audit scanner continuously checks policy enforcement over time. PolicyReports provide workload audit reporting. Testing and CI/CD integration support policy development and delivery, while integrations with OpenTelemetry, Prometheus, Jaeger, and Policy Reporter give operators optional observability paths.

Security across the workload lifecycle

The beta SBOM Scanner finds vulnerabilities in container images running in a cluster and supports VEX, which helps distinguish findings that do not affect the software. KEV and EPSS support is on the way. The beta Runtime Enforcer controls what can run inside Kubernetes pods. Both extend protection beyond admission, but their beta status makes them less suitable as the sole basis for mature production controls.

The experimental Network Enforcer discovers workload network activity and can produce native Kubernetes NetworkPolicy or Istio AuthorizationPolicy rules. It supports Istio ambient, Calico, and Cilium on x86_64 and aarch64 with Kubernetes 1.30 or newer. That narrow compatibility and experimental status make it a cautious choice for teams that need dependable network enforcement today.

Deployment and supply-chain safeguards

Component pages provide Helm installation instructions, and the kwctl CLI has installation instructions for Linux, macOS, and Windows. Kubewarden documents SLSA-based verification and publishes signed artifacts and software bills of materials. These practices help teams assess software provenance, though they do not change the maturity of the individual components.

Pricing

Kubewarden is free and open source, with a free plan. There are no paid Kubewarden tiers to compare. Teams seeking commercial support can turn to SUSE’s SUSE Security Admission Controller, a curated version of Kubewarden with enterprise support; its pricing is custom pricing.

Open monthly community meetings and a Kubernetes Slack community offer project-level support routes. Teams that require a formal enterprise support relationship should weigh SUSE’s offering rather than relying on community channels alone.

Platforms

Kubewarden is listed for Linux, macOS, Windows, and self-hosted environments. The kwctl CLI installation instructions cover Linux, macOS, and Windows, while the components are deployed to Kubernetes using Helm. Network Enforcer use additionally requires one of its supported providers, x86_64 or aarch64, and Kubernetes 1.30 or newer.

Who it's for

Kubewarden suits Kubernetes operators who want policy-as-code controls at admission and value policy reuse, registry-based distribution, audit reporting, and a free open-source platform. It is especially compelling for teams already invested in OPA, Gatekeeper, or ValidatingAdmissionPolicy that want to avoid rewriting policies.

It is a weaker fit for organizations that need every security layer to be stable today, or need broad network-provider compatibility beyond the stated choices. The stable Admission Controller can stand on its own, but beta and experimental components should be evaluated separately rather than treated as equally mature parts of a single dependable suite.

Pros and cons

Pros

Stable admission control: blocks unsafe workloads before cluster entry, with monitor mode available before enforcement.
Policy portability: supports WebAssembly-compatible languages and reuse of OPA, Gatekeeper, and ValidatingAdmissionPolicy policies.
Free and modular: teams can use components independently and avoid paying for a bundled suite.
Operational visibility: continuous audit scanning, PolicyReports, and optional observability integrations support ongoing policy oversight.

Cons

Uneven maturity: the SBOM Scanner and Runtime Enforcer are beta, while the Network Enforcer is experimental.
Network requirements are specific: the Network Enforcer is limited to Istio ambient, Calico, or Cilium, x86_64 or aarch64, and Kubernetes 1.30 or newer.
Enterprise support is separate: SUSE’s curated supported version is a distinct route rather than support included with the free project.

Alternatives

Cloud Custodian is another free, open-source option, with an Apache 2.0 license and Linux, macOS, Windows, and self-hosted platforms; consider it when those characteristics suit your governance needs better than Kubewarden’s Kubernetes workload focus.

AWS Control Tower is worth considering for an AWS-oriented setup: it has no additional charge for Control Tower, though underlying AWS services are billed by usage.

OmniGCloud has a free plan with one connector, a single SaaS workspace, basic CSV export, and a basic audit trail; consider it if that starting point fits better than Kubernetes-native policy controls.

CGPulse offers a free plan with two cloud accounts, 10 scans per month, one tracked initiative, five auto-fixes per month, and watermarked PDF reports. Choose it instead when those cloud-account scanning and reporting limits match the task.

CoreStack Cloud Governance offers product, bundle, and assessment options with custom pricing.

Jamcracker is a cloud management platform for MSPs, system integrators, enterprises, and cloud teams working across AWS, Azure, Google Cloud, VMware, and private clouds.

MacroCloud Governance Center is a paid web product with pricing on request.

PolicyCortex is a paid web product with annual or monthly terms and commercial terms on request.

Verdict

Kubewarden is a strong choice for Kubernetes teams that want free, modular policy enforcement and a stable admission layer with broad policy-language and engine compatibility. Its main advantage is policy control without forcing a rewrite or paid platform commitment; its main reason to look elsewhere is the uneven maturity of its broader security layers. Adopt the Admission Controller confidently on its own, and treat beta and experimental components as additions to evaluate against your organization’s risk tolerance.

	Kubewarden	Tetragon
Free plan	No	Yes
Free trial	No	No
Paid from	—	Free
Open source	No	No
Platforms	Linux, macOS, self-hosted, Windows	api, Linux, self-hosted
Free plan	Yes	Yes
Admission control	Yes	—
Deployment model	—	self_hosted
Runtime protection	—	Yes

Kubewarden vs Tetragon

Kubewarden

Tetragon