Kubewarden just made the easiest Kubernetes admission controller even easier to install. If you have been sitting on the sidelines wondering whether WebAssembly-based policy enforcement is worth your time, version 1.37.0 is the release that tips the scales.
Let us be honest: admission controllers are not the sexiest part of Kubernetes. They are the bouncers at the club door of your API server, checking every request against a list of rules before it gets in. Kubewarden does this using policies written in WebAssembly, which means you can write security rules in any language that compiles to WASM — Rust, Go, TypeScript, you name it — instead of being locked into a specific DSL or configuration format.
Think of it as replacing a single overworked bouncer with a team of specialists who each check exactly one thing, really fast, and can be swapped out without restarting the club.
That pain you feel when you think about installing yet another Kubernetes policy engine? Version 1.37.0 makes that pain go away by consolidating three separate Helm charts into one. And if you are already running Kubewarden, the upgrade comes with a full migration toolkit to get you there without breaking a sweat.
One Chart to Rule Them All
The headline feature of v1.37.0 is the Helm chart consolidation. Since its inception, Kubewarden shipped as three separate Helm charts: kubewarden-crds, kubewarden-controller, and kubewarden-defaults. This was done for flexibility — cluster operators could install and upgrade each component independently. But flexibility that comes with complexity is just a different kind of pain.
Now there is a single chart: admission-controller. One install command. One upgrade path. One thing to remember.
# The old way (three separate installs)
helm install kubewarden-crds kubewarden/kubewarden-crds
helm install kubewarden-controller kubewarden/kubewarden-controller
helm install kubewarden-defaults kubewarden/kubewarden-defaults
# The new way (one unified chart)
helm install kubewarden kubewarden/admission-controllerThe legacy charts are deprecated as of v1.36 and the new unified chart ships at version 6.0.0. The Values file is essentially a concatenation of the three old ones, so nothing is lost — just simplified. See PR #1802 for the full consolidation.
One chart, one install, zero confusion. The way Helm was meant to work.
Cleanup That Actually Cleans Up
If you have ever uninstalled a Kubernetes admission controller and then watched your cluster slowly grind to a halt because orphaned webhooks were still intercepting API calls, you will appreciate this one. Version 1.37.0 introduces the --cleanup flag on the controller, consumed by a Helm pre-delete hook.
This means when you run helm uninstall, the controller now orchestrates a staggered cleanup — removing policies, PolicyServers, and webhooks in the correct order before tearing itself down. No more orphaned webhooks. No more accidental denial-of-service on your own cluster.
The old uninstall process required manually removing the three legacy charts in the right order and hoping the pre-delete hook in kubewarden-controller caught everything. Now it is all handled by a single, well-orchestrated operation. See PR #1879.
Smarter Defaults, Automatically Applied
A new DefaultsApplierReconciler joins the controller in this release. This is a dedicated reconciler that manages default PolicyServer settings and recommended policies. In the old chart setup, recommended policies were deployed by Helm. Now, the controller itself handles this via an internal ConfigMap.
Why does this matter? Because it means your default security policies are now reconciled continuously, not just at install time. If someone accidentally deletes a recommended policy, the controller brings it back. If you disable defaults via Helm values, they are cleanly removed. This is a meaningful shift from static deployment to active management. See PR #1793.
Benchmark Your Context-Aware Policies
kwctl, the Kubewarden CLI tool, now supports context-aware policies when running the bench command. Context-aware policies are policies that need access to cluster resources beyond what is in the admission request — for example, checking if a service account has specific permissions across namespaces.
Previously, if you wanted to benchmark the performance of these policies, you were out of luck. Now you can measure latency and throughput with full context awareness, giving you real-world performance data before you deploy policies to production. See PR #1877.
Bug Fixes and Security
- Audit scanner cleanup: Stale audit reports are now deleted by write-set instead of label selector, which is more reliable and prevents accumulation of orphaned reports. PR #1859
- Background audit fix: Recommended policies now correctly default to
backgroundAudit: true, ensuring audit scanning works as expected out of the box. PR #1860 - PolicyServer ConfigMaps: Tracking labels added to PolicyServer ConfigMaps for better resource discovery and management. PR #1874
Migration: Do Not Panic
If you are running an older version of Kubewarden, this release requires migration. The Kubewarden team has published a detailed migration guide and built migration tooling directly into the chart. The legacy charts are deprecated but still available, so you can migrate at your own pace.
The migration script handles the heavy lifting: merging legacy values into the unified chart format, upgrading Helm releases in the correct order, and verifying that all resources made the transition successfully.
Kubewarden v1.37.0 is available now. Three charts became one, and your cluster is better for it.
