Skip to content
forked from dvob/k8s-wasm

Extend Kubernetes with WebAssembly

License

Notifications You must be signed in to change notification settings

KramNamez/k8s-wasm

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

32 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Kubernetes API Access Extensions with WebAssembly

This repository explains an extension of the Kubernetes API server which allows to use WebAssembly modules to perform/extend the following actions:

  • Authentication
  • Authorization
  • Admission (validating and mutating)

To implement this I forked the Kubernetes source code and extended the API server accordingly: https://github.com/dvob/kubernetes/tree/wasm.

The extension is not intended for production use. Its a proof of concept to show how WebAssembly could be used to extend Kubernetes.

In the fork I created a new package pkg/wasm in which I implemented an Authenticator, Authorizer and AdmissionController. Most of the implementation lives in this new package. There are only a few changes in the pkg/kube-apiserver package to add command line options which allow to enable the WASM Authenticator, Authorizer and AdmissionController.

To run the WebAssembly modules we use the Wazero runtime. Wazero has zero dependencies and does not rely on CGO. Hence it can be easy integrated in a Go project without adding a ton of dependencies.

To pass data between our extension (host) and the WASM modules we make use of the capabilities of WASI (fd_read, fd_write). The module reads the input data form standard input and writes the result to the standard output. See the Module specification for the full details on how data is passed between host and modules. For Admission the extension also supports to use Kubewarden policies which are not context aware.

See Build and test Kubernetes API server for a manual on how to build and test API server fork with the WASM extension.

See User Documentation for a full description on how to setup and configure the extended API server.

To implement your own modules see the Module Specification. If you want to use Rust to implement the modules you can use the k8s_wasi helper library.

Links Overview

About

Extend Kubernetes with WebAssembly

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Go 75.5%
  • Rust 22.0%
  • Shell 1.4%
  • Other 1.1%