Kubernetes API Access Extensions with WebAssembly

This repository explains an extension of the Kubernetes API server which allows to use WebAssembly modules to perform/extend the following actions:

• Authentication
• Authorization
• Admission (validating and mutating)

To implement this I forked the Kubernetes source code and extended the API server accordingly: https://github.com/dvob/kubernetes/tree/wasm.

The extension is not intended for production use. Its a proof of concept to show how WebAssembly could be used to extend Kubernetes.

In the fork I created a new package pkg/wasm in which I implemented an Authenticator, Authorizer and AdmissionController. Most of the implementation lives in this new package. There are only a few changes in the pkg/kube-apiserver package to add command line options which allow to enable the WASM Authenticator, Authorizer and AdmissionController.

To run the WebAssembly modules we use the Wazero runtime. Wazero has zero dependencies and does not rely on CGO. Hence it can be easy integrated in a Go project without adding a ton of dependencies.

To pass data between our extension (host) and the WASM modules we make use of the capabilities of WASI (fd_read, fd_write). The module reads the input data form standard input and writes the result to the standard output. See the Module specification for the full details on how data is passed between host and modules. For Admission the extension also supports to use Kubewarden policies which are not context aware.

See Build and test Kubernetes API server for a manual on how to build and test API server fork with the WASM extension.

See User Documentation for a full description on how to setup and configure the extended API server.

To implement your own modules see the Module Specification. If you want to use Rust to implement the modules you can use the k8s_wasi helper library.

Links Overview

• User Documentation: How to setup and configure the WASM extension
• Kubernetes Cluster Setup: How to setup a Kubernetes cluster
• Module Specification:
  • Rust module library: Rust library which simplifies the creation of WASM modules according to the Module Specification.
• Experiments (PoCs)
  • WASM
    • Runtimes: Comparison of WebAssembly Runtimes
    • Data passing (Modules, Runtimes)
  • Kubernetes Integration
    • Webhook
    • Direct in API server