Kubewarden Network Enforcer

Kubewarden Network Enforcer is a Kubernetes operator that observes east-west traffic between workloads, derives an allow list from what it sees, and, when you opt in, projects that allow list into a native policy on a pluggable backend (Istio ambient, Calico, or Cilium).

It operates in three phases:

  • Learn — observe traffic and generate a WorkloadNetworkPolicyProposal per workload and direction.

  • Monitor — report violations of an approved WorkloadNetworkPolicy without blocking them.

  • Protect — block traffic that violates the policy allow-list.

Getting started

Documentation map