NeuVector¶

Open-source (since SUSE's acquisition) zero-trust container security:

• Layer-7 network segmentation learned from observed traffic (Discover → Monitor → Protect modes).
• Runtime process/file monitoring per container.
• Vulnerability and compliance scanning (registries, running images, nodes).
• Admission control rules.
• Components: controller, enforcer (DaemonSet, the datapath), manager (UI), scanner, updater.

A good adoption path: deploy in Discover, let it learn for a representative period, review the generated rules, then move namespaces to Protect one at a time.

Kubewarden¶

CNCF policy engine where policies are WebAssembly modules — write them in Rust, Go, Rego, CEL, etc. Policies are distributed as OCI artifacts.

apiVersion: policies.kubewarden.io/v1
kind: ClusterAdmissionPolicy
metadata:
  name: no-privileged-pods
spec:
  module: registry://ghcr.io/kubewarden/policies/pod-privileged:v0.3.2
  rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["pods"]
      operations: ["CREATE", "UPDATE"]
  mutating: false

Rust developers will find writing custom Kubewarden policies natural — the SDK compiles to wasm32-wasip1.

CIS and hardening¶

• RKE2 profile: cis plus the hardening guide (etcd user, kernel params, PSA).
• Rancher's CIS benchmark app runs kube-bench and reports per-check results.
• Pod Security Admission templates can be applied per cluster from Rancher.

← Longhorn: distributed block storage · Index · Edge and OS lifecycle →