# Install kwctl with Homebrew, zypper CLI tool for the Kubewarden policy engine for Kubernetes. Version 1.36.0 via Homebrew; verified 2026-07-04. ## Install ```sh sudo av install brew:kwctl ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install kwctl ``` Evidence: local Homebrew formula metadata ### Linux - zypper (92%): ```sh sudo zypper install kwctl ``` Evidence: openSUSE Tumbleweed package metadata: kwctl from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:kwctl - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.36.0 - **Source summary:** CLI tool for the Kubewarden policy engine for Kubernetes - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-07-04T16:53:43+09:00 - **Generated:** 2026-07-08T18:08:21+00:00 ## Executables - kwctl (cli) - kwctl (alias) ## Build dependencies - pkgconf - rust ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.36.0 - Package-manager updated: 2026-07-04 - Local data: ok - Upstream repository: https://github.com/kubewarden/adm-controller - Upstream latest detected: v1.36.0 (current) ## Project history and usage kwctl is the command-line tool in the Kubewarden admission-controller ecosystem. It gives policy authors and Kubernetes administrators a local way to inspect, annotate, run, benchmark, pull, push, save, and verify WebAssembly admission policies. ### Project history Kubewarden grew around the idea of using WebAssembly modules as Kubernetes admission policies. In June 2021 the project announced kwctl as a new tool for both policy authors and cluster administrators, and the December 2021 first-year recap described it as an expansion of the Kubewarden toolkit after KubeCon Europe. The CLI became the developer-facing and operator-facing workbench for Kubewarden policies: it handles OCI registry distribution, metadata annotation, policy inspection, local execution, and scaffolding around the admission-controller components that run inside a cluster. ### Adoption history kwctl's adoption follows Kubewarden's adoption path rather than a separate ecosystem. It appears in Kubewarden tutorials and how-to material as the default CLI for testing policies before applying them to Kubernetes clusters and for preparing policy artifacts for registries. ### How it is used The common package-manager use case is installing kwctl beside kubectl, Helm, and policy build tools so a policy can be pulled or run locally before a cluster admission rule is created. It is also used to annotate WebAssembly modules with Kubewarden metadata and push policies as OCI artifacts. ### Why package nerds care For package collectors, kwctl is a small but telling example of the Kubernetes toolchain adopting OCI artifacts and WebAssembly outside normal container images. It is the Kubewarden equivalent of a specialized kubectl for policy packages. ### Timeline - 2021-06-09: Kubewarden announced kwctl as a command-line utility for policy authors and Kubernetes administrators. - 2021-12-15: Kubewarden's first-year recap described kwctl as a toolkit addition released shortly after KubeCon Europe. - 2026-06-22: The 2021 kwctl announcement page carried an update date while retaining the original June 2021 publication date. ### Related projects - kwctl is part of Kubewarden Admission Controller alongside kubewarden-controller, policy-server, audit-scanner, Kubewarden policies, OCI registries, WebAssembly, Sigstore, and Kubernetes admission webhooks. ### Sources - - - - ## Security Notes infrastructure mutation or orchestration signal. - **Geiger risk:** orange / medium - infrastructure mutation or orchestration signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** kwctl - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - zypper - kwctl - 1.31.0-1.4: normalized package name match | openSUSE Tumbleweed package metadata: kwctl from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | The go-to CLI tool for Kubewarden users | https://kubewarden.io/ ## Related links - [Cloud CLI packages](https://www.automicvault.com/pkg/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [rust](https://www.automicvault.com/pkg/brew/rust/) - Build dependency declared by Homebrew. - [kyverno](https://www.automicvault.com/pkg/brew/kyverno/) - Shares av.db curated category or tags: cli, cloud-infrastructure, kubernetes, policy, policy-engine. - [polaris](https://www.automicvault.com/pkg/brew/polaris/) - Shares av.db curated category or tags: cli, cloud-infrastructure, kubernetes, policy. - [cdk8s](https://www.automicvault.com/pkg/brew/cdk8s/) - Shares av.db curated category or tags: cli, cloud-infrastructure, kubernetes. - [chaoskube](https://www.automicvault.com/pkg/brew/chaoskube/) - Shares av.db curated category or tags: cli, cloud-infrastructure, kubernetes. - [click](https://www.automicvault.com/pkg/brew/click/) - Shares av.db curated category or tags: cli, cloud-infrastructure, kubernetes. - [cloud-provider-kind](https://www.automicvault.com/pkg/brew/cloud-provider-kind/) - Shares av.db curated category or tags: cli, cloud-infrastructure, kubernetes. - [clusterawsadm](https://www.automicvault.com/pkg/brew/clusterawsadm/) - Shares av.db curated category or tags: cli, cloud-infrastructure, kubernetes. - [clusterctl](https://www.automicvault.com/pkg/brew/clusterctl/) - Shares av.db curated category or tags: cli, cloud-infrastructure, kubernetes. - [epinio](https://www.automicvault.com/pkg/brew/epinio/) - Local package facts share a topical domain. Shared terms: cli, cloud, cloud-infrastructure, engine, infrastructure. ## Combined YAML source View the package source record on GitHub. [combined/kwctl.yml](https://github.com/automic-vault/db/blob/main/combined/kwctl.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph