Nirmata Control Hub

Govern every cluster with Kyverno. Prove it at audit time.

Policies, exceptions, image risk and compliance in one place. From the creators of Kyverno.

• From the creators of Kyverno
• Clusters, repos and pipelines
• Git, Slack, Jira and ServiceNow

Nirmata Control Hub Chat with Copilot

Overview

Clusters: 12
Repositories: 9
Failed: 412
Passed: 2.6K

• prod-us-east: 184 / 297
• prod-eu-west: 96 / 252
• staging: 71 / 338
• payments-infra: 12 / 131

Policy as code, on every cluster.

Sync policy sets from Git and roll them out where they belong.

• GitOps sync and auto-deploy
• Target clusters by label
• Curated policy sets from the Kyverno team
• Scan repos and CI pipelines

Policy Sets Chat with Copilot

• Pod Security Standards · Restricted git: platform/policies · main
  12 clusters Synced
• RBAC Best Practices git: platform/policies · main
  12 clusters Synced
• Image Verification label: env in (prod)
  4 clusters Synced
• Multitenancy label: tenant exists
  6 clusters Deploying
• Cost Management git: finops/guardrails · v1.4
  9 clusters Synced

Exceptions with guardrails.

Approved, time-boxed and audited. Fixes go to the owners.

• Scoped to namespace, cluster, repo or resource
• Expire after a day, week or month
• Approval rules with reviewers and MFA
• Jira tickets and fix suggestions

Request Policy Exception Chat with Copilot

• Reason: Legacy batch job needs hostPath until the storage migration completes in Q4.
• For how long? 1 day / 1 week / 1 month / Other
• Scope: ns: batch-legacy in prod-us-east · policy disallow-host-path
  1. Requested by data-eng
  2. Approved 2 of 2 reviewers
  3. Deployed via GitOps
  4. Expires in 7 days

See which vulnerable images are running.

CVEs, policy violations and workloads in one view.

• CVEs by severity for every image
• Policy violations alongside CVEs
• Where each image runs
• Violations by cluster and namespace

Images Chat with Copilot

Images: 64
Critical: 38
High: 412
Medium: 517
Policy violations: 7

Audit evidence, always current.

Policies map to controls, so every scan updates your score.

• CIS, Pod Security, PCI DSS, NIST and custom standards
• Policy and manual control coverage
• Per cluster, namespace or repo
• Scheduled reports by email

Compliance Chat with Copilot

• PCI DSS At risk
  • 72%
  • 3 failing controls of 12
  • 83% policy coverage
  • 50% manual coverage

4 clusters Scanned 2h ago

• NIST SP 800-53 At risk
  • 81%
  • 6 failing controls of 62
  • 58% policy coverage
  • 42% manual coverage

12 clusters Scanned 2h ago

• Pod Security · Restricted Passing
  • 96%
  • 1 failing control of 48
  • 100% policy coverage
  • – manual coverage

12 clusters Scanned 2h ago

• CIS Kubernetes Passing
  • 91%
  • 4 failing controls of 45
  • 76% policy coverage
  • 24% manual coverage

12 clusters Scanned 2h ago

Ask Copilot. It knows how everything connects.

A context graph links clusters, workloads, images, policies and owners, so Copilot can answer questions across all of them.

Nirmata Copilot Control Hub

Which critical CVEs are running in production, and who owns them?

Critical CVEs by namespace · prod-us-east

• payments: 6
• ingress: 3
• ml-batch: 2
• monitoring: 1

payments has the most: all 6 are in payments/api:3.8.1, run by payments-api (8 pods) and owned by team checkout. The same workload also violates disallow-privileged, mapped to PCI DSS 2.2.

AI agents on your platform team.

Agents take on the ongoing checks and hand back the fixes.

• Security, compliance, cost and troubleshooting agents
• On demand or on a schedule
• Read-only analysis, fixes as pull requests
• Reports to Slack, email and Copilot

Take Control Hub further.

• nctl ai · terminal & IDE

Nirmata Assistant

Write and test Kyverno policies from your terminal or IDE.

Hardened Kyverno in every cluster

Hardened, enterprise-grade Kyverno.

Bring every cluster under one set of policies.

Connect a cluster and see your compliance standing.