Case study
Razorpay meets the Reserve Bank of India’s Payment Aggregator Master Directions across more than 7,000 Kubernetes nodes by writing its regulatory controls as Kyverno policies. The same policies run in CI, at admission and in periodic scans, so every change is checked against RBI requirements and auditors see live enforcement records instead of spreadsheets.
Challenge
Razorpay processes an annualized $180 billion in payments for millions of businesses and more than 300 million consumers, and powers payments for 80 of India’s 100 unicorns. As an authorized payment aggregator, it answers to RBI’s PA Master Directions. Three requirements land directly on the platform team:
| Requirement | What it means on Kubernetes |
|---|---|
| Data localization | Transaction processing systems and their logs stay inside India, within enforced boundaries |
| Zero-trust access and microsegmentation | Core transaction clusters are isolated, with least-privilege access and segregation of duties |
| Continuous auditability | Point-in-time screenshots and spreadsheet approvals no longer count; compliance must be provable at any moment |
Razorpay used to validate these requirements with architecture reviews, deployment checklists and engineering approvals. That stopped holding at 7,000-plus nodes, dozens of commits a day and autoscaling that adds hundreds of nodes in minutes during festival sales. Reviewers could not read YAML as fast as developers shipped it, and a review of a static manifest says little about ephemeral containers that spin up and down on demand.
Razorpay still launches more than 40 products a year. Slowing that down to satisfy the auditor was not an option, so the controls had to move into the platform itself.
Solution
Razorpay worked with Nirmata to adopt Nirmata Enterprise for Kyverno, the enterprise distribution of the CNCF-graduated policy engine. Kyverno policies are Kubernetes resources written in YAML, so developers read them the way they read their own manifests. The same policies run at three points between a git push and a running container:
| Layer | Where it runs | What it catches |
|---|---|---|
| Proactive | IaC and GitOps pipelines | Non-compliant Kubernetes manifests and cloud templates, including S3 and data-residency boundaries, before anything is provisioned |
| Preventive | Kubernetes API server (admission) | Root containers, wildcard RBAC bindings, missing compliance metadata and unsigned images, at the moment of deployment |
| Detective | Periodic cluster and cloud scans | Drift, policy bypasses, and existing resources that fall out of line when a policy changes |
At the API server, Kyverno validates (a pod that runs as root is rejected with an error the developer sees in their own console), mutates (secure defaults and compliance labels are added automatically), generates (each new namespace gets an isolating NetworkPolicy and Istio authorization settings) and verifies (only images built in Razorpay’s CI pipelines and signed with Sigstore Cosign are admitted).
Mutation and generation are what make compliance the default path rather than a gate. A developer creating a namespace does nothing extra, and the namespace arrives isolated.
Results
Razorpay’s next steps are to contribute reusable Kyverno policy templates for financial regulation back to the community, use AI agents to test policies and gather audit evidence on a schedule, and build a multi-cluster compliance view on OpenReports.
Case study
Using Kyverno scale-down policies managed through Nirmata, the platform team scaled down 1,945 idle deployments across two clusters and released 579 CPU cores and 4.5 TiB of memory.
Case study
A leading quick-service restaurant chain streamlined its governance and compliance processes across multiple Amazon EKS clusters with Nirmata Control Hub, the Unified Governance Platform.
Case study
Chase UK made Kubernetes audit-ready by replacing a manual compliance process with Kyverno policies enforced in every cluster from the day it is built. Policy reports feed one Grafana dashboard for developers, security teams and auditors.
