Nirmata Control Hub

Govern every cluster with Kyverno. Prove it at audit time.

Policies, exceptions, image risk and compliance in one place. From the creators of Kyverno.

Start free trial Request a demo
From the creators of Kyverno Clusters, repos and pipelines Git, Slack, Jira and ServiceNow
Nirmata Control HubChat with Copilot
Overview
Clusters12
Repositories9
Failed412
Passed2.6K
prod-us-east184 / 297
prod-eu-west96 / 252
staging71 / 338
payments-infra12 / 131
PassedFailedExample data
Policy management

Policy as code, on every cluster.

Sync policy sets from Git and roll them out where they belong.

  • GitOps sync and auto-deploy
  • Target clusters by label
  • Curated policy sets from the Kyverno team
  • Scan repos and CI pipelines
Policy SetsChat with Copilot
Pod Security Standards · Restrictedgit: platform/policies · main
12 clustersSynced
RBAC Best Practicesgit: platform/policies · main
12 clustersSynced
Image Verificationlabel: env in (prod)
4 clustersSynced
Multitenancylabel: tenant exists
6 clustersDeploying
Cost Managementgit: finops/guardrails · v1.4
9 clustersSynced
Example data
Exceptions & remediation

Exceptions with guardrails.

Approved, time-boxed and audited. Fixes go to the owners.

  • Scoped to namespace, cluster, repo or resource
  • Expire after a day, week or month
  • Approval rules with reviewers and MFA
  • Jira tickets and fix suggestions
Auto-fix with Agent Hub →
Request Policy ExceptionChat with Copilot
Legacy batch job needs hostPath until the storage migration completes in Q4.
1 day1 week1 monthOther
ns: batch-legacy in prod-us-east · policy disallow-host-path
Requestedby data-eng
Approved2 of 2 reviewers
Deployedvia GitOps
Expiresin 7 days
Example data
Images & violations

See which vulnerable images are running.

CVEs, policy violations and workloads in one view.

  • CVEs by severity for every image
  • Policy violations alongside CVEs
  • Where each image runs
  • Violations by cluster and namespace
ImagesChat with Copilot
Images64
Critical38
High412
Medium517
Policy violations7
ImageCritHighMedPolicyRunning
payments/apiv3.8.16211428
library/nginx1.25.34179–23
ml/feature-store2024.113122013
platform/ingressv1.10.0165–12
Example data
Audit-ready compliance

Audit evidence, always current.

Policies map to controls, so every scan updates your score.

  • CIS, Pod Security, PCI DSS, NIST and custom standards
  • Policy and manual control coverage
  • Per cluster, namespace or repo
  • Scheduled reports by email
ComplianceChat with Copilot
PCI DSSAt risk
72%
3 failing controls of 1283% policy coverage50% manual coverage
4 clustersScanned 2h ago
NIST SP 800-53At risk
81%
6 failing controls of 6258% policy coverage42% manual coverage
12 clustersScanned 2h ago
Pod Security · RestrictedPassing
96%
1 failing control of 48100% policy coverage– manual coverage
12 clustersScanned 2h ago
CIS KubernetesPassing
91%
4 failing controls of 4576% policy coverage24% manual coverage
12 clustersScanned 2h ago
Example data
Context graph & Copilot

Ask Copilot. It knows how everything connects.

A context graph links clusters, workloads, images, policies and owners, so Copilot can answer questions across all of them.

INFRASTRUCTURE CONTEXT GRAPH contains runs uses has owned by violates maps to prod-us-east ns: payments payments-api payments/api:3.8.1 CVE · critical (×6) team: checkout disallow-privileged PCI DSS · control 2.2 HIGHLIGHTED: THE PATH COPILOT FOLLOWED TO ANSWER
Nirmata CopilotControl Hub
Which critical CVEs are running in production, and who owns them?
Thought, used searchResource, listNamespaces ›
Critical CVEs by namespace · prod-us-east
payments6
ingress3
ml-batch2
monitoring1

payments has the most: all 6 are in payments/api:3.8.1, run by payments-api (8 pods) and owned by team checkout. The same workload also violates disallow-privileged, mapped to PCI DSS 2.2.

Fix first: move to 3.9.0 and drop the privileged flag. Want me to draft the change?

Ask Nirmata Copilot…
Example conversation
Agent Hub

AI agents on your platform team.

Agents take on the ongoing checks and hand back the fixes.

  • Security, compliance, cost and troubleshooting agents
  • On demand or on a schedule
  • Read-only analysis, fixes as pull requests
  • Reports to Slack, email and Copilot
Explore Agent Hub →
Agent HubChat with Copilot
Weekly agents · prod-us-east
RBAC AnalyzerSecurity
2 escalation paths
Compliance AuditorCompliance
SOC 2 · 88% pass
Cost AnalyzerCost
$4,180/mo to save
Resource CleanerHygiene
37 stale resources
Workload TroubleshooterReliability
3 failing workloads
Example data · reports sent to Slack
Extend Control Hub

Take Control Hub further.

nctl ai · terminal & IDE

Nirmata Assistant

Write and test Kyverno policies from your terminal or IDE.

Install nctl → Enterprise Kyverno

Hardened Kyverno in every cluster

Hardened, enterprise-grade Kyverno.

See Enterprise Kyverno →
Works with
Git & CIGitHubGitLab CITerraform Cloud
CollaborationSlackJiraServiceNow
IdentityOktaAzure ADAWS SSO

Bring every cluster under one set of policies.

Connect a cluster and see your compliance standing.

Start free trial Request a demo