Skip to content

Solutions · Automated remediation

Turn policy violations into pull requests.

The Remediator agent in Agent Hub, part of Nirmata Control Hub, reads your Kyverno policy reports and opens a pull request with the fix. Your team reviews it and merges it like any other change.

Request a DemoSee Agent Hub
Agent Hub · remediation runChat with Copilot
  1. Violations detected38 found

    require-run-as-non-root · 6 namespaces · 3 clusters

  2. Fix proposedAgent
      securityContext:
+   runAsNonRoot: true
+   allowPrivilegeEscalation: false
  3. Pull request openedIn review

    #1207 · platform/deployments · 12 files

  4. Merged · re-scan0 violations

    Policy moved from Audit to Enforce

Example data

Your team still approves every change

  • Pull requests with the fix

    Each change arrives as a pull request or an issue in your repo, linked to the policy that flagged it and the resources it touches.

  • Move from Audit to Enforce

    Cover the workloads you already run with Kyverno policy exceptions, then enforce the policy for everything new.

  • Scheduled runs

    Run the agent on a schedule. New violations get their own pull requests as they appear, so the backlog stays small after the first cleanup.

Go deeper

Free eBookHow to Secure Production Kubernetes Environments with KyvernoPractical guidance from the Kyverno maintainers on building a policy-driven Kubernetes platform and running it in production.Get the eBook

More to read

Turn the violation backlog into merged fixes.

Request a DemoSee Agent Hub