Skip to content

Solutions · Shift-left guardrails

The same policies in the pipeline as in the cluster.

Run your Kyverno policies against Terraform, Helm charts and Kubernetes manifests in CI and on every pull request. Developers see the failing rule and a suggested fix while the change is still open.

Request a DemoSee Nirmata Scanners
Policy check · PR #482View in GitHub
2 of 14 checks failing · merge blockedChanges requested
  • charts/payments/values.yamlrequire-requests-limitsFail
  • k8s/payments/deploy.yamlrequire-cost-center-labelFail
  • k8s/payments/deploy.yamldisallow-privileged-containersPass
  • terraform/eks/main.tfeks-secrets-encryptionPass

Suggested fix

  resources:
+   requests: { cpu: 250m, memory: 256Mi }
+   limits:   { memory: 512Mi }
Example data

Write the policy once. Run it in CI and in the cluster.

  • Checks in the pull request

    Results post to the pull request with the rule that failed and a suggested fix. You can block the merge until the checks pass.

  • Cost guardrails

    Require CPU and memory requests, limits and a cost-center label before a workload deploys, so spend in every namespace can be traced to a team.

  • IaC and Kubernetes, one engine

    Scan Terraform plans, Dockerfiles, Helm charts and manifests with the same Kyverno engine your clusters use at admission.

Go deeper

Free WhitepaperShift Down Security: A New Paradigm for Platform Engineering SuccessHow platform teams are building security into their internal developer platforms, and what it changes for the developers who use them.Get the whitepaper

More to read

Pipeline scanning and cost governance

In the pipeline:

  • Scan Dockerfiles, Kubernetes manifests, Terraform plans, Infrastructure-as-Code files, and cloud resources for potential misconfigurations within your preferred CI/CD pipeline efficiently and automatically.
  • Receive early feedback and remediation suggestions – empowering developers and platform engineers to address issues quickly.
  • Confidently oversee compliance across code repositories, clusters, and cloud resources.

For cost:

  • Enforce resource limits on deployments, preventing over-allocation and wasted budget.
  • Block resource-intensive deployments such as those requesting large, persistent volumes.
  • Automate the cleanup of unused resources based on labels, age, or resource consumption.
  • Integrate with OpenCost to enforce cost allocation rules for teams or projects.

Learn More

Catch misconfigurations while the pull request is still open.

Request a DemoSee Nirmata Scanners