Skip to content

Nirmata Control Hub

Govern every cluster with Kyverno. Prove it at audit time.

Policies, exceptions, image risk and compliance in one place. From the creators of Kyverno.

  • From the creators of Kyverno
  • Clusters, repos and pipelines
  • Git, Slack, Jira and ServiceNow
Start free trialRequest a demo
Nirmata Control HubChat with Copilot

Overview

Clusters
12
Repositories
9
Failed
412
Passed
2.6K
  • prod-us-east184 / 297
  • prod-eu-west96 / 252
  • staging71 / 338
  • payments-infra12 / 131
PassedFailed
Example data

Policy management

Policy as code, on every cluster.

Sync policy sets from Git and roll them out where they belong.

  • GitOps sync and auto-deploy
  • Target clusters by label
  • Curated policy sets from the Kyverno team
  • Scan repos and CI pipelines
Policy SetsChat with Copilot
  • Pod Security Standards · Restrictedgit: platform/policies · main
    12 clustersSynced
  • RBAC Best Practicesgit: platform/policies · main
    12 clustersSynced
  • Image Verificationlabel: env in (prod)
    4 clustersSynced
  • Multitenancylabel: tenant exists
    6 clustersDeploying
  • Cost Managementgit: finops/guardrails · v1.4
    9 clustersSynced
Example data

Exceptions & remediation

Exceptions with guardrails.

Approved, time-boxed and audited. Fixes go to the owners.

  • Scoped to namespace, cluster, repo or resource
  • Expire after a day, week or month
  • Approval rules with reviewers and MFA
  • Jira tickets and fix suggestions
Auto-fix with Agent Hub
Request Policy ExceptionChat with Copilot
Reason
Legacy batch job needs hostPath until the storage migration completes in Q4.
For how long?
1 day1 week1 monthOther
Scope
ns: batch-legacy in prod-us-east · policy disallow-host-path
  1. Requestedby data-eng
  2. Approved2 of 2 reviewers
  3. Deployedvia GitOps
  4. Expiresin 7 days
Example data

Images & violations

See which vulnerable images are running.

CVEs, policy violations and workloads in one view.

  • CVEs by severity for every image
  • Policy violations alongside CVEs
  • Where each image runs
  • Violations by cluster and namespace
ImagesChat with Copilot
Images
64
Critical
38
High
412
Medium
517
Policy violations
7
ImageCritHighMedPolicyRunning
payments/apiv3.8.16211428
library/nginx1.25.34179–23
ml/feature-store2024.113122013
platform/ingressv1.10.0165–12
Example data

Audit-ready compliance

Audit evidence, always current.

Policies map to controls, so every scan updates your score.

  • CIS, Pod Security, PCI DSS, NIST and custom standards
  • Policy and manual control coverage
  • Per cluster, namespace or repo
  • Scheduled reports by email
ComplianceChat with Copilot
  • PCI DSSAt risk
    72%
    • 3 failing controls of 12
    • 83% policy coverage
    • 50% manual coverage
    4 clustersScanned 2h ago
  • NIST SP 800-53At risk
    81%
    • 6 failing controls of 62
    • 58% policy coverage
    • 42% manual coverage
    12 clustersScanned 2h ago
  • Pod Security · RestrictedPassing
    96%
    • 1 failing control of 48
    • 100% policy coverage
    • – manual coverage
    12 clustersScanned 2h ago
  • CIS KubernetesPassing
    91%
    • 4 failing controls of 45
    • 76% policy coverage
    • 24% manual coverage
    12 clustersScanned 2h ago
Example data

Context graph & Copilot

Ask Copilot. It knows how everything connects.

A context graph links clusters, workloads, images, policies and owners, so Copilot can answer questions across all of them.

INFRASTRUCTURE CONTEXT GRAPHcontainsrunsuseshasowned byviolatesmaps toprod-us-eastns: paymentspayments-apipayments/api:3.8.1CVE · critical (×6)team: checkoutdisallow-privilegedPCI DSS · control 2.2HIGHLIGHTED: THE PATH COPILOT FOLLOWED TO ANSWER
Nirmata CopilotControl Hub

Which critical CVEs are running in production, and who owns them?

Thought, used searchResource, listNamespaces ›

Critical CVEs by namespace · prod-us-east
  • payments6
  • ingress3
  • ml-batch2
  • monitoring1

payments has the most: all 6 are in payments/api:3.8.1, run by payments-api (8 pods) and owned by team checkout. The same workload also violates disallow-privileged, mapped to PCI DSS 2.2.

Fix first: move to 3.9.0 and drop the privileged flag. Want me to draft the change?

Ask Nirmata Copilot…

Example conversation

Agent Hub

AI agents on your platform team.

Agents take on the ongoing checks and hand back the fixes.

  • Security, compliance, cost and troubleshooting agents
  • On demand or on a schedule
  • Read-only analysis, fixes as pull requests
  • Reports to Slack, email and Copilot
Explore Agent Hub
Agent HubChat with Copilot

Weekly agents · prod-us-east

  • RBAC AnalyzerSecurity
    2 escalation paths
  • Compliance AuditorCompliance
    SOC 2 · 88% pass
  • Cost AnalyzerCost
    $4,180/mo to save
  • Resource CleanerHygiene
    37 stale resources
  • Workload TroubleshooterReliability
    3 failing workloads
Example data · reports sent to Slack

Extend Control Hub

Take Control Hub further.

Works with

  • Git & CI
    • GitHub
    • GitLab CI
    • Terraform Cloud
  • Collaboration
    • Slack
    • Jira
    • ServiceNow
  • Identity
    • Okta
    • Azure AD
    • AWS SSO

Bring every cluster under one set of policies.

Connect a cluster and see your compliance standing.

Start free trialRequest a demo