7k STARS! 🚀 Huge thanks to the Kyverno community! It's your contributions, feedback, and passion that make us the leading Kubernetes policy engine. This is a collective win. Onward to the next milestone! 🛡️ #Kyverno #Kubernetes #OpenSource #PolicyAsCode #Nirmata

The gate is on the attestation, not the digest, and it only applies when a pod is created. I created a Kyverno policy that looks at the cosign-vuln attestation (the signed Trivy vulnerability report) attached to the image's digest and requires its scanFinishedOn to be within the threshold, which I ended up setting to 720h, so 30 days. It runs at admission only, so a Job that's already running is never re-evaluated. It gets checked again at the next pod creation, so a retry, a CronJob run, a rollout, or a reschedule. Pinned golden digests don't age out, because the pipeline that refreshes those images re-attests on every scheduled run. It rescans and runs cosign attest against the published digest nightly or weekly, depending on the tier the image is in, even when the bytes haven't changed. A copa-patched image is the other case. It typically gets a new digest each run, and the old digest ages out after 30 days. That's the intended outcome, because the old digest is the unpatched one.

VCF Breakroom Chats Episode 95: Securing VMware vSphere Kubernetes Service with Nirmata and Kyverno dy.si/jSpXJu

Also new, Kyverno runtime policies: github.com/nirmata/kyverno-r…

Novo vídeo no Canal .NET -> Kubernetes + Recomendações de Segurança da OWASP: governança através do uso de policies, Kyverno... -- Link: piped.video/watch?v=BwPIZgzy… C/ @diegoonazure @AngeloBelchior #kubernetes #cybsersecurity #owasp #security #k8s #kyverno #openpolicyagent #devops

From Kubernetes Deployment to Kubernetes Security: Hardening a Cluster and Proving It Works I hardened a workload with non-root pods, a read-only filesystem, NetworkPolicy, Pod Security Standards and Kyverno, then tested every control. 🧵 #Kubernetes #DevSecOps #CloudSecurity

VCF Breakroom Chats Episode 95: Securing VMware vSphere Kubernetes Service with Nirmata and Kyverno dy.si/HM3dE

1 policy across 100 clusters. The challenge isn’t writing policy, it’s managing its lifecycle. Staged rollouts, exceptions, drift, and audit evidence all require consistent governance. 👉 bit.ly/4hDof3X 💬 How do you manage Kyverno at scale? #kyverno #Nirmata

This tutorial shows you how to secure Kubernetes with five Kyverno policies for resource limits, image tags, labels, restricted privileges, and signed container images through YAML examples ➜ ku.bz/01Vd1HLGy

Scaling #Kubernetes governance: A platform engineer’s guide to #Kyverno & #CEL Kyverno & CEL support provides #PolicyasCode for #K8s governance. Enforce security, automate guardrails, and boost developer velocity for #platformengineering teams. platformengineering.org/blog…

#Kyverno makes #Kubernetes policy enforcement painless because it natively speaks standard #YAML. Skip the headache of learning custom languages like #OPA's #Rego—you can define, validate, and mutate cluster rules using the exact same manifests you already know inside out.

#Kyverno takes the grunt work out of #Kubernetes management. By automating repetitive policy checks and manifest mutations right inside your cluster, it lets you enforce security & standards automatically without spending hours on tedious manual updates.

🚀 Less than a month to #KubeCon + #CloudNativeCon North America 2026! Nirmata is a proud Silver Sponsor. Join our sessions on Kyverno, security, scaling & AI governance. 📍 Hall 4 | Booth 278 Explore our lineup 👇 na2.hubs.ly/H08k7pg0

What’s next for Kyverno? 🚀 Join Jim Bugwadia & Justin Munoz at KubeCon + CloudNativeCon for CEL policies, migration & JPMorganChase’s adoption story. Explore the session and our event guide 👇 na2.hubs.ly/H08kKJS0 #Kyverno #KubeCon

Processing over $180B in annual payments means strict regulatory compliance at scale. Tomorrow at 9:30 AM PT on Cloud Native Live, hear how Razorpay automated security policies and moved away from manual audits using Kyverno. 🛠️ Tune in live: bit.ly/3VAdjwC

@VMware (by @Broadcom) #HybridCloud #VCF - VCF Breakroom Chats | Episode 95: Securing VMware vSphere Kubernetes Service with @NirmataCloud & @kyverno (by @anikasuri, Ritesh Patel) @VMwareVCF @vExpert #vExpertVCF dy.si/1o4krH2

Securing AI agents on #Kubernetes? 🤖🛡️ It was fun presenting at the OpenShell meetup in SJ last week alongside @zer0tweets, @AaronErickson , and Jim Meyer! Wrote a guide covering OpenShell (NVIDIA ➡️ @CloudNativeFdn), a hands-on demo with @kyverno policies, and a comparison vs agent-substrate: nirmata.com/2026/10/11/opens…

Policy should guide developers, not slow them down. This CNCF article explores how platform teams can rethink Kubernetes policy to build secure platforms while maintaining developer velocity. Read more: na2.hubs.ly/H08gycJ0 #Kubernetes #PlatformEngineering

🚀 $180B+ in annual payments. 99.99% availability. How do you ensure compliance at this scale? Join Jim Bugwadia (Nirmata) and Ashwath Kumar (Razorpay) to explore automated security policy enforcement with Kyverno. 📅 Oct 14 | 9:30 AM PT / 10 PM IST 🔔 na2.hubs.ly/H08hT7y0

Processing $180B+ in payments while meeting strict regulatory standards takes serious infrastructure work. Next Wednesday, Oct 14 at 9:30am PT, join Ashwath Kumar (Razorpay) and Jim Bugwadia (Nirmata) for a Cloud Native Live session on automating security policies at scale using Kyverno. 🛠️ We'll cover how Razorpay shifted from manual audits to continuous compliance in production. Save your spot: bit.ly/3VAdjwC

Your AI agent has access. Who sets the limits? Set clear policies, budgets, and audit controls for AI traffic with Nirmata AIControls. Control what your agents can access and how they use it. Explore AIControls → na2.hubs.ly/H08dk5q0 #AI #AIAgents #AIGovernance #kyverno