Every change to your cluster passes through Kyverno. These are the official Helm charts for Nirmata Enterprise for Kyverno (N4K): drop-in, OSS-compatible Kyverno with backported CVE fixes for every supported release.
If you are not on the latest upstream minor, upstream is not patching your Kyverno. N4K backports fixes to every supported release, often the same day.
Each chart is published in this repository and supported by Nirmata.
nirmata/kyverno · 3.8.3 (v1.18.0-n4k)
Hardened Kyverno policy engine with backported CVE fixes, Kubernetes compatibility testing, and FIPS builds.
nirmata/kyverno-notation-aws · 2.0.0
Kyverno extension service that verifies container image signatures with Notation and the AWS Signer.
nirmata/kube-bench-adapter · v1.2.9
Runs CIS Kubernetes benchmark checks on a schedule with kube-bench and publishes the results as cluster policy reports.
Add the repository, then install the charts you need.
# Add the Nirmata chart repository helm repo add nirmata https://nirmata.github.io/kyverno-charts/ helm repo update # Enterprise Kyverno helm install kyverno nirmata/kyverno -n kyverno --create-namespace # Notation adapter (AWS Signer) helm install kyverno-notation-aws nirmata/kyverno-notation-aws -n kyverno-notation-aws --create-namespace # Kube-bench adapter (CIS benchmark reports) helm install kube-bench-adapter nirmata/kube-bench-adapter -n kube-bench --create-namespace
Same Kyverno, same policies and tooling, with the support window production clusters need.
| Upstream Kyverno | Nirmata Enterprise | |
|---|---|---|
| CVE fixes | Latest minor only | Every supported release |
| Patch window | About 3 months | 18 months |
| Engine backports | No | Yes, by the maintainers |
| Support | Community Slack and GitHub | 24/7 with SLAs for CVEs |
| Policies | Same Kyverno, OSS-compatible | |
N4K is not a fork. Nirmata created Kyverno and continues to maintain it as a CNCF project. Your existing policies, CLI, and tooling work unchanged.