# Nirmata Documentation — Full Content

> Last updated: 2026-04-16
> This file contains the complete content of the most important Nirmata documentation pages for AI tool ingestion (Cursor, Copilot, Claude Code, ChatGPT, Perplexity).
> Products covered: Nirmata Control Hub, Enterprise Kyverno, nctl CLI, Nirmata AI Agents, Policy Library.

---

## Nirmata Control Hub

Nirmata Control Hub provides enterprise-grade policy governance and AI agent management across Kubernetes clusters, IaC pipelines, and cloud resources. It is built on Kyverno, a CNCF Graduated project created by Nirmata.

**What's Inside:**
- Cluster Onboarding — Onboard and manage Kubernetes clusters
- Policy Hub — Policy sets, reports, exceptions, remediations, and compliance
- Agent Hub — Deploy and run AI governance agents
- Monitoring — Cluster health, activity, and alerts
- Identity & Access — Users, teams, SAML/OIDC, and API keys
- Settings — Integrations, GitHub App, Terraform, and MFA
- How-To Guides — Step-by-step workflows for common tasks

---

## Cluster Onboarding

**Applies to:** Nirmata Control Hub 4.20 and later

Learn how to onboard and manage Kubernetes clusters with Nirmata Control Hub.

### Prerequisites

Before onboarding your Kubernetes cluster to Nirmata Control Hub, ensure that your cluster is CNCF-compliant. You can onboard both cloud-provided and local Kubernetes clusters, such as kind and minikube clusters.

### Onboarding Workflow — UI Wizard

**Step 1: Add Cluster**
1. Navigate to the Clusters page in Nirmata Control Hub.
2. Click on the Add Cluster button to open the onboarding wizard.
3. Provide a name for your cluster. Optionally, add labels for better identification.

**Step 2: Choose Onboarding Method**
- **nctl (Nirmata CLI):** Recommended for users who want a streamlined process.
- **Helm:** For users who prefer Helm charts.

> Nirmata recommends using nctl with version 4.7.0 or higher for a smooth onboarding experience.

**Step 3: Verify Kyverno Health**
The wizard checks the health of Kyverno running in the cluster. If your cluster is running an older version of Nirmata Enterprise for Kyverno or open-source Kyverno, it can still be onboarded without issues.

**Step 4: Select Policy Sets**
Nirmata provides several built-in policy sets. Pod Security Standards (17 controls) are available by default during onboarding. Deploying policy sets during onboarding is optional.

**Step 5: Final Verification**
All related components must be properly installed: Kyverno (open source or enterprise), Kyverno Operator, optional Policy Sets, and nirmata-kube-controller.

### Onboarding with Helm

Add the Nirmata Helm chart repository:

```bash
helm repo add nirmata https://nirmata.github.io/kyverno-charts/
helm repo update nirmata
```

Install Nirmata Kube Controller using a User API Token:

```bash
helm install nirmata-kube-controller nirmata/nirmata-kube-controller -n nirmata --create-namespace \
  --set cluster.name=<cluster-name> \
  --set namespace=nirmata \
  --set apiToken=<nirmata-api-token> \
  --set features.policyExceptions.enabled=true \
  --set features.policySets.enabled=true
```

Install Nirmata Kube Controller using a Service Account Token (recommended for automation/GitOps):

```bash
helm install nirmata-kube-controller nirmata/nirmata-kube-controller -n nirmata --create-namespace \
  --set cluster.name=<cluster-name> \
  --set serviceAccountToken=<nch-service-account-secret> \
  --set features.policyExceptions.enabled=true \
  --set features.policySets.enabled=true \
  --set clusterOnboardingToken=<onboarding-token> \
  --set nirmataURL=wss://nirmata.io/tunnels
```

Install Nirmata Enterprise for Kyverno Operator:

```bash
helm install kyverno-operator nirmata/nirmata-kyverno-operator -n nirmata-system \
  --create-namespace \
  --set enablePolicyset=true
```

Install Nirmata Enterprise for Kyverno:

```bash
helm install kyverno nirmata/kyverno -n kyverno --create-namespace \
  --set features.policyExceptions.namespace="kyverno" \
  --set crds.reportsServer.enabled=false \
  --set features.policyExceptions.enabled=true
```

---

## Enterprise Kyverno (Nirmata Enterprise for Kyverno)

**Applies to:** Enterprise Kyverno 1.10 and later

Nirmata Enterprise for Kyverno is Nirmata's enterprise-grade distribution of Kyverno (CNCF Graduated). It is fully compatible with Kyverno OSS and provides additional reliability, security hardening, and enterprise SLAs.

**Key Features:**
- Hardened and optimized distribution with secure production-ready defaults
- 0-CVE images with regular security scanning and patching
- 24x7 support from Kyverno experts
- Enhanced nctl CLI for scanning Kubernetes manifests, Terraform, Dockerfiles, and JSON payloads
- 300+ curated policy sets for security, compliance, and best practices
- Two years of Long-Term Support (LTS) across Kyverno and Kubernetes versions
- Prioritized fixes and features for enterprise customers

**Frequently Asked Questions:**

*What is the difference between Nirmata Enterprise for Kyverno and Kyverno OSS?*
Nirmata Enterprise for Kyverno is an enterprise distribution that uses secure defaults, optimized configuration (RBAC best practices and etcd offloading enabled by default), 0-CVE images, and optional FIPS support. It is fully compatible with Kyverno OSS and designed as a drop-in replacement.

*Will I get locked in?*
No. Nirmata Enterprise for Kyverno is fully compatible with Kyverno and you can migrate back to Kyverno OSS at any time.

**Licensing:** Nirmata Enterprise for Kyverno is commercial software available under a paid Nirmata subscription. Kyverno itself is open source under Apache 2.0.

---

## nctl — Nirmata CLI

**Applies to:** nctl 3.0 and later

`nctl` is the Nirmata CLI for scanning Kubernetes manifests, Terraform plans, Dockerfiles, and JSON resources. It integrates with Nirmata Control Hub and includes `nctl ai`, the Nirmata Assistant AI agent.

**Key Features:**
1. **Shift-Left Security** — Scan Kubernetes manifests, Terraform plans, Dockerfiles, and JSON payloads in CI/CD, GitOps, and IaC pipelines before deployment.
2. **Simplified Cluster Scanning** — Scan Kubernetes clusters for misconfigurations without installing a policy engine in each cluster.
3. **Unified Governance** — Integrates with Nirmata Control Hub for centralized policy management, shared policy sets, and exceptions.
4. **Nirmata Assistant** — `nctl ai` is an AI-powered personal agent for policy development, cluster troubleshooting, and compliance management from the terminal.

**Installation:**
See https://docs.nirmata.io/docs/nctl/ for platform-specific installation instructions.

**Common Commands:**

Scan a Kubernetes manifest against a policy:
```bash
nctl scan manifest --policy <policy-file> --resource <manifest-file>
```

Scan a Kubernetes cluster:
```bash
nctl scan cluster --cluster <cluster-name>
```

Scan a Terraform plan:
```bash
nctl scan terraform --policy <policy-file> --resource <terraform-plan.json>
```

Start the Nirmata Assistant AI agent:
```bash
nctl ai
```

---

## Nirmata AI Agents

**Applies to:** Nirmata AI Agents (all tiers)

Nirmata AI Agents automate complex tasks across Kubernetes clusters, IaC and CI/CD pipelines, and cloud environments — from local development to production.

### Nirmata Assistant (nctl ai)

An AI-powered personal agent that runs on the platform engineer's workstation. Provides 15+ specialized skills for:
- Policy development and testing
- Kubernetes cluster scanning and troubleshooting
- Compliance management
- Security remediation

Start a session:
```bash
nctl ai
```

### Service Agents

Autonomous AI agents deployed inside Kubernetes clusters. Continuously detect policy violations and open GitOps pull requests to remediate them. Integrated with Nirmata Control Hub's Agent Hub.

### Cloud Agents

On-demand and scheduled AI agents launched from Nirmata Control Hub for:
- Kubernetes cost analysis and optimization
- Security auditing
- Workload troubleshooting
- Automated remediation

### AI Copilot

Context-aware AI embedded in Nirmata Control Hub. Provides intelligent insights using your cluster state, policies, and organizational context.

---

## Policy Hub

**Applies to:** Nirmata Control Hub 4.20 and later

Policy Hub is the central place in Nirmata Control Hub for managing all aspects of Kyverno policy governance across clusters.

**Capabilities:**
- **Policy Sets** — Apply curated and custom policy sets to clusters and namespaces
- **Policy Reports** — View and share policy violation reports across clusters
- **Policy Exceptions** — Manage temporary policy deviations with approval workflows
- **Auto Remediations** — Automated, context-aware suggestions for resolving violations
- **Repository Scanning** — Scan Git repositories for policy compliance
- **Compliance** — Map policy violations to compliance controls and standards (CIS, NIST, PCI-DSS, SOC 2, ISO 27001)
- **Offline Cluster Scanning** — Scan clusters without in-cluster agents using nctl

---

## Policy Library

All policies are available at https://github.com/nirmata/kyverno-policies and licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).

**Policy Sets Available:**
- Pod Security Standards (Baseline and Restricted)
- Best Practices (labels, probes, image tags, anti-affinity)
- RBAC Best Practices
- Compliance (CIS, NIST 800-53, ISO 27001, NSA/CISA, SOC 2, PCI-DSS)
- Workload Security (security contexts, capabilities, volumes)
- Image Verification (Cosign, Notary signatures)
- Terraform policies (plans, configurations, state files)
- AI Policies (AI agents, MCP servers, LLM workloads)
- GitHub Actions (workflow security, version pinning, permissions)
- Cost Management (resource limits, instance types, scaling)
- Cloud / EKS (AWS EKS best practices, cloud security)
- Multitenancy (namespace isolation, multi-tenant standards)
- Dockerfile Best Practices

### Policy Conventions

**Display Policy Category:**
```yaml
policies.kyverno.io/category: Pod Security Standards (Baseline)
```

**Display Findings Description:**
```yaml
policies.kyverno.io/description: >-
  Host namespaces allow access to shared information and can be used to elevate
  privileges. Pods should not be allowed access to host namespaces.
```

**Display Findings Severity:**
```yaml
policies.kyverno.io/severity: medium
```

**Link to Remediation Docs:**
```yaml
policies.nirmata.io/remediation-docs: "https://docs.nirmata.io/docs/policy-sets/..."
```

**Provide Remediation Suggestion (Diff):**
```yaml
policies.nirmata.io/remediation: "https://github.com/nirmata/kyverno-policies/tree/main/..."
```

**Analyzer Binding for Kyverno JSON Policies:**
```yaml
# In the match block:
($analyzer.resource.type): terraform-config
# Values: terraform-config | terraform-plan | terraform-state | dockerfile
```

---

## REST API Reference

**Applies to:** Nirmata Control Hub 4.x

Nirmata provides a REST API for integrations using any language. The API supports all operations available in the Nirmata web console and CLI.

Base URL: `https://nirmata.io/`

Authentication: API Token (passed as `Authorization: NIRMATA-API apiToken=<token>` header).

Full API documentation: https://docs.nirmata.io/docs/reference/rest-api/